Your whistleblowing channel now has a supervisor.
With Spain's whistleblower protection authority up and running, the ethics@ mailbox and the spreadsheet no longer pass: Ley 2/2023 requires technical anonymity, watched deadlines (7 days / 3 months) and evidence of every step — with fines of up to €1,000,000.
From a tick-box channel to one that stands up to the regulator.
«¿Cuántas Declaraciones UE de Conformidad ha emitido ya?»
El PPWR no pide un sistema de gestión: pide un expediente de conformidad por cada tipo de envase, con su documentación técnica y su Declaración UE. Y el obligado no siempre es quien fabrica el envase — también quien lo llena, quien encarga su fabricación o quien lo vende bajo su marca.
Estar adherido a un SCRAP responde a «soy productor». No responde a «soy fabricante».
«El 14 de marzo, ¿su modelo estaba implementado?»
Ninguna de las leyes exime por tener un modelo de prevención: todas exigen que estuviera efectivamente implementado antes del hecho. Y esa pregunta se contesta mirando hacia atrás, no mirando el estado de hoy.
España · Chile · Colombia · Perú · Brasil — una matriz, cinco marcos legales.
From paper to evidence. In every country you operate in.
La pregunta del inspector no cambia al cruzar la frontera — «demuéstreme que el control existía y se ejecutaba» — pero sí cambia la ley que se la permite hacer. Un sistema de gestión, y encima la norma de cada jurisdicción, con su plazo y su sanción.
Six jurisdictions · seven ISO standards · one file that proves all three.
Without due diligence, your goods don't enter the EU.
Cacao, café, soja, madera, caucho, palma y vacuno: el EUDR exige geolocalización de parcelas, análisis de riesgo y declaración de diligencia debida para vender, importar o exportar en la UE. DSA Compliance ya incluye módulo EUDR con verificación satelital de parcelas.
Geolocate · Verify · File — before December.
Your company already uses AI. Since 2 August, that is regulated.
Copilots, chatbots, CV screening, scoring… The AI Act requires a system inventory, documented training (art. 4) and logged human oversight — with fines of up to €35m or 7% of global turnover. DSA Compliance turns it into a live control with dated evidence.
Inventory · Train · Document — before the regulator asks.
Chile gets a data protection regime. With an agency, and with fines.
For the first time, data protection in Chile will have real supervision: its own agency, fines of up to 20,000 UTM, and an infringement prevention model that mitigates liability. The processing register, the rights procedures and the breach protocol get built now — not in December.
The GDPR standard, landed in Chile — and you can arrive with the work already done.
Ley Karin is being adjusted. What it actually demands isn't.
The admissibility filter the labour ministry is preparing will send back to the company any dispute that isn't harassment — and it will have to be handled internally, with a protocol, deadlines and evidence. 993 fines and 2,117 inspections in 5 months set the bar.
Whatever the labour inspectorate sends back, your company will have to resolve — and prove it.
Free · 1 hour · you leave with your obligations, your gaps and your roadmap
Already certified? Your management system, with each country's law on top
The ISO standard is international; the law changes at every border. One management system answers to Act 20.393 in Chile, art. 31 bis in Spain, Act 2195 in Colombia, Act 30424 in Peru and Lei 12.846 in Brazil. Here is the full map, standard by standard.
Certification does not comply with the law — it evidences a management system, and the authority weighs the proof that it was working. What it saves you is running one system per country.
Compliance software that you operate. Not a law firm, not an auditor, not a certification body.
DSA Nexus builds it and maintains it. Your organisation's record is yours — and you take all of it whenever you want.
Four frameworks with an enforceable penalty regime in 2026
The competent authorities are already constituted and have enforcement powers: AIPI for the whistleblowing channel, AESIA for AI systems, the AEPD for data protection and Chile's Dirección del Trabajo for Ley Karin.
Spain's whistleblower authority has been operating since Sep 2025 and already penalises missing or defective channels.
Spain's AESIA has been enforcing since Aug 2026, up to €35m or 7% of global turnover.
993 fines and 2,117 inspections in just 5 months. No minimum headcount.
The GDPR penalty regime. In Chile, Ley 21.719 takes effect in Dec 2026.
European regulation runs ahead of Latin American regulation. Your compliance can run ahead too.
Every European framework finds its mirror in Latin America a few years later. The platform maps both regimes — Spain, Ecuador, Colombia, Chile, Argentina, Bolivia, Dominican Republic, Peru, Brazil and Mexico — so you implement once and comply on both continents.
