NormScan identifies unauthorized copies of published standards across the open web, after renaming, re-typesetting, scanning or translation, and runs the full enforcement ladder on the rights holder's authority until they come down. Documented evidence behind every case.
Figures from our initial pilot with IPQ. Volume was set by the scope of the mandate, not by what detection surfaced.
Instituto Português da Qualidade, the Portuguese national standardization body and the ISO, CEN and CENELEC member for Portugal
INOVA Quality Hub, the innovation hub of IPQ
The problem
One licensed PDF is renamed, mirrored, translated and reuploaded across a long tail of hosts far beyond the obvious ones. Manual search reaches a fraction of them. The body responsible for the text is left with no way to establish how far it has spread, which edition is in circulation, or who is now relying on it.
Until they don’t. In our initial pilot with IPQ we were mandated to act on 134 reproductions. All 134 came down.
Why it matters
A copy does not stay where it was posted. It is downloaded, cited and applied for years after the sale it replaced, and every one of those uses is one the publisher cannot account for.
Revenue from the sale of publications is the primary funding mechanism for the technical work. Every unauthorized copy is a licence that will not be sold.
Standards are cited in legislation and applied in conformity assessment. A superseded edition circulating without its amendments and corrigenda gets used as though it were the text in force.
CEN-CENELEC Guide 10 and ISO POCOSA require members to document unauthorized reproduction and act to stop it. A team chasing links by hand cannot evidence that it did.
In our IPQ pilot, that meant 134 reproductions documented and acted on, and 134 removed.
Platforms we monitor continuously
Why NormScan
An unauthorized copy is licence revenue that will not be recovered, and a text placed beyond the publisher's control, with no way to establish how widely it has spread or which edition is in circulation. NormScan recognizes what a generic tool cannot, documents each case to an evidential standard, and acts on it under the rights holder's authority. Fully managed, fully evidenced, accountable for every case.
Keyword alerts and manual sweeps surface a fraction of what is live. We work the publicly accessible web continuously, down to the renamed, re-typeset, scanned and translated files that carry no usable metadata and slip straight past search.
AI match confirmed
Every candidate is assessed before it becomes a case: passage traced to source, scored, reviewed and documented. Evidence, not a guess.
Document libraries, course-note marketplaces, file lockers and the long tail of niche hosts, ranked by where a body's editions and their national adoptions actually turn up.
We do not stop at a notice. Each case is pursued at the host and through search delisting, so end-users stop being handed a text that was never issued.
The data above is shown as an example.
In a pilot with IPQ, the Portuguese national standardization body, we were mandated to act on 134 unauthorized copies. All 134 came down.
Across national territories, continuously
One international text becomes many national adoptions, each separately published, priced and translated, and unauthorized copies follow it into every territory. NormScan monitors the publicly accessible web continuously, in the languages these publications are actually copied into, and attributes each case to the edition and the rights holder it belongs to.
How the detection works
Web monitoring is not new. What is specific to standardization is the recognition problem: telling the definitive text from a rewrite of it, the edition in force from the one it superseded, and an identical national adoption from the international text it implements. That is what our technology is built for, and a specialist reviews what it surfaces.
Detection reads the document's own content, so a reproduction that has been renamed, re-typeset, scanned or machine-translated is still attributed to the publication it came from.
An identical national adoption (BS EN, DIN EN, NF EN, NP EN) is not the EN or ISO text it implements, and the edition in force is not the one it superseded. We separate them, so every case is attributed to the right publication and the right rights holder.
A copy of a withdrawn edition, or one circulating without its amendments and corrigenda, is a normative-integrity problem as much as a revenue one. We record which edition each reproduction actually is.
Our models learn from the freely available parts of publications, such as covers, forewords and scope clauses, and from content licensed to us by the rights holder we act for. Using standards text for machine learning is itself a reproduction, so it requires permission like any other. We work inside that limit by design.
Analysts tune detection and assess the borderline cases. Judgement on the record, not automation alone.
The process
Every case follows the same documented path and climbs the enforcement ladder stage by stage, using whichever step the host and the jurisdiction actually warrant. Each stage is timestamped, so the record shows the effort as well as the outcome.
Managed end to end
Nobody at the standards body chases hosts, files notices or preserves evidence. We open a case the moment a reproduction is confirmed, take it through each level of escalation available to us, and keep an immutable record of every step. The documentation duty is discharged as a by-product of the work, not as a separate exercise afterwards.
The moment a copy reappears under a new name or host, our sonar catches it and we pull it again. For as long as it takes.
Ignored notices never sit. Host, registrar, search, network: we keep escalating until the copy is unreachable.
Each match is screenshotted, hashed and timestamped the instant we find it, sealed for any registrar or court.
Established channels into host and marketplace trust & safety teams. Not a form into the void.
A live record from detection to removal. Nothing slips, nothing left half-done.
Evidence that reports upward
Enforcement is worth what can be evidenced. Every case rolls up into one auditable report (totals, trends and the chain behind each removal), so protecting the collection becomes a line item that answers to a board, an auditor or a member reporting obligation, rather than an act of faith.
What goes in front of a board
Every case rolls up into a number that holds at board level, with the record behind it one click away.
