Important Legal Notice: This website does not replace official EU publications
We are not responsible for discrepancies with official sources. Always consult the official publications referenced in our resources section for legal compliance and authoritative information.
CRA · NIS2 · GDPR · Machinery Regulation · RED
Crosswalk turns five EU cyber laws into one guided assessment: verbatim law texts, gap analysis, evidence and the documents your auditor asks for. It runs in your browser; nothing is uploaded.
No payment details · Runs offline · Built by a CRA trainer
The clock is running
Five laws, one calendar. Some dates have passed; the rest are close enough to plan for now.
Cybersecurity requirements for radio equipment apply
REDRules for notified bodies apply
CRAReporting of actively exploited vulnerabilities and severe incidents
CRAMachinery Regulation applies
MRAll CRA obligations apply
CRAOne assessment, five laws
Overlapping obligations are mapped to each other, and the standards you already use to every law they serve, so a requirement you answer under the CRA also counts under NIS2 and the GDPR where they overlap, and a standard assessed once counts for every law it supports.
Hover or focus a law to see which standards Crosswalk assesses it against. Standards stay voluntary; the law is the binder.
The product
The dashboard shows coverage per law for the organisation, the open gaps and risks, who owns which piece of work and what changed last. One project, all five laws, in a workspace you own.
Every requirement has its place in the tree: the law text beside it, the control to assess, the evidence to attach and the to-do with an owner and a date. Gaps are listed, not hidden.
Generate the audit report set: a management review, one document per law for the organisation and per product, and the technical documentation in the order Annex VII prescribes. As Markdown or PDF, with the source snapshot on every document.
This is our own CRA file. Crosswalk is itself a product with digital elements, and we keep its compliance file in Crosswalk.
Free tools
Everything here is free and runs in your browser. The scan tells you which laws apply; the hubs and tools take you from there.
A few questions about where you operate, what you make and whom you serve. You get a yes or no per law, the reasoning, and the tools that fit.
For anyone placing products with digital elements on the EU market: obligations, requirements, the timeline, penalties and the free CRA tools.
For essential and important entities: risk-management measures, incident reporting, governance, and whether your sector is in scope.
Where you stand against the essential requirements.
Is your product in scope, and in which class?
Default, important or critical.
The obligations as a printable list.
Essential, important, or out of scope.
Lawful processing, security of processing, breach notification.
Regulation (EU) 2023/1230, applies from 20 January 2027: overview, articles, obligations, six steps to conformity, timeline.
Who does what, as a printable matrix.
Built on proven standards
Each law has its frameworks: ENISA guidance and IEC 62443 for the CRA, ISO 27001 for NIS2, ISO 27701 for the GDPR, ISO/TR 22100-4 and IEC TS 63074 for the Machinery Regulation. The site shows where they overlap, so one investment serves several laws.
Who this is for
The problem. You have to comply, and professional advice costs thousands of euros you would rather spend on the product.
What you get. Plain-English guides and free tools that fit a small budget and a real timeline, and a workspace that starts at no cost.
The problem. The regulations are written for lawyers, and you are the one who has to build what they ask.
What you get. Requirements as controls with the law text beside them, standards mapped to each, and guidance you can act on in a sprint.
The problem. You explain complex obligations to people who do not read regulations, and you owe the auditor a complete file.
What you get. Clear, structured resources for the board and the engineers, and an audit-ready file with evidence, gaps and sign-off.
Who builds this
Software security and compliance specialist with more than thirty years in OT software development: factory automation, control algorithms, test frameworks and automated generation of compliance evidence, with secure product development under IEC 62443-4-1 and 4-2 in industrial control. He developed and teaches the four-day Cyber Resilience Act course at Mikrocentrum and speaks on security in OT. Before that: thirteen years of OPC and RFID courses for Mikrocentrum.
The Lite licence costs nothing to start: one project, all five laws, no payment details.
