Classify AI systems and GPAI models by role, risk tier, obligation set, staged application date, and required evidence.

AI Act Timeline and Compliance Guide

Separate consumer smart-device duties, ransomware payment reporting, voluntary incident coordination, Cyber Incident Review Board reviews, and SOCI overlap.

Australia Cyber Security Act Timeline and Compliance Guide

Check product scope, operator duties, essential requirements, vulnerability handling, Article 14 reporting, conformity assessment, and CE marking.

Cyber Resilience Act Timeline and Compliance Guide

ESPR DPP guide covering product-specific triggers, responsible operators, passport data, identifiers, access rights, registry and customs readiness, and implementation evidence.

Digital Product Passport Timeline and Compliance Guide

ESPR guide covering scope, delegated acts, ecodesign requirements, DPP readiness, unsold-goods duties, evidence, and implementation dates.

ESPR Timeline and Compliance Guide

Apply the voluntary ETSI EN 303 645 consumer IoT security baseline, including its scope, provisions, implementation evidence, assessments, and claim limits.

ETSI EN 303 645 Implementation Guide

Plain-language guidance for trust service provider scope, common EN 319 401 controls, operating evidence, assessment boundaries, and eIDAS mapping.

ETSI EN 319 401 Implementation Guide

Navigate certificate policy profiles, TSP and CA/RA roles, subscriber validation, certificate lifecycle controls, revocation status, CA keys, and assessment evidence.

ETSI EN 319 411-1 Certificate Service Guide

Guide to V2.6.1 qualified certificate policy profiles, EN 319 411-1 dependencies, identity proofing, QSCD routes, lifecycle controls, trusted-list reliance, and the separate eIDAS qualified-status context.

ETSI EN 319 411-2 Qualified Certificate Guide

Define the cryptographic module boundary, security level, approved services, operating environments, laboratory testing, and CMVP validation evidence.

FIPS 140-3 Implementation Guide

Choose FIPS algorithms and separate algorithm approval, CAVP testing, CMVP module validation, approved use, transitions, and procurement evidence.

FIPS Cryptographic Algorithms Guide

Plan BCMS scope, BIA, disruption risk, recovery strategy, exercises, conformity evidence, and optional certification under ISO 22301:2019.

ISO 22301 Implementation Guide

Plan ISMS scope, risk treatment, the Statement of Applicability, Annex A evidence, internal audits, management review, and certification.

ISO/IEC 27001 Implementation Guide

ISO/IEC 27005:2022 guidance for risk criteria, scenario-based assessment, treatment, residual-risk decisions, and reviewable ISMS evidence.

ISO/IEC 27005 Risk Management Guide

ISO/IEC 27017:2015 guidance for provider/customer roles, cloud contracts, control ownership, operations, evidence, and certification boundaries.

ISO/IEC 27017 Cloud Security