Skip to main content
How we work

We take a regulated build from your idea to a running, compliant service.

We decide what your system must do, and we build it, so the same people carry each decision through to execution. You take part in each decision as we reach it, while it is still open to change. This continues for the length of the build, however long the system and its regulatory requirements make that build.
White
Fill
The standards that govern the whole cycle sit in the bands, not on a station. Pinning ISO 9001 to Release, or ISO 31000 to Assess, would say something about them that is not true. An overlay adds a regime's own instruments per station, moves the weight, and in three lanes changes the shape of the cycle itself.

  • Understand

    the people, the use, the obligation · ISO 9241-210 — our choice

  • Assess risk

    what can go wrong, and the rigour it buys

  • Build

    the system and its record, together · NIST SSDF

  • Verify

    by someone who did not build it · IEEE 1012

  • Release

    nothing goes out until the plan is met

  • Operate

    run it, and keep the record current

  • Retire

    end of support, and what the record owes

Why the bands exist

Six standards define the cycle rather than sit inside it. Drawing one under a box claimed it governed a single act. They govern all seven.

Why Retire is a station

12207's technical processes end in disposal, and six frameworks land there with nowhere else to go, including the CRA support period and the Data Act's exit rights.

Three lanes change the shape

AI spreads risk across every station. Blockchain strikes the closing arc, because a deployed contract cannot take a fix. Cloud fuses build to operate into one pipeline.

What is deliberately absent

No V. It is current in automotive and wrong for AI and cloud, so it cannot carry a cycle claiming to hold in every lane.

Band and station placement follow the framework matrix, verified at the level of a framework's stated scope and not clause by clause. ISO 9241-210 is marked as our choice, not an obligation, because no regime mandates it outside the IEC 62366-1 context. Independence is claimable in the IEEE 1012 technical sense — the reviewer did not write the thing — and not in the managerial or financial sense, being the same firm and the same budget.

We build regulated software the way a design studio builds a product.

A design studio starts from the people who will use the product and shapes the design around how they actually work. It works the constraints it is handed, a brand or a fixed budget, into the product itself, and checks the result against how people actually use it. We start from the people who operate your system and the assessor who reviews it, working its regulation into the design as material so it becomes part of the system itself. Tested against how the work is really done, the system holds up to the assessor's review, and the people who operate it use it.

The first step is a conversation about where your system stands. The first deliverable is the User Requirements Specification.

Schedule a conversation

Or read a build already in production: the compliance layer we run for Concordium's AI agents. See the engagement