You did the work. Now prove it.
Put every obligation you track — GDPR, ESG, EU AI Act — in one place, attach the evidence as you go, and export an audit-ready pack for any period. Built for compliance teams at EU and UK companies of 10 to 250 people.
Start your free 14-day trial — no credit card required. Apply your Founders code when you're ready to subscribe.
Sound familiar?
Scattered across spreadsheets
Your GDPR register, ESG data, and training records each live in a different file, maintained by a different person. When someone asks for the full picture, you're stitching it together by hand.
Deadlines slip through the cracks
Quarterly reviews, annual policy updates, monthly DSAR logs — you track them, but the tracking lives in reminders and inboxes, not in something that surfaces what's due on its own.
No proof when it matters
You did the work, but you can't show it. No timestamps, no evidence trail, no audit-ready report to hand over.
Why compliance teams use ObligoBoard
The system of record for GDPR, ESG, and AI Act obligations — evidence attached, article references built in, exportable on demand.
One record, every obligation
Every GDPR, ESG, and AI Act obligation lives in one record instead of scattered files — searchable, filterable, and current.
Deadlines surface on their own
Quarterly reviews, annual policy updates, and monthly DSAR logs are scheduled against real dates, so what's due surfaces on its own instead of living in someone's inbox.
Timestamped evidence
Every action carries a timestamp and an owner, and rolls into an audit-ready pack for any period, on demand.
One system for every obligation.
ObligoBoard consolidates your GDPR, ESG, and AI Act tracking into a single, evidence-linked record — replacing the spreadsheet-and-inbox patchwork most teams run today.
Pre-built obligation frameworks
Start with expert-designed templates for GDPR and ESG. Every obligation in the pre-built frameworks arrives with its plain-language guidance, its legal reference, and its evidence requirement attached — so what you assign travels with everything the assignee needs.
Maintain an up-to-date ROPA covering all key processing operations. Supervisory authorities can request this record at any time.
Evidence collection in one place
Upload documents, screenshots, and reports directly against each obligation. Build a timestamped evidence trail that proves you did the work.
Audit-ready evidence packs
Generate a professional compliance report covering any period. One click gives you a structured PDF with obligations, statuses, owners, and evidence — ready for your DPO, auditor, or regulator.
Your sector, your obligation mix
B2B SaaS companies
Processing customer data under GDPR? Track your obligations without enterprise-grade complexity.
Consultancies and professional firms
For managing compliance across your own practice areas, subsidiaries, or partner companies.
Fintech & insurtech
Navigating GDPR, ESG, and sector-specific requirements with a lean team.
Manufacturing & industrial SMEs
Facing ESG questionnaires from enterprise clients? Get ahead of CSRD with structured tracking.
Agencies & compliance service providers
For managing client compliance with isolated sub-accounts and white-label branding. Multi-client workspaces, per-client billing, and your own brand on the user-facing app.
Up and running in under 15 minutes
Pick a framework
Choose GDPR, ESG, EU AI Act, or UK Business Compliance. Your obligation board is pre-populated with expert-designed tasks.
Assign and track
Give each obligation an owner and a deadline. Colour-coded statuses and a programme completeness score show what needs attention.
Collect evidence and export
Upload files, add notes, and generate audit-ready PDF reports whenever you need them.
Built on the regulations that matter
Frameworks mapped to current law
Pre-built obligation sets for EU & UK GDPR, CSRD/ESRS, EU AI Act, and UK Business Compliance — each with the relevant article references, and maintained as the rules change, including the 2026 AI Act deadline shifts.
Audit-ready by design
Every change is timestamped. Every obligation links to its evidence. One click generates a structured PDF report ready for your DPO, auditor, or supervisory authority.
Hosted in the EU, transfers disclosed
The application and its database run in Frankfurt (Vercel, Neon eu-central-1), encrypted in transit and at rest. A few sub-processors — transactional email and payment processing among them — process limited personal data outside the EU under EU Standard Contractual Clauses. Each is named on our security page with its region and transfer mechanism.
How we host and transfer your dataBuilt for EU & UK compliance teams — GDPR, ESG, and AI Act, article by article.
Founder and operator
Mirko Grewing
Florence, Italy
I built ObligoBoard after watching EU and UK compliance teams lose hours to spreadsheets, scattered deadlines, and last-minute audit panic. I’m Mirko Grewing, founder and operator, based in Florence, Italy. I believe compliance should be clear, honest, and manageable without enterprise bloat or sales pressure. ObligoBoard gives small teams one place to track GDPR, ESG and EU AI Act obligations, collect evidence, and face audits with proof — not promises. Built in Europe, for teams who need clarity, not chaos.
Built for compliance consultancies
Multi-client workspaces, white-label branding, and a single bill.
Managing compliance for multiple clients? Founding Agencies gives compliance consultancies 25% off Agency for 18 months.
See Founding Agencies →Simple, transparent pricing
No hidden fees. Cancel anytime.
Starter
- 1 organisation
- Up to 5 team members
- 1 compliance framework of your choice
- Evidence collection & audit trail
- Evidence pack export
- Email reminders
- Risk assessment & scoring
- Document generators
Pro
- Up to 5 of your own organisations (e.g., subsidiaries, practice areas, holding companies)
- Up to 10 team members per organisation
- All available frameworks
- Evidence collection & audit trail
- Evidence pack export
- Email reminders
- Risk assessment & scoring
- Document generators
- Priority email support
Agency
For compliance consultancies, fractional DPO firms, and multi-client legal or accounting practices managing multiple clients. Multi-tenant with white-label branding. One slot = one active SME organisation.
- Unlimited sub-account workspaces (10-slot floor)
- Volume pricing — your bill drops as you grow
- White-label: logo, colour, footer + custom domain
- Single billing across all client workspaces
Start your free 14-day trial — no credit card required. Apply your Founders code when you're ready to subscribe.
Prices exclude VAT. Italian customers are charged 22% VAT; EU/UK businesses with a valid VAT number are reverse-charged.
Are you a compliance consultant or multi-client practice? Learn about Founding Agencies →
Frequently asked questions
ObligoBoard is a lightweight compliance tracker built for EU & UK SMEs. It helps you manage GDPR, ESG/CSRD, EU AI Act, and UK Business Compliance obligations in one place — with pre-built frameworks, evidence collection, and audit-ready reports.
Any EU or UK SME (10–250 employees) that handles personal data or faces ESG reporting requirements. Common users include B2B SaaS companies, professional services firms, fintechs, and manufacturers.
A record you can hand over. ObligoBoard assumes you know what your organisation owes — it gives you somewhere defensible to track it, attach evidence against it, and export it. Every obligation in the pre-built frameworks carries its article reference and its evidence requirement, so what you record is structured for the question an accountability request actually asks: which rule, who owns it, what proves it.
Yes, and that is the point of the guidance layer. When you assign an obligation from a pre-built framework, the plain-language explanation, the legal reference, and the evidence requirement travel with it. Your colleague can complete the task without a briefing from you, and you keep the audit trail.
The application and its PostgreSQL database run in the EU (Frankfurt) on Vercel and Neon, and data is encrypted in transit and at rest. We process your personal data on your documented instructions, not for our own purposes. Running the service does involve a small number of sub-processors — hosting, database, payments, transactional email, file storage and the cookie scanner — each under an Article 28 processing contract and each named, with its region and transfer mechanism, on our security and sub-processors pages. Where a sub-processor processes data outside the EU, that transfer is covered by EU Standard Contractual Clauses.
Yes. Both plans are month-to-month with no long-term commitment. Cancel from your billing page at any time.