Six solutions on one core
Each solution groups the programs of one area and is bought separately. They all share the same file-and-evidence core, so the second one is implemented on top of what you already configured. Hover over one.
The art. 5 whistleblowing channel of Ley 2/2023, the art. 31 bis criminal model and the AI system inventory, on one file.
Where is your group non-compliant, and under which rule?
The same obligation doesn't say the same thing in every country. The whistleblowing channel is imposed by Ley 2/2023 (Spain · whistleblowing) in Spain and by Ley 21.643 (Chile · Ley Karin) in Chile; in Brazil it doesn't exist as a general obligation. A dashboard that paints in red what isn't even enforceable stops being looked at by week two.
- Eight obligations × seven jurisdictions, each cell with the rule that requires it. What doesn't apply reads as “not applicable”, not as a fail.
- Each user sees their own. The group director sees all five subsidiaries; the Chile lead sees only Chile. Viewing and operating are granted separately.
- One contract, not five. The dashboards, the calendar and the channels fold either way: consolidated or subsidiary by subsidiary.
Four ways to use the same platform
Answering for your own compliance is not the same as answering for that of ten clients. The platform covers both, and the price and the contract change accordingly.
See eight cases by sector →Training, AI agents and professional services, built into the same platform
AI agents — DSA SmartAgent
Agents with local inference and a document base isolated per entity, trained on your procedures and the applicable rules. They propose and cite the source; the decision is recorded in a person's name.
Meet the agents →Training and Awareness
Campaigns by role, country and rule, with assessment and a verifiable individual certificate. Covers art. 4 of Regulation (EU) 2024/1689 and art. 19 of Spain's Ley 31/1995.
Explore the solution →Professional services
Lawyers, auditors, expert witnesses, data protection officers, ethical hackers and surveyors vetted by DSA Nexus, with a signed engagement letter and deliverables tracked on the file.
Explore the marketplace →A report comes in at 09:12. Here's what happens next.
No step depends on somebody remembering: the system counts the statutory deadlines and every action is sealed.
- 01 The reporter files without giving a name They come in through the web channel, choose real anonymity and leave with a tracking code. No IP logging, no metadata.
- 02 The case lands in the inbox with its clock already running Acknowledgement within 7 days and resolution within 3 months, counted by the system and sorted by how close the deadline is.
- 03 The case handler works the file Facts, witnesses, the person named, classification and applicable rule. A conflict of interest locks out the line manager.
- 04 Every action is sealed User, date and time in a tamper-proof log, with the statutory deadlines met alongside. This is what you show the authority.
- 05 The compliance body sees the whole picture Open cases, deadlines at risk, the most reported conduct and the measures taken — the annual report, already written.
The fine is the consequence that gets published. It isn't the only one
An enforcement case has effects that never make the headline and that last for years: on public procurement, on directors' liability, and on the company's standing as a supplier to large clients.
What separates a request you close in a week from a full enforcement procedure is being able to produce dated evidence that the control existed and was being run.
For information only; this is not legal advice.
What your committee will ask
Four answers you normally have to drag out of a sales call. They are here because whoever signs the purchase is rarely the one making the call.
You start with one programme, not all of them: registering companies, the obligations that apply, people and owners. That is weeks, not months. What sets the timescale is not the tool — it is deciding who answers for what, and that has to be decided anyway.
They are loaded. Master data —people, sites, suppliers, risks— comes in by import, and the document history is uploaded to the repository keeping its date. Nothing forces you to start from scratch, and whatever is not migrated stays accessible until it is no longer needed.
Documents are encrypted at rest and every access leaves a trail: who opened what and when. Isolation between companies is not a check repeated on every screen but a condition of the store itself. DSA Nexus is the processor, with the GDPR art. 28 agreement signed from day one and the hosting location stated in writing.
You take your data with you. Full export of case files, evidence and documents in open formats, whenever you want and without asking. A system that proves compliance cannot be the one holding your evidence hostage.
How much regulatory exposure do you have open today?
Six questions, an honest answer. Nobody else sees the result.
Every “no” marks an obligation you couldn't evidence today if you were asked.
Your obligations, your gaps, your roadmap
A free one-hour session with a digital compliance consultant. You leave knowing exactly where you are exposed and what to close first — whether you buy or not.
Book my free assessment →No commitment · straight into the consultant's calendar