Each case keeps its detection time, matched passage, edition identified, notice and removal date: the full chain, timestamped.
Hand an auditor, a court or a reporting line a complete record. Nothing kept by hand, no spreadsheet to reconcile.
What a managed, evidence-led enforcement service does that an internal team chasing links cannot, and cannot be expected to.
No procurement marathon. A short confidential call, then a first sweep scoped to the collection.
Fully managed end to end. Detection, notices, escalation and reporting are all carried out on our side.
Every case documented to the standard the obligations and the auditors expect.
The pilot
NormScan is early. Rather than illustrate outcomes we have not yet produced, this is the single engagement we have completed, reported as it happened, with the limits of the mandate stated alongside the result.
Every reproduction we were mandated to act on was removed. The volume was set by the scope of that mandate, not by what detection surfaced.
of the cases filed in the pilot carried a matched passage, a source URL, the edition identified and a timestamped record.
Median time from a confirmed match to removal, across the cases filed.
Of the reproductions we were mandated to act on, all were taken down.
One pilot completed, incubated at INOVA Quality Hub, and building the next engagements with the bodies that hold the rights.
Inside the standards world
NormScan is part of the 2026 cohort at INOVA Quality Hub, the innovation hub of Instituto Português da Qualidade (IPQ), the Portuguese national standardization body. Being there puts us in direct contact with the community we build for, and with the rules, obligations and reporting lines it actually works under.
We don't study the standards world from the outside. We're being built inside it.
The sale of publications is what funds the technical work, and the technical work is what keeps whole industries safe. Every unauthorized reproduction erodes that funding base quietly, and puts a text into circulation that no longer answers to the body responsible for it. We built NormScan so a national body never has to choose between protecting its collection and getting on with its mission.
We do the finding, the documenting and the removing, discreetly and continuously, so it never has to come out of a member's week. The authority over the text stays where it belongs, and the record proves it was exercised.
How we engage
Pricing is scoped to the size of the collection: nothing to install, no dashboard to staff. We share figures on a first call, and we can be reached any time at joao@normscan.com.
for bodies establishing the scale of the problem
for bodies protecting a live collection
Multi-tenant from day one, built for national bodies and for European and international organizations running one consistent, auditable process across a source text and every national adoption of it, with each case attributed to the member that holds the rights in that territory.
FAQ
NormScan is a fully managed copyright-enforcement service for national standardization bodies, European and international organizations, and other publishers of priced normative documents. It identifies potentially unauthorized copies of published standards and their national adoptions across the publicly accessible web, documents each one with timestamped evidence, and pursues removal through the enforcement ladder: host takedown, then search delisting, then administrative site-blocking where the jurisdiction allows it. Nothing to install, no dashboard to staff.
Continuous web monitoring is not new. What is specific to standardization is recognition: identifying the definitive text after it has been renamed, re-typeset, scanned or machine-translated, telling the edition in force from the one it superseded, and separating an identical national adoption from the international text it implements. That, together with an understanding of how rights flow from ISO and CEN-CENELEC to their members within each national territory, is what NormScan is built around. Every result is backed by a documented match, so each one can be verified.
CEN-CENELEC Guide 10 requires every member to adopt technical, organizational and contractual measures against unauthorized reproduction, including documenting any unauthorized reproduction and taking appropriate action to stop it as soon as it becomes known. ISO POCOSA places a comparable duty on ISO members to protect the integrity of the text and prevent unauthorized reproduction or sale. NormScan is the operating instrument for those clauses: continuous detection so a reproduction becomes known, a documented case file for each one, and enforcement carried through under the member's authority. We are a service provider, not an accredited or endorsed body; the obligation and the authority remain with the member.
Yes, and it determines who files. An identical national adoption is a separate publication with its own designation, its own price and its own rights position within the national territory, even though the technical content is that of the EN or ISO text it implements. We attribute each case to the specific edition found and to the body holding the rights in the territory concerned, so notices are filed by the party entitled to file them and nothing is claimed on another member's behalf.
On the freely available parts of publications, such as covers, forewords and scope clauses, and on content licensed to us by the rights holder we act for. We do not train on standards content we hold no licence to use. Using standards text for machine learning is itself a reproduction, so it requires permission like any other, and any expansion of that scope happens through the contractual relationship with the body that holds the rights.
Document libraries, course-note marketplaces, search results, mirror sites and direct file hosts across the publicly accessible web, monitored continuously, in the languages those publications and their adoptions are likely to be copied into.
The part of the collection to be covered, and confirmation of the rights held in it within the territory concerned. We run a confidential first sweep and report what is already in circulation before any commitment.
Every case pairs the matched passage and the source URL with a timestamped record identifying the publication, the edition and the rights holder: the standard of evidence a host, a registrar and a court expect.
No. NormScan is fully managed. Results and reports are delivered on a set cadence; the tooling that produces them stays on our side.
We escalate up the enforcement ladder, from the host, to search delisting, to upstream providers, to administrative site-blocking where the jurisdiction allows it, and we say plainly when a reproduction is beyond reach rather than leaving a case open indefinitely.
Request access and we will run a confidential first sweep of the publicly accessible web, scoped to whichever part of the collection matters most. No commitment, and nothing leaves the engagement.