Run a gap analysis

Gap analysis reads a regulation's text and extracts the individual requirements inside it, so you can track each one to a met / partial / gap verdict instead of treating the whole rule as one blob. It is rolling out gradually — if you don't see it yet, contact support for early access.

Start the analysis

1. From the item detail page (see View your first risk score), click Run gap analysis.
2. ACE extracts candidate requirements from the regulation's text. Each extraction is fenced against prompt injection — text from a source is data, never instructions.
3. The extracted list replaces any previous requirement set for that regulation. ACE tells you how many requirements and mapped controls will be replaced before you confirm.

Review and decide

Extraction gives you the obligation list; the verdicts are yours. For each requirement you can:

• Set a status — Met, Partial, or Gap.
• Add an assessment note — how you decided, e.g. “off-platform control in our claims system satisfies this”. Notes are not registry evidence.
• Map a control — pick one of your registered controls and record why it satisfies the requirement. That rationale is audited.
• Link evidence — point at a document in your evidence registry via the API.

Remediation tasks

Every extracted requirement that lands as a new gap gets an open remediation task automatically, linked back to the source regulation.

What to do next

The tasks show up in the Remediation queue. From here, the next guide shows you how to invite a teammate to take ownership of the work — useful when legal, operations, or product need to weigh in on a single gap.