Manufacturers and importers placing connected products on the EU market — industrial equipment, medical devices, energy systems, connected software — are now legally required to demonstrate cybersecurity by design, structured vulnerability handling, and documented conformity before any product reaches a customer.
ProdComply deploys a structured compliance programme directly inside your Microsoft 365 — giving every function a single governed view of every product, every obligation, every owner, and every deadline. Built around IEC 62443-4-1. Aligned to EU CRA, NIS2, and the Data Act.
The international foundation for cybersecurity in connected products. Defines 8 Security Practices and 4 Maturity Levels (ML1–ML4) for the secure development lifecycle of any IACS product. Already contractually required by NIS2-regulated operators from their suppliers — and the structured framework Notified Bodies audit for CRA Class I and II assessment.
Mandatory cybersecurity requirements for all products with digital elements on the EU market. References IEC 62443-4-1 as the harmonised route to conformity. Notified Body assessment for Class I and II mandatory — they audit your 62443-4-1 compliance documentation.
NIS2-regulated operators (energy grids, hospitals, transport) are legally required to verify their suppliers' cybersecurity practices. They are already contractually requiring IEC 62443-4-1 ML2 compliance documentation from product suppliers. Your customers are asking for this now.
Manufacturers of connected products must design data access into the product from the start — users must be able to access generated data in real-time, free of charge. Tracked per product at the design gate.
A SharePoint-native governance framework replacing fragmented spreadsheets, shared drives, and unstructured communication. Process stages, obligations, ownership, and milestone tracking — structured, versioned, and accessible across every relevant function simultaneously.
Every function — product management, security engineering, legal, quality assurance, and executive leadership — operates from a single governed source of truth. Role-appropriate access. Ownership resolved live from your organisational directory. Accountability is embedded in the platform architecture.
Every artifact linked to the precise process item, gate, and obligation — permanently and traceably. Regulatory authority inspections, customer qualification audits, and internal governance reviews are addressed from a consolidated, governed source without manual retrieval effort.
8 security practices · ML1–ML4 per product team · SDLA certification dossier auto-assembled for TÜV SÜD or UL Solutions
Non-conformance register · CAPA lifecycle · Internal audit findings · Management review records — all structured and tracked
Per-supplier assessment · Automatic re-evaluation every 2 years · Risk scoring · NIS2 Art.21(2)(d) supply chain audit export
Stage-gate approvals · Multi-stakeholder sign-off · Budget and milestone tracking · Portfolio view across all active projects
Per-device lifecycle tracking · Clinical evaluation · Post-market surveillance · Technical file completeness per gate
RFC workflow · Approval chains · Impact assessment · Rollback planning · Artifacts per change · Audit trail automatic
Data storage, lists, document library, file versioning, page hosting — the entire app runs here.
Automated reminders, overdue escalation, approval workflows, deadline countdowns — fully configurable.
Live owner search from your company directory — real names, roles, departments, always current.
SSO, multi-factor auth, conditional access, role-based permissions — all inherited automatically.
We map your process and determine regulatory applicability — CRA risk class per product, Data Act scope, NIS2 supply chain exposure, IEC 62443-4-1 maturity baseline. Written gap analysis and remediation roadmap.
ProdComply deployed on your SharePoint tenant. Process configured to your exact workflow. Microsoft Graph owner integration live. Power Automate reminders activated. Management dashboard operational.
Priority obligations activated first — EU CRA Dec 2027 enforcement readiness and IEC 62443-4-1 ML2 gaps. Existing artifacts migrated and structured within the platform. Supplier assessment frameworks configured to your qualification criteria.
Team training tailored to each role. Management dashboard walkthrough. Power Automate configuration handed to your team. Full documentation. Zero consultant dependency after handover.