In short
Demonstrable compliance means you can show at any moment that your measures work: who had access, what was shared, which policy applied and when action was taken. In 2027, NIS2 (in the Netherlands the Cybersecurity Act), DORA, the AI Act and the Cyber Resilience Act explicitly ask for this. The pitfall is that organisations respond with more reports and more complex processes. That does not make them more resilient, only slower. If you translate policy into simple, enforceable measures that produce evidence automatically, you meet the rules without slowing your organisation down.
Updated on 4 November 2026
The key question is shifting. No longer “are we compliant?”, but “can we prove it every day?”. Regulators, auditors, clients and board members do not want to see a policy document, but evidence that processes work in practice.
At the same time, the risk grows that compliance becomes a goal in itself. Teams spend more time reporting than improving, and employees look for workarounds as soon as processes become too complicated. This article explains what demonstrable compliance means in 2027, where it often goes wrong and how to put it into practice.
What is demonstrable compliance?
Demonstrable compliance is the extent to which an organisation can show with objective evidence that its measures work. So the question is not whether there is a policy, but whether you can reconstruct what happened: which control applied, who had access, which action was taken and with what result.
That evidence consists of logs, audit trails, reports and recorded decisions. The more of it is created automatically in daily work, the less time you spend collecting it afterwards.
What changes for demonstrable compliance in 2027
In a short time, compliance has changed from a legal concern into an operational one. For its Chief Ethics and Compliance Officer Survey 2025, KPMG surveyed 105 compliance officers of the largest Dutch companies in late 2024. They expect more scrutiny and higher regulatory expectations in the coming years. New regulations and the accuracy and completeness of data are the biggest challenges they name. Data privacy and cybersecurity top their improvement priorities, and most expect a higher technology budget.
2027 is not a year of new laws, but of testing. The rules are in place. Now the question is whether they work in practice:
- NIS2 and the Dutch Cybersecurity Act (Cbw): in force in the Netherlands since 15 August 2026, for over 8,000 organisations in 18 sectors. 2027 is the first full year in which the law applies. It requires registration with the NCSC, risk management, incident reporting and accountability at board level. Read more in the Cybersecurity Act and admissibility of evidence.
- Critical Entities Resilience Act (Wwke): took effect together with the Cbw, implementing the EU CER Directive. Around 500 organisations have been designated as critical entities.
- DORA: applicable in the financial sector since 17 January 2025, with requirements for ICT risk management, incident reporting, resilience testing and oversight of critical ICT providers. Read more about DORA and secure file sharing.
- AI Act: the transparency obligations have applied since 2 August 2026. After the Digital Omnibus, the rules for stand-alone high-risk AI apply from 2 December 2027, and for AI in regulated products from 2 August 2028 (overview of the new deadlines).
- Cyber Resilience Act (CRA): the reporting obligation for manufacturers has applied since 11 September 2026, most obligations from 11 December 2027. Even if you are not a manufacturer, it will affect how you buy software and connected products.
- GDPR: remains the foundation for everything involving personal data. Read more about the GDPR and secure file sharing.
Free management guide: Demonstrable compliance in 2027
The 2027 regulatory calendar, the four-layer model, a self-assessment with ten control points and a quarterly roadmap, in one 15-page guide for board members and compliance officers. Download the guide (pdf)
The compliance paradox: more reporting, less resilience
In sustainability circles there is a term for this: the “green lie”, where companies spend more time reporting on sustainability than actually innovating. Erik Jager described on Marketingfacts (Dutch source) how the growing focus on reports, audits and control slows innovation down. The same applies to compliance and security.
A strong psychological mechanism is at work in the boardroom: avoiding loss weighs more heavily than the ambition to win. Fines, data breaches and reputational damage are concrete, while innovation feels uncertain. The result is a culture of risk avoidance instead of risk management.
“You can’t innovate in an organisation that spends all its time avoiding tomorrow’s fine. We’ve forgotten that compliance is meant to make us better, not just safer.”
Thijs van der Linden, COO of Msafe
This creates a digital form of red tape: processes that mainly exist to prove that they exist. That has the opposite effect of what lawmakers intend:
- attention shifts from detection to documentation;
- new technology gets stuck in the pilot phase;
- budget goes to audits instead of prevention.
The security world learned this lesson long ago: a system can be fully compliant and still vulnerable. Following the rules is necessary, but not sufficient.
Complexity is the biggest enemy of compliance
Compliance rarely fails because there is no policy. It fails because policy becomes too complicated in practice. As soon as employees have to deal with cumbersome processes, extra steps and separate portals, they look for a faster route. A personal cloud account, an unmanaged link, a free transfer service: it feels efficient, but the organisation loses sight of access, logging and retention. That is why the UK NCSC explicitly calls shadow IT a risk.
The human factor weighs heavily. According to the Verizon Data Breach Investigations Report 2026, around 62% of the breaches studied involved a human element, such as an error, misuse or social engineering. That does not mean people are the problem, but that processes depending on perfect human behaviour remain vulnerable.
The Police Service of Northern Ireland showed how small such a mistake can start. Hidden data in a spreadsheet led to the disclosure of personal data of 9,483 officers and staff. In October 2024 the UK regulator ICO imposed a fine of £750,000 and stressed that simple procedures could have prevented the incident.
The lesson: the secure route must also be the easiest route. Otherwise the workaround almost always wins. Also read why security awareness training only works when the process itself is simple.
Demonstrable compliance in four layers: Policy, Access, Use, Evidence
Demonstrable compliance does not come from a single tool, but from how the parts fit together. We use four layers for this.
