Press release
Stockholm, 1 September 2026
Isodora opens its compliance platform to Swedish small businesses: from SEK 500 a month instead of half a million in consulting fees
After eight months running live with a handful of customers, Isodora AB today opens its AI-native compliance platform to the broader market. Nine specialised AI experts assemble the documentation against the right regulatory framework, and automated controls continuously verify that it holds. The ambition is explicit. Isodora wants to become for regulatory compliance what Fortnox became for bookkeeping: a tool the small business owner can run alone, at a cost that fits any budget.
Bookkeeping was once a consulting fee. Then it became software for a few hundred kronor a month, and Swedish small businesses stopped paying for something they could handle themselves. Compliance has not made that journey. A small company that needs ISO 9001, or an answer to a customer's security questionnaire, still faces consulting fees of between SEK 450,000 and 1.7 million, and a lead time of three to nine months.
"What took a senior consultant six months can be done in software today. There's no reason Swedish small businesses should keep paying as if it were 2015," says Jonas Deibe, CEO and founder of Isodora.
The pressure comes from customers, not from the law
On 15 January 2026, Sweden's Cybersecurity Act (2025:1506) entered into force, implementing the EU's NIS2 directive into national law. The number of Swedish entities in scope grew from roughly 900 to approximately 8,000, with mandatory registration with the Swedish Agency for Civil Defence in place since February 2026. Because the act makes supply chain security mandatory, those entities must be able to show that their subcontractors also meet the bar. The requirement therefore travels on, to companies that have never read the directive. Comparable transpositions are landing across the Nordics.
“A freight company with twelve employees isn't covered by the act. But their largest customer is, so the security questionnaire lands on the kitchen table on a Friday afternoon anyway.”
How it works
The customer answers a tested question set about how the business actually operates. Nine specialised AI experts turn those answers into documentation against the right frameworks, mapping the same answers to several frameworks at once so nothing is documented twice. The customer's own systems are then connected across cloud, identity, code and HR, and automated controls continuously verify that what is written on paper also holds in reality. When a control fails, a non-conformity is opened with an owner and a remediation proposal, and the audit trail builds itself in the background.
"The controls get better with every customer we add. A consultant starts from zero every time," says Henrik Engström, CTO and co-founder of Isodora.
As a licensee of SIS, the Swedish Institute for Standards, Isodora reproduces the requirement text of ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO/IEC 42001 inside the platform, so that the requirement, the control that verifies it and the evidence an auditor asks for are linked from the start. The platform also supports GDPR, NIS2, DORA, the EU AI Act, CSRD and SOC 2, with all data for European customers hosted within the EU.
Availability and pricing
Isodora is open to new customers from today at www.isodora.se, with a seven-day free trial at app.isodora.se. The platform fee starts at SEK 500 per month, with frameworks and modules added as needed. A full licence is only needed for the people who actually work in the system; everyone else gets reader access and has the information shared to them. There is neither a minimum nor a procurement process.
"You run your business. We handle compliance. That's the whole offer," says Jonas Deibe.
Fact box: how the Cybersecurity Act reaches small businesses
| In force since | 15 January 2026 |
|---|---|
| Directly in scope | Approx. 8,000 entities across 18 sectors (previously approx. 900) |
| Indirectly affected | Their subcontractors, via the act's supply chain security requirement |
| Registration | Open since 2 February 2026; to be submitted without undue delay |
| Incident reporting | 24 hours / 72 hours / one month |
| New requirements | Explicit management accountability, mandatory supply chain security, increased penalties |
About Isodora
Isodora AB turns regulatory compliance into software rather than a consulting project. The platform combines nine specialised AI experts, automated controls against the customer's actual systems, and a company brain that remembers every requirement, control and decision over time. Isodora is a licensee of SIS, the Swedish Institute for Standards, and works with law firm Hellström Advokatbyrå. Customers include companies in green energy technology, financial leasing, craft trades and manufacturing.
www.isodora.se · linkedin.com/company/isodora
For more information
