EU cybersecurity compliance
We help manufacturers, public institutions, operators of essential services and ICT providers get ready for Europe's cybersecurity and AI rules, from the Cybersecurity Act certification schemes to the Cyber Resilience Act, the AI Act, NIS2 and DORA.
We are a boutique consultancy. We take part in the standards and certification work behind these rules, in CEN/CENELEC, ETSI, ISO and ENISA ad hoc working groups, and we work in English and Spanish.
Experience you can check
- Since 2007 in security evaluation and certification
- ISO/IEC JTC 1/SC 27 national expert and co-editor of ISO/IEC TS 9569
- ENISA ad hoc working groups for EUCC and EUMSS
- ICCC speaker at the International Common Criteria Conference
What we do
Compliance readiness
Gap analysis, architecture guidance and conformity evidence mapped to each regulation, so your evaluation or audit starts from a known position.
Standards expertise
Direct experience in the committees that write the harmonised standards and certification schemes the regulations rely on.
Technical depth
We read your design and your code, and translate regulatory text into concrete engineering requirements.
Services
Each service page lists what you receive, how long it usually takes and a fixed-scope first step.
- EUCC and Common Criteria Security targets, evaluation evidence and certificate maintenance for vendors certifying ICT products under EUCC.
- Cyber Resilience Act Product classification, Annex I gap analysis, vulnerability handling, Article 14 reporting and technical documentation for CE marking under the CRA.
- AI Act Risk classification, Annex IV technical documentation, quality management and Article 15 security testing for high-risk AI systems.
- Certification schemes Scheme rules, protection profiles and evaluation methodologies for governmental and private scheme owners, aligned with the Cybersecurity Act and EUCC.
- NIS2 Directive Scoping, Article 21 risk-management measures, incident reporting and supply chain security under NIS2, aligned with Spain's ENS and with the national transposition that applies to you.
- DORA DORA readiness for financial entities and for the ICT and managed security providers that serve them: contract clauses, register of information, TLPT and evidence.
Not a manufacturer?
We also work with the organisations that operate essential services or supply them.
- Operators of essential services NIS2 scoping, risk-management measures, incident notification and supplier security, aligned with Spain's ENS where it applies. See the service
- ICT and managed security providers to banks and insurers What DORA asks of you through your customers, one evidence pack for their questionnaires, and readiness for the EUMSS candidate scheme. See the service
Everything is connected
EU cybersecurity rules overlap. An AI product can fall under the AI Act and the CRA at once, and a certificate earned for one regulation can support another. We plan compliance across all of them.
Explore the interplay
Tell us which rules apply to you and where you stand
A few lines about your product, service or organisation are enough. We reply within 8 working hours (Madrid time).
Contact us