Writing
Writing, from our own data
Every piece below rests on a dataset we maintain and cite.
Who it applies toThe datesThe one thing to do
- Who it applies to
- Anyone who needs the answer to one regulatory question rather than a platform.
- The dates
- Every article carries the day it was published and the day its sources were read, and the subjects below carry the most recent.
- The one thing to do
- Start from the subject that matches your question, then read the article: each one opens with who it applies to, the dates, and the one thing to do.
- Cyber Resilience Act
CRA Article 13 for a software manufacturer
The twenty-five paragraphs in order, which are yours, which are the Commission's, and a checklist by role.
13 September 2026 - Data Act
The Data Act for a SaaS company
The switching duties since 12 September 2025, the nine contract terms, the end of switching charges, and what a data holder owes.
13 September 2026 - ISO 27001
The ISO 27001 corrective action record
What Clause 10.2 asks for after a nonconformity, the seven sections an auditor accepts, the mistakes that reopen a finding, and a page that writes it.
13 September 2026 - ISO 27001
The ISO 27001 information security policy
What Clause 5.2 asks for, the nine sections of a short policy, the mistakes an auditor flags, and a page that writes it.
13 September 2026 - ISO 27001
The ISO 27001 management review
The seven inputs of Clause 9.3 as an agenda, the four trends, the two outputs, what the minutes have to show, and a page that writes them.
13 September 2026 - ISO 27001
The ISO 27001 risk assessment for a software company
What Clause 6.1.2 asks for, a five-point method, the starter risks, and a page that writes the register and the treatment plan.
13 September 2026 - ISO 42001
The ISO 42001 AI policy for a software company
What Clause 5.2 asks for, the ten sections, the AI Act duties it names, the mistakes an auditor flags, and a page that writes it.
13 September 2026 - ISO 42001
The ISO 42001 AI system impact assessment
What Clause 6.1.4 asks for, the three levels of consequence, where it meets the AI Act, the mistakes an auditor flags, and a page that writes it.
13 September 2026 - NIS2
The NIS2 incident clock for a software company
The 24-hour early warning, the 72-hour notification, the one-month final report, what makes an incident significant for a cloud provider, and a page that writes the three reports.
13 September 2026 - AI Act
AI literacy under Article 4 of the AI Act
AI literacy under Article 4 of the AI Act, as rewritten on 27 July 2026: what 'take measures' means, who it covers, what it does not require, and the record to keep.
12 September 2026 - AI Act
Article 50 of the AI Act for generative AI
Article 50 of the AI Act for a company that ships or uses generative AI: the four transparency duties in force since 2 August 2026, the 2 December 2026 transition, the code of practice and the EU icon.
12 September 2026 - ISO 9001
Does ISO 9001:2015 require a quality manual?
What clause 7.5 asks for instead, the 21 places the standard names documented information, and what a manual is for today.
12 September 2026 - DORA
DORA for a software vendor
The Article 30 contract clauses your bank customer will send, the register of information you will appear in, and what ISO 27001 already answers.
12 September 2026 - DORA
DORA's nineteen types of ICT service, S01 to S19
Which one a SaaS product is, what the register of information records about it, and why one contract can be several rows.
12 September 2026 - DORA
Subcontracting under DORA, RTS 2025/532
Ten conditions your customer checks, twelve terms your contract carries, a notice period before you change a subcontractor.
12 September 2026 - DORA
Your bank's DORA vendor policy, RTS 2024/1773
The six due-diligence questions, the five sources of assurance, the eight conditions for accepting your ISO 27001 certificate in place of an audit, and the five reports you will owe.
12 September 2026 - NIS2
Essential or important under NIS2
The size rule, the size-blind rules and the seven ways to be essential.
12 September 2026 - GDPR
GDPR international transfers for a software company
The 17 adequacy decisions, the four SCC modules, what a US, UK or Indian sub-processor needs, and a page that picks the mechanism.
12 September 2026 - Cyber Resilience Act
Harmonised standards for the CRA
None cited yet, 41 requested, the first two were due 30 August 2026.
