- DORA, NIS2 and the EU Cyber Resilience Act joined the crosswalk.
- Japan added APPI, the AI Promotion Act and the METI/MIC AI guidelines.
- In production on 22 August 2026, taking the count to 28 frameworks.
What’s new
In August 2026 DORA, NIS2, the EU Cyber Resilience Act and three Japanese frameworks took the count to 28. The Japanese additions are the Act on the Protection of Personal Information (APPI), the AI Promotion Act and the METI/MIC AI guidelines.
Why it matters
Before this change the crosswalk carried only the EU AI Act and GDPR for Europe, and had no Japanese coverage.
DORA has applied since 17 January 2025, and the Cyber Resilience Act’s Article 14 reporting obligations have applied since 11 September 2026.
How it works
DORA and NIS2 were brought into the scored crosswalk. At the same time, the platform stopped letting an organisation switch on a framework it cannot yet score.
The Cyber Resilience Act, which applies to makers of software and connected products, was added with six controls.
Japan brought a Japanese personal-data pattern pack for My Number, residence cards and Japanese passports. The My Number check uses the official checksum and also needs a naming word nearby, because in testing the checksum alone passed 9.95% of random 12-digit strings.
On kapalins.com, the notification clocks include a 24-hour early warning and a 72-hour notification under both NIS2 and the Cyber Resilience Act, and DORA’s initial, intermediate and final reports.
Availability
The six frameworks reached production on 22 August 2026. Kapālins now maps controls across 42 compliance frameworks in 15 jurisdictions plus global standards, with 217 controls, 93 of them read live from the platform.
Compliance & Evidence is included in the Growth plan, and Fortress adds assurance on top.
