Important Legal Notice: This website does not replace official EU publications
We are not responsible for discrepancies with official sources. Always consult the official publications for legal compliance and authoritative information.
Guides · Tools · Crosswalk · Consultancy
Free guides and tools for the Cyber Resilience Act, NIS2, the GDPR, the Machinery Regulation and the AI Act: who they apply to, what they ask and by when. When the work starts: Crosswalk for your compliance file, and advice from Depre.nl.
No account needed · Law texts from EUR-Lex
What you find here
Start free with the guides and the tools. When the work begins, keep your compliance file in Crosswalk, or ask us to help.
In plain English: who each law applies to, what it asks, the deadlines and the penalties. For the CRA, NIS2, the GDPR and the Machinery Regulation also the law text, article by article.
The 2-minute scan of which laws apply, the CRA product checker, risk classifier and gap analysis, the NIS2 sector checker, and a printable CRA checklist and RACI. In your browser, no account.
A workspace for your compliance file under the CRA, NIS2, the GDPR, the Machinery Regulation and RED: gaps, evidence, actions and the documents your auditor asks for. It runs in your browser; the Lite licence is free.
Assessments, support while you implement, and ongoing compliance support, from Depre.nl, the company behind this site.
The clock is running
Five laws, one calendar. Some dates have passed; the rest are close enough to plan for now.
Cybersecurity requirements for radio equipment apply
REDRules for notified bodies apply
CRAReporting of actively exploited vulnerabilities and severe incidents
CRAMachinery Regulation applies
MRAll CRA obligations apply
CRAFree tools
Everything here is free and runs in your browser. The scan tells you which laws apply; the hubs and tools take you from there.
A few questions about where you operate, what you make and whom you serve. You get a yes or no per law, the reasoning, and the tools that fit.
For anyone placing products with digital elements on the EU market: obligations, requirements, the timeline, penalties and the free CRA tools.
For essential and important entities: risk-management measures, incident reporting, governance, and whether your sector is in scope.
Where you stand against the essential requirements.
Is your product in scope, and in which class?
Default, important or critical.
The obligations as a printable list.
Essential, important, or out of scope.
Lawful processing, security of processing, breach notification.
Regulation (EU) 2023/1230, applies from 20 January 2027: overview, articles, obligations, six steps to conformity, timeline.
Who does what, as a printable matrix.
Crosswalk · one assessment, five laws
Overlapping obligations are mapped to each other, and the standards you already use to every law they serve, so a requirement you answer under the CRA also counts under NIS2 and the GDPR where they overlap, and a standard assessed once counts for every law it supports.
Hover or focus a law to see which standards Crosswalk assesses it against. Standards stay voluntary; the law is the binder.
Home shows the four stages in the order you work in, each with its state, and the one next step. Figures has the numbers behind it.
A requirement counts as in place once its evidence is recorded; what is missing becomes an action with an owner and a date.
The audit report set: a management review, one document per law and the technical documentation in the order Annex VII prescribes, as Markdown or PDF.
Crosswalk is itself a product with digital elements, and we keep its compliance file in Crosswalk.
Built on proven standards
Each law has its frameworks: ENISA guidance and IEC 62443 for the CRA, ISO 27001 for NIS2, ISO 27701 for the GDPR, ISO/TR 22100-4 and IEC TS 63074 for the Machinery Regulation. The site shows where they overlap, so one investment serves several laws.
Who builds this
Software security and compliance specialist with more than thirty years in OT software development: factory automation, control algorithms, test frameworks and automated generation of compliance evidence, with secure product development under IEC 62443-4-1 and 4-2 in industrial control. He developed and teaches the four-day Cyber Resilience Act course at Mikrocentrum and speaks on security in OT. Before that: thirteen years of OPC and RFID courses for Mikrocentrum.
The scan tells you in two minutes which EU cyber laws apply to you and which tools fit. For what a scan cannot answer, talk to us.