12 September 2026 - ISO 9001
How to check an ISO 9001 certificate is real
What a certificate must show, three checks that take ten minutes, and the 27 accreditation registers.
12 September 2026 - ISO 27701
ISO/IEC 27701:2025 for a software company
The standalone privacy standard, its 78 controls, what an ISO 27001 system already covers, and the GDPR articles each control evidences.
12 September 2026 - ISO 9001
ISO 9001 for a software company
What clause 8 means when the product is code, sub-clause by sub-clause.
12 September 2026 - ISO 9001
Which EU countries name ISO 9001 in public tenders
4,897 German notices, 4,743 Romanian, and one in ten Romanian notices names it.
12 September 2026 - NIS2
NIS2 Article 20 for the board
What the management body must approve, oversee and learn, the twelve places the Implementing Regulation names it, and what liability means.
12 September 2026 - NIS2
NIS2 for a SaaS company
You are a cloud computing service provider, and this is what follows.
12 September 2026 - NIS2
NIS2 for managed service providers and MSSPs
An Annex I entity by definition, and the supplier every customer's due diligence lands on.
12 September 2026 - NIS2
NIS2 for marketplaces, search engines, social networks
NIS2 for online marketplaces, search engines and social networks: the Annex II digital providers, and why they are never essential by size.
12 September 2026 - NIS2
NIS2 registration
The two lists you may be on, what you submit, by when, and to whom (Article 3(4) and Article 27).
12 September 2026 - NIS2
NIS2 transposition, state by state
What the Commission's own register shows.
12 September 2026 - AI Act
The AI Act after the Digital Omnibus
The dates that changed on 27 July 2026, and which ISO 42001 controls produce the evidence for Article 17's thirteen aspects and Articles 9 to 15.
12 September 2026 - AI Act
The AI Act for a software company
Which role you are, what applies to everyone, what applies only to a high-risk provider, the SME provisions, and the dates as amended.
12 September 2026 - Cyber Resilience Act
The EU declaration of conformity under the CRA
Annex V point by point, the simplified form, and a worked example.
12 September 2026 - GDPR
The GDPR 72-hour breach clock for a software company
When awareness starts it, what the notification contains, the processor's own clock, and the NIS2, CRA and DORA clocks beside it.
12 September 2026 - GDPR
The GDPR data subject request for a software company
The month of Article 12(3), the eight contents of an access answer, the two further months, and a page that computes the deadline.
12 September 2026 - GDPR
The GDPR for a software company
Controller of your own data, processor for your customers', and the five duties that turn on size and data.
12 September 2026 - GDPR
The GDPR impact assessment for a software company
The three cases of Article 35(3), the nine criteria behind them, the four elements of Article 35(7), and a page that writes it.
12 September 2026 - GDPR
The GDPR privacy notice for a software company
The twelve pieces of Article 13, the thirteen of Article 14, the moment each is given, and a page that writes it.
12 September 2026 - GDPR
The GDPR processor contract for a SaaS company
The eight terms of Article 28(3) every customer addendum carries, the duty most of them forget, and what sits beside them under DORA.
12 September 2026 - GDPR
The GDPR record of processing for a software company
The seven fields of Article 30(1), the four of Article 30(2), why the 250-person exemption never applies, and a page that writes it.
12 September 2026 - GDPR
The GDPR representative of Article 27
The GDPR representative of Article 27 for a software company outside the EU: who must appoint one, the three conditions of the exemption, and where the name goes.
12 September 2026 - ISO 27001
The ISO 27001 scope statement
Why a certificate that says head office does not cover your SaaS, what clause 4.3 asks for, what a buyer under DORA checks, and three scope statements that pass.
12 September 2026 - ISO 27001
The ISO 27001 Statement of Applicability
The ISO 27001 Statement of Applicability for a software company: the 93 controls, the four columns of Clause 6.1.3(d), the exclusions an auditor accepts, and a page that writes it.
12 September 2026 - ISO 9001
The ISO 9001 management review
The 13 inputs and 3 outputs of clause 9.3 as an agenda, where each input comes from, and what the minutes have to show.
