EU cyber-law compliance workbench

The EU cyber laws, in a workspace you own

Crosswalk turns the CRA, NIS2, GDPR, the Machinery Regulation and RED into one guided assessment: verbatim law texts, gap analysis, evidence and audit-ready reports.

Try it free See plans

Free starts you on the CRA in full, with no time limit and no sign-up. NIS2, GDPR, the Machinery Regulation, RED, the standards catalogues and the AI assistant come with a plan - each free to try for 14 days. See the plans →

The CRA clock is running — reporting obligations from 11 Sep 2026, main obligations from 11 Dec 2027. Map yours now.

Crosswalk dashboard: 99% coverage across CRA, Machinery, GDPR, NIS2 and RED, with open gaps, risks and products at a glance.
One live dashboard across every law in scope — coverage, open gaps, risks and products at a glance.
A control being assessed — Penetration testing (SVV-4): legal basis, the questions an auditor asks, evidence prompts and a status, with an AI Interview-me assistant.
Each control brings its legal basis, the questions an auditor asks, evidence prompts and a status — or let the built-in AI auditor interview you.
Multi-regulation overlap: each requirement mapped to the CRA, NIS2, GDPR, AI Act, RED and Machinery articles.
One product, many EU laws — obligations mapped across the CRA, NIS2, GDPR, the AI Act, RED and the Machinery Regulation.
Gap analysis: coverage by theme and the remaining open items, each linked back to its control.
See exactly where you stand — coverage by theme and every open item, each one click from its control.
Every obligation as a tracked, assignable task on one list.
Every obligation becomes a tracked, assignable task — the whole compliance file in one workspace.
Compliance calendar listing every law milestone and product support window in date order, with an Export .ics button.
Every deadline that matters — CRA, NIS2, GDPR, RED and Machinery milestones plus product support windows, exportable to any calendar.
Maturity report scoring each control set on capability and how much has been assessed — Advanced overall across 794 requirements.
A live maturity report: how much of each control set is genuinely in place, weighted by evidence and by how much has been assessed.
Recommended next actions: the highest-severity gaps first, each with guidance and the law articles it satisfies.
Know what to do next — the highest-severity gaps first, each with concrete guidance and a link straight to the control.
Coordinated vulnerability disclosure policy and security.txt generator with a CVSS-based remediation SLA matrix.
Generate a publishable coordinated-disclosure policy and security.txt, with a defensible CVSS-based remediation SLA.
CRA harmonised standards tracker: the EN 40000 series, their Official Journal status and the standards Crosswalk maps them to.
Track the CRA harmonised standards (M/606) — their Official Journal status and how each maps to what Crosswalk assesses.

Your files never leave your device

Crosswalk is local-first: your evidence and project data stay with you.

Runs on your deviceProjects are plain files in a folder you choose.
Works offlineLoaded once, it needs no connection.
Crosswalk will never upload your filesAI is opt-in — your own key, a local model, or managed Plus; content you submit goes only to that AI provider.

From "which laws apply?" to an audit-ready file

Crosswalk walks a product or organisation through the same four steps for every law it covers, so the work is consistent and the trail is defensible.

01

Scope

Answer a short questionnaire; Crosswalk determines which laws and obligations apply to your product or organisation.

02

Assess

Each law's requirements are broken into workable controls with the verbatim text beside them. Record where you stand and what is missing.

03

Evidence

Attach evidence, assign owners and track tasks to closure. Professional keeps an evidence binder, audit trail and version history.

04

Report

Export watermark-free gap analyses, applicability statements and audit-ready reports for management, customers and auditors.

Five laws, one method

Every paid plan includes all five (the free version covers the CRA), each broken down into controls you can actually work through - not just a copy of the legal text.

CRA Cyber Resilience Act NIS2 network & information security GDPR data protection Machinery Regulation (EU) 2023/1230 RED Radio Equipment Directive

Professional adds the full controls catalogue: 14 standards-based control sets, 850+ controls, mapped to the law clause by clause (IEC 62443, ISO/IEC 27001, ISO 22301, ETSI EN 303 645, EN 18031 and more). See the full catalogue →

Who uses Crosswalk

Manufacturers & importers

Software and connected-product makers placing goods on the EU market - map your obligations under the CRA, RED and the Machinery Regulation, and keep the evidence in one place.

Consultants & in-house teams

Run engagements or an internal programme with a clean folder per client or product, your own branding on client-facing reports (Advisor), and a repeatable method across laws.

See it on your own project — no credit card

The free version covers the CRA workflow without a time limit and without a watermark, and every paid plan can be tried in full for 14 days per project — no account or credit card. Upgrade when you need the other laws, the standards depth and clean, client-ready exports. Every paid plan includes all five laws; Professional adds the full controls catalogue.

Try it free See plans