1. Policy
Record policy, the risk register, controls and owners in a GRC or ISMS environment. Map your controls to frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework, so one set of measures covers several laws. For each control, also define its purpose: not the checklist, but the intent behind the control determines its impact.
2. Access
Decide who may access which information, internally and externally. Think of Single Sign-On and MFA as standard, automatic joiner and leaver processes via SCIM, and agreements with third parties on security and logging. Access that is no longer needed should expire automatically.
3. Use
This is where most risks arise: in daily collaboration and file sharing with clients, suppliers, auditors and supply chain partners. Choose ways of working that fit seamlessly into daily work, so nobody has a reason to turn to email attachments or free tools.
4. Evidence
Make sure every relevant action automatically leaves a trace, and that you can export that evidence to your SIEM or GRC environment. A practical tip: use fixed IDs per control in all your systems. That way you can trace every log entry directly to the measure it belongs to.
Three lessons from the security domain
- Make risk dynamic, not static. Security reassesses risks continuously based on behaviour and context. Replace the annual tick-box audit with ongoing monitoring of processes and data.
- Automate the burden of proof. Security teams collect evidence automatically via SIEM and GRC. Connect logs and reports through an API, and spend the time saved on improvement.
- Think like a security architect. Do not build one big control, but several layers that reinforce each other. That creates resilience instead of bureaucracy.
The role of secure file transfer in demonstrable compliance
The KPMG survey shows that third-party oversight, due diligence, monitoring, reporting and investigations are becoming more important. These are exactly the processes in which sensitive documents move between departments, auditors, clients and suppliers. If you do not organise those document flows in a controlled way, a gap opens up between compliance policy and its execution.
Secure file transfer is therefore not a separate IT topic, but a practical compliance measure. Msafe Secure File Transfer directly covers three of the four layers:
- Policy: central rules for retention periods, expiry dates and which file types may not be shared.
- Access: Single Sign-On via Microsoft Entra ID, SCIM, MFA and verification of external recipients, even without an account via Easy Download. Access can be revoked.
- Evidence: a complete audit trail per file and exportable reports for auditors and regulators. In a shared space, everyone can see what happens to a document.
And because employees simply share from Outlook with the Msafe Connector, the Use layer stays simple too. Msafe is certified to ISO/IEC 27001:2022 and hosted in the Netherlands. A tool never makes an organisation automatically compliant, though: that also takes policy, risk assessment and processes. Read more about sharing with external parties in secure file and document sharing with external parties.
Five steps to demonstrable compliance
- Define scope and deadlines. Which laws apply to your organisation: NIS2, CER, DORA, the AI Act, the CRA, the GDPR? And which deadlines fall in 2027?
- Make your GRC or ISMS environment the backbone. Record controls, owners, review moments and reports.
- Secure the exchange of information. Choose secure file transfer with a complete audit trail.
- Automate the burden of proof. Connect identity management, SIEM, privacy and supplier management to your GRC environment.
- Practise and improve. Run tabletop exercises and discuss the results with the board regularly.
Checklist for board members
- Incident reporting processes are in place, with the legal deadlines.
- There is a dashboard with the current status per control and open issues.
- File exchange produces exportable, forensically usable logs.
- The record of processing activities and DPIAs are up to date and linked to projects.
- Third parties have been checked contractually on security and logging.
- Retention and back-ups are policy-driven and demonstrably tested.
- Awareness is tailored to roles and measurable.
- Evidence for an auditor or regulator is available within a day.
Want to dive deeper? Download the management guide Demonstrable compliance in 2027 (pdf) or read the interview on proving compliance without complexity.
Frequently asked questions about demonstrable compliance
What is demonstrable compliance?
Demonstrable compliance means you can show with objective evidence, such as logs, audit trails and reports, that your measures work in practice. Not only that there is a policy, but that it is followed.
How do you combine innovation with compliance without slowing down?
By removing complexity from daily processes and letting evidence arise automatically. Choose measures that are as easy as the insecure route, automate reports and spend the time saved on improvement rather than extra control.
What does NIS2 require in practice?
Registration with the regulator, appropriate risk management measures, timely reporting of significant incidents and accountability at board level. Above all, you must be able to demonstrate that those measures work.
What does DORA change for financial institutions?
Since 17 January 2025, uniform requirements apply for ICT risk management, incident reporting, resilience testing and oversight of critical ICT providers.
What changes for compliance in 2027?
2027 is the first full year under the Dutch Cybersecurity Act and the Critical Entities Resilience Act. On 2 December 2027 the AI Act rules for stand-alone high-risk AI take effect, and on 11 December 2027 most Cyber Resilience Act obligations. Supervisors are moving from explanation to testing.
When do the AI Act rules apply?
Prohibited practices have applied since February 2025 and transparency obligations since 2 August 2026. The rules for high-risk AI have been postponed to 2 December 2027, and for AI in regulated products to 2 August 2028.
Is EU hosting mandatory under the GDPR?
No. The GDPR does not require storage in the EU. Transfers outside the EEA are allowed under conditions, such as an adequacy decision or standard contractual clauses. EU hosting can reduce risks, however.
Does secure file transfer automatically make an organisation compliant?
No. Secure file transfer supports measures such as access management, encryption, retention periods and logging. Compliance also depends on policy, risk assessment, configuration and processes.
Demonstrable compliance, without extra complexity
In a short demo we show how to share sensitive documents with external parties, with central policy, revocable access and an audit trail that auditors and regulators can use directly.