12 September 2026 - ISO 9001
The ISO 9001 quality policy
The four things clause 5.2 says it must contain, the three things that must happen to it, and a one-page example.
12 September 2026 - DORA
Where your bank customer's ICT risk framework reaches
The nine places where your bank customer's ICT risk framework reaches into your product, RTS 2024/1774: support end dates, vulnerability reports and library tracking, settings you may not let it bypass, source code tested before production, named accounts for your staff, and your incidents as its alarms.
12 September 2026 - NIS2
The ten measures of NIS2 Article 21(2), as a checklist
Each point quoted, the Regulation sections behind it, and the ISO 27001 controls that already produce it.
12 September 2026 - DORA
Threat-led penetration testing under DORA
Threat-led penetration testing under DORA, from the vendor's side: when your bank customer's red team is allowed into your production systems, the 12-week test of RTS 2025/1190, the pooled test you can run instead, and what the contract already says.
12 September 2026 - AI Act
What a deployer of a high-risk AI system owes
What a deployer of a high-risk AI system owes under Article 26 of the AI Act: the twelve paragraphs in order, the Article 27 impact assessment, when you become the provider, and the records an ISO 42001 system keeps.
12 September 2026 - ISO 9001
What ISO 9001 certification costs
The audit days IAF MD 5 fixes by headcount, the day rate, the three-year total, and why it is a third of ISO 27001.
12 September 2026 - DORA
When your outage becomes your bank customer's major incident
DORA's six criteria, the two-hour downtime threshold of RTS 2024/1772, the four-hour, 24-hour, 72-hour and one-month clocks of RTS 2025/301, and the facts your customer will need from you.
12 September 2026 - GDPR
Which GDPR supervisory authority is yours
The main establishment, the lead authority of Article 56, the local cases, and the 30 authorities of the Board.
12 September 2026 - Cyber Resilience Act
CRA Annex 1
The 22 essential requirements as a checklist, 14 product requirements and 8 for vulnerability handling.
11 September 2026 - Cyber Resilience Act
The CRA final report clock
The CRA final report clock does not start when you become aware.
11 September 2026 - Cyber Resilience Act
CRA or NIS2
Which one applies to a software company, and can it be both?
11 September 2026 - Cyber Resilience Act
Default, important or critical
The 26 technical descriptions of Implementing Regulation 2025/2392, and the core-functionality test.
11 September 2026 - Cyber Resilience Act
Does software need a CE mark under the CRA?
Yes, and Article 30 says where it goes.
11 September 2026 - Cyber Resilience Act
Does the CRA apply to open-source software?
Three cases, and the light regime for stewards.
11 September 2026 - Cyber Resilience Act
Does the CRA require an SBOM?
Yes, and here is exactly what it says.
11 September 2026 - Cyber Resilience Act
How long is the CRA support period?
At least five years, the end date shown at purchase, each update kept ten years.
11 September 2026 - Cyber Resilience Act
How to file a CRA notification on ENISA's platform
A personal EU Login, one coordinator, three tabs, no API.
11 September 2026 - ISO 27001
ISO 27001 without a consultant
What you take on, in the order you take it on.
11 September 2026 - Cyber Resilience Act
Is your open-source project 'commercial' under the CRA?
The Commission's seven tests, with its examples.
11 September 2026 - Cyber Resilience Act
Is your product important or critical under the CRA?
Default unless it is one of the 19, 4 or 3 categories of Annex III and IV.
11 September 2026 - Cyber Resilience Act
Is your product in scope of the Cyber Resilience Act?
Where SaaS sits.
11 September 2026 - ISO 42001
ISO 42001 certification
What it asks for, what it costs, and who is actually asking.
11 September 2026 - Cyber Resilience Act
NIS2 or CRA
Which incident clock runs for a software company, and what makes an incident 'significant'.
11 September 2026 - Cyber Resilience Act
Self-assessment under the CRA
What module A actually requires, from Annex VIII and the Commission's FAQ.
