Ciber-AsesorIA/ST - Regulatory compliance assessment engine

At the core of the module is a graph linking the articles of NIS2 and DORA to the Spanish ENS controls that satisfy them. Pick an article and you will see which controls it demands. This is the real data from the thesis graph, kept in the original Spanish and EU wording.

• Principle of Maxima resolved in Cypher over Neo4j: for each control it selects the strictest requirement across the three frameworks, combining floors, reinforcements and exclusions
• Deterministic inference by graph query, kept apart from the LLM stages: the verdict can be reconstructed and explained
• Anti-false-positive LLM judge that filters the candidates coming out of the semantic search, degrading in a controlled way to the top 3 by similarity if the model fails
• Conversational agent that turns each requirement into business language and audits it one requirement at a time
• Deterministic 1–10 score, verdict cache shared between controls and a per-session audit trail
• CITAD module to classify the organisation's ENS category
• Validation by invariants derived from the regulatory specifications, not from the engine's own output: 346 checks (33 unit tests, 142 from the NIS2 PCE, 135 from DORA, 36 on dimensional weighting) plus 1,572 cross-mode comparisons, all satisfied
• The test batteries uncovered real defects in the scope of the NIS2 exclusions and in the ENS–DORA crosswalk, and made it possible to fix them
• Analysis of how it fits the AI Act (Regulation (EU) 2024/1689): transparency-obligation tier, with determinism, traceability and a human in the loop
• All 9 specific objectives met

Ciber-AsesorIA is a joint project made of two subsystems. My thesis is the ST module (inference engine, assessment agent, CITAD and the integration with the Coordinator), plus the CITAD and Autopilot pieces of the frontend. The SN module and the rest of the frontend are the work of my project partner, Laura.