Regulatory readiness and compliance
Know which rules apply to your products and sites, and what to do first.
Several EU rules now apply to the same product. We turn them into one plan.
A connected machine sold in the EU can fall under the Cyber Resilience Act, the Machinery Regulation, the Radio Equipment Directive and, for its operator, NIS2, each with its own deadlines, evidence and conformity route. Reading them one by one creates duplicate work and blind spots.
We start from your products, not from the legal texts. For each product we decide which rules apply, which class and route follow, and which evidence you already have. The result is one prioritised plan with owners and dates, and we stay to implement it until the declaration of conformity is signed.
Who it is for
- Manufacturers placing connected products on the EU market
- Product and compliance managers who sign the declaration of conformity
- Companies that fall under NIS2
- Suppliers asked by customers for CRA or NIS2 evidence
The regulatory landscape
The rules that most often apply together to our clients' products and sites. The overlaps are where most effort is saved.
Products
Cyber Resilience Act
Essential requirements for every product with digital elements. Reporting duties since 11 September 2026, full application from 11 December 2027.
Machines
Machinery Regulation
From 20 January 2027, protection against corruption and safe control systems become essential health and safety requirements.
Radio
RED cybersecurity
Since 1 August 2025, radio equipment must protect networks, personal data and against fraud, assessed with EN 18031.
Operators
NIS2
Risk management, reporting and supply chain duties for essential and important entities, with personal accountability of management.
AI
EU AI Act
Cybersecurity and robustness requirements for high-risk AI systems, linked to the CRA through its Article 12.
Vehicles
UN R155 and R156
Cybersecurity and software update management systems required for vehicle type approval.
Health
MDR and FDA
Cybersecurity as part of medical device safety and the US premarket submission.
Standards
Harmonised standards
Harmonised standards, such as EN 18031 for radio equipment and the CRA standards now in preparation, give presumption of conformity. IEC 62443 is the technical basis for many of them.
How we make compliance manageable
Regulation is a design input, not paperwork at the end. These principles keep the effort proportional.
1
Product first
We map rules to products and variants, not the other way round.
2
One evidence base
One risk assessment and one set of documents serve several rules.
3
Standards as shortcut
Harmonised standards give presumption of conformity and a clear test basis.
4
Deadline driven
Work is ordered by what applies first, starting with CRA reporting.
5
Lifecycle thinking
Support periods, updates and vulnerability handling are planned from day one.
6
Built to be audited
Every decision is documented so a notified body or authority can follow it.
How we help
From the first scope decision to CE marking. Each service has a clear scope and a defined result.
CRA Readiness Check
Where your products stand under the CRA.
What we do
- Inventory products, software and remote data processing
- Decide scope, exclusions and product class
- Check against Annex I and the reporting duties
You receive
Scope and class decision per product, gap list, prioritised plan
Multi-regulation applicability analysis
Which rules apply, and where they overlap.
What we do
- CRA, Machinery Regulation, RED, NIS2 and AI Act per product and site
- Overlap map to avoid duplicate work
- Roles as manufacturer, importer, distributor or operator
You receive
Applicability matrix, overlap map
NIS2 gap analysis and implementation
From applicability to working measures.
What we do
- Check if you are an essential or important entity
- Gap analysis against the risk management measures
- Implement measures, reporting process and supply chain controls
You receive
Applicability decision, gap list, implemented measures
Machinery Regulation and RED readiness
Cybersecurity for machines and radio products.
What we do
- Protection against corruption and safe control systems
- RED requirements with EN 18031
- Test and documentation plan
You receive
Gap list per product, test and document plan
Conformity route and technical documentation
The way to CE marking.
What we do
- Choose Module A, B+C, H or certification
- Build technical documentation, SBOM and support period
- Prepare the EU declaration of conformity
You receive
Documentation set, timeline to CE marking
Notified body and authority preparation
Ready for the outside view.
What we do
- Pre-assessment against the chosen route
- Evidence review and mock questions
- Support during the assessment
You receive
Pre-assessment report, closed gaps
How we work
Step 1
Scope
Products, markets and your roles.
Step 2
Assess
Gap analysis against each applicable rule.
Step 3
Plan
One prioritised roadmap with owners and dates.
Step 4
Implement
Support until documentation and declaration are ready.
Standards and regulations
Cyber Resilience Act (EU) 2024/2847
Products with digital elements. Reporting since 11 September 2026; all other requirements from 11 December 2027.
Machinery Regulation (EU) 2023/1230
Applies from 20 January 2027, including protection against corruption.
RED Delegated Regulation (EU) 2022/30 and EN 18031
Cybersecurity of radio equipment, applied since 1 August 2025.
NIS2 Directive (EU) 2022/2555
Essential and important entities; German implementation in force since 6 December 2025.
EU AI Act
Cybersecurity and robustness for high-risk AI systems.
IEC 62443 series
Industrial security standards used as the technical basis for many of these rules.
Industries
Machines, automation components, vehicles, medical devices and energy systems: every sector has its own mix of rules.
Why Nord CS
Our team holds IEC 62443 Expert, TISAX and NIS2 implementer qualifications, and our founder serves on the ENISA Advisory Board. AITIGRITY classifies products under the CRA and keeps risk assessment and evidence in one place, so the plan stays current.
Talk to a consultantQuestions we often hear
Does the CRA apply to my product?
If your product contains hardware or software and connects to a device or a network, it is likely in scope. Products covered by specific sector rules, such as medical devices under the MDR or vehicles under type approval, are excluded. We confirm the scope product by product.
What applies today?
Reporting of actively exploited vulnerabilities and severe incidents applies since 11 September 2026. All other CRA requirements, including CE marking, apply from 11 December 2027.
We already follow IEC 62443. Are we done?
It is a strong basis, but not a complete answer. The CRA adds duties such as reporting, a defined support period and an SBOM. We map what you have to what is still missing.
Do you certify products?
No. Certification and notified body assessments are done by accredited bodies. We prepare you so that this step goes smoothly.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.