11 September 2026 - Cyber Resilience Act
The CRA's coordinated vulnerability disclosure policy
The coordinated vulnerability disclosure policy the CRA requires: three provisions, and a one-page policy that meets them.
11 September 2026 - Cyber Resilience Act
The CRA cybersecurity risk assessment
What Article 13 actually requires, and the one output it must produce.
11 September 2026 - Cyber Resilience Act
The CRA for a small software manufacturer
The Cyber Resilience Act for a small software manufacturer, in twelve steps.
11 September 2026 - Cyber Resilience Act
The EU's own CRA machinery, on the day the duty started
0 notified bodies, 0 harmonised standards, 7 of 27 enforcers.
11 September 2026 - Cyber Resilience Act
What goes in the CRA technical file
Annex VII, point by point.
11 September 2026 - Cyber Resilience Act
What the CRA asks of importers and distributors
What the CRA asks of importers and distributors, and when it makes them the manufacturer.
11 September 2026 - Cyber Resilience Act
What the CRA asks of you for your dependencies
Due diligence, reporting upstream, and known exploitable vulnerabilities, from the Commission's guidance.
11 September 2026 - Cyber Resilience Act
What you have to report under the CRA
The two triggers, as the Regulation defines them.
11 September 2026 - Cyber Resilience Act
When does the CRA's 24-hour clock start?
At a reasonable degree of certainty after a prompt initial assessment, per the Commission's guidance.
11 September 2026 - Cyber Resilience Act
When is software 'placed on the market' under the CRA?
When is software 'placed on the market' under the CRA, and which of your builds is a product? The guidance's rule for standalone software.
11 September 2026 - Cyber Resilience Act
Which CSIRT do you report to under the CRA?
The coordinator for your main establishment, all 27 named.
11 September 2026 - Cyber Resilience Act
Which parts of your backend are inside the CRA?
Remote data processing, from the Commission's guidance.
11 September 2026 - Cyber Resilience Act
Which update puts your existing software under the CRA?
Substantial modifications, from the Commission's guidance.
11 September 2026 - Cyber Resilience Act
Who enforces the Cyber Resilience Act in your member state?
7 of 27 have said.
11 September 2026 - Cyber Resilience Act
Cyber Resilience Act penalties
What a small manufacturer is actually exposed to.
8 September 2026 - ISO 27001
How to answer a security questionnaire
How to answer a security questionnaire from your ISO 27001 ISMS: 30 question topics mapped to the Annex A controls that answer them.
3 September 2026 - ISO 27001
Which EU countries name ISO 27001 in public tenders
1,548 German notices, 829 Polish, and Greece has the highest share.
3 September 2026 - ISO 27001
Best ISO 27001 compliance software
What to ask before you compare features.
20 August 2026 - ISO 27001
Cheapest ISO 27001 certification
How to compare quotes without buying a worthless certificate.
20 August 2026 - ISO 27001
The cheapest way to get ISO 27001
The cheapest way to get ISO 27001, and the part you cannot make cheaper.
20 August 2026 - ISO 27001
How to get ISO 27001 certification
How to get ISO 27001 certification for a company, in the order it actually happens.
20 August 2026 - ISO 27001
ISO 27001 certification cost for a company, by headcount
Auditor days come from the ISO/IEC 27006-1:2024 Annex C chart, so certification cost tracks headcount more than industry. Here is the arithmetic, and the lines people forget.
20 August 2026 - ISO 27001
ISO 27001 compliance checklist, by clause
A checklist that follows the standard's own structure: clauses 4 to 10 and what each one asks you to be able to show, plus what Annex A adds.
20 August 2026 - ISO 27001
ISO 27001 cost of implementation
The three-year number, not the first invoice.
20 August 2026 - NIS2
ISO 27001 vs NIS2
What the certificate covers and what it does not.
20 August 2026 - ISO 27001
ISO 27001 auditor days by headcount
How many auditor days an ISO 27001 certification takes, by headcount.
11 August 2026 - ISO 27001
ISO 27001 vs SOC 2 in Europe
Which one buyers actually ask for.
11 August 2026