How ARGOS works
ARGOS turns each legal obligation into a test that runs on your real systems. This is how a verification campaign works.
Inventories and classifies
Discovers your systems, locates personal data and maps where it flows, using read-only connectors.
Challenges the systems
Introduces synthetic subjects, exercises test access and erasure requests and checks whether deletion really happens.
Issues verdicts
A deterministic rules engine evaluates every piece of evidence. The AI model proposes; it never decides the verdict.
Signs the evidence
The report is issued as a verifiable credential: a third party can check its integrity without seeing the data.
Which regulations it verifies
The complete European data regulatory package, plus the reference security frameworks.
- GDPR and LOPDGDDAccess, transfers, retention, effective erasure and transfers outside the EEA.
- EHDSRegulation (EU) 2025/327 on the European Health Data Space.
- AI ActRegulation (EU) 2024/1689: event logging, transparency and human oversight.
- NIS2Cybersecurity measures and incident management.
- Data Act and DGAData access and sharing.
- ENS and ISOSpain's National Security Framework (RD 311/2022), ISO 27001 and ISO 27701.
Key dates on the calendar
- 2 August 2026The AI Act is now generally applicable.
- 26 March 2027General application of the EHDS, with phased obligations until 2035.
- 2 December 2027Obligations for high-risk AI systems in Annex III.
- 2 August 2028High-risk obligations for AI embedded in products (Annex I).
The high-risk dates are those of Regulation (EU) 2026/1744 (the “digital omnibus on AI”), which postponed the August 2026 and 2027 deadlines.
What you receive at the end of each verification
Working documents for the DPO and the CISO, generated from the real state of the systems.
Compliance report
Each control with its evidence and its verdict.
Remediation plan
Findings ranked by priority, with the rule they breach.
Differential RoPA
Record of processing activities generated from the real catalogue, compared with the declared one.
Draft DPIAs
Impact assessments with the risks detected.
Verifiable credential
The signed report (W3C) within the Gaia-X trust framework.
ARGOS compared with other tools
It does not replace your governance platform or your auditor: it provides the technical evidence they lack today.
| What it checks | Annual audit | GRC platforms | Data discovery | ARGOS |
|---|---|---|---|---|
| Basis of the evidence | Interviews and sampling | Policies and configurations | Where the data is | Active tests on real behaviour |
| Frequency | Once a year | Continuous | Continuous | Continuous or on demand |
| Effective erasure | Not checked | Declared | No | Verified in every repository |
| Where it runs | On site | Vendor cloud | Usually in the cloud | Inside your perimeter, with no outbound connection |
| EHDS and AI Act | Depends on scope | Partial | No | Included |
Deployment without disrupting operations
ARGOS is delivered as an appliance on the COGNITIV AI server, in three sizes depending on the number of systems to verify. It only needs read credentials.
- Appliance installation and set-up of read-only connectors.
- Initial inventory of systems.
- Classification of personal data and data-flow map.
- Comparison with the declared record of processing activities.
- Challenge campaigns on the prioritised controls.
Value arrives from the first phase: the inventory and the differential RoPA are available before the first campaign.
Questions from the DPO and the CISO
The most common questions before deploying ARGOS. You can ask the assistant anything else.
Does ARGOS access real personal data?
Yes, during the discovery and classification phase, through read-only connectors. Everything happens inside your perimeter, with the model running locally and applying data minimisation: classifications and fingerprints are kept, not bulk copies of content. ARGOS's own access is logged and audited.
Do synthetic subjects raise any data protection issue?
They are fictitious identities with plausible data that do not belong to any real person, so the tests create no risk for any data subject. When the campaign ends, ARGOS deletes them and verifies its own erasure.
What happens when ARGOS detects a breach of the rules?
The finding is recorded with its evidence and verdict, enters the remediation plan and is notified to the internal roles you configure. ARGOS never reports anything to any authority or third party: that decision always belongs to the data controller.
Does the evidence carry weight with a data protection authority or an auditor?
It is generated with a timestamp, a cryptographic chain of custody and the explicit evaluation rule, and the report is signed as a verifiable credential. It is complete and traceable; its assessment is for the authority or the auditor, who can check for themselves that it has not been altered.
If a verdict is wrong, who is accountable?
ARGOS is a support tool under human oversight. Each verdict references the exact rule and evidence, and decisions with legal effects are always taken by the compliance team: AI proposes, the engine disposes and the person decides.
Could ARGOS itself become a risk entry point?
It uses read-only connectors, has no outbound connection, receives signed one-way updates, is hardened to ENS high category and ISO 27001, and runs its own probes against itself.