ProdComply covers every regulation that applies to connected hardware products placed on the EU market — from product design through end of life.
REGULATION (EU) 2024/2847 · IN FORCE 10 DEC 2024
EU Cyber Resilience Act
⚡ Sep 2026 · Dec 2027
Mandatory cybersecurity requirements for all hardware and software products with digital elements placed on the EU market. Applies to Manufacturers, Importers, and Distributors regardless of where they are established.
SBOM in machine-readable format (CycloneDX/SPDX) — Sep 2026
Art. 14 active vulnerability reporting: 24h early warning → 72h notification → 14-day final report to national CSIRT — Sep 2026
13 essential cybersecurity requirements (Annex I Part I) — Dec 2027
CVD policy, 8 vulnerability handling obligations (Annex I Part II) — Dec 2027
Technical File (Annex VII), EU DoC, CE marking, 5-year support period declaration — Dec 2027
Class II products: Notified Body assessment mandatory — Module B+C or H
Art. 22: Substantial modification resets full Manufacturer obligations
DIRECTIVE (EU) 2022/2555 · IN FORCE 18 OCT 2024
NIS 2 Directive — Supply Chain
Active · Customer-driven urgency
Under Art. 21(2)(d), Essential and Important Entities — energy operators, grid operators, hospitals, transport authorities — are legally required to assess and manage cybersecurity risks across their entire supply chain. This creates a binding compliance flow-down to their product suppliers and system integrators.
NIS 2-regulated customers require documented secure development lifecycle evidence from product suppliers
Procurement contracts increasingly mandate IEC 62443-4-1 ML2 as minimum supplier requirement
ProdComply generates exportable NIS 2 supplier security profiles per product for procurement questionnaires
SBOM availability per product required for supply chain vulnerability management under NIS 2
Penalties for Essential Entities: up to €10M or 2% of global turnover — driving urgent supplier qualification
REGULATION (EU) 2023/2854 · APPLICABLE 12 SEP 2025
EU Data Act
In force · Products from Sep 2026
Mandates that manufacturers of connected products design and build products so that data generated by the product is accessible to users in real-time, machine-readable, and shareable with third parties under FRAND terms. Applies to all connected hardware placed on the EU market.
Data access by design (Art. 3-4): products must be designed so users can access generated data easily, securely, and free of charge
Pre-contractual transparency (Art. 3): disclosure of data types, access mechanisms, and sharing conditions before purchase
Data sharing on request (Art. 5): make product data available to third parties designated by users under FRAND terms
API specifications and data format documentation maintained and available
Data access obligations for new products placed on market from 12 September 2026
IEC 62443-4-1 · INTERNATIONAL STANDARD · CRA CONFORMITY PREREQUISITE
IEC 62443-4-1 Secure Development Lifecycle
Contract-driven · CRA prerequisite
Defines Secure Development Lifecycle (SDL) process requirements for manufacturers of products used in Industrial Automation and Control Systems. Increasingly required by contract from NIS 2-regulated customers and as a prerequisite for CRA Notified Body assessment of Class I and II products.
8 Security Practices: Security Management · Security Requirements · Secure Design · Secure Implementation · Verification & Validation · Issue Management · Update Management · Security Documentation
ML2 (Managed): documented, repeatable SDL processes — minimum for CRA Class I conformity and most NIS 2 customer contracts
ML3 (Defined): standardised organisational process — required for SDLA certification via TÜV SÜD, UL Solutions, Bureau Veritas
ProdComply tracks maturity level progression per practice with evidence attached per requirement — audit-ready SDLA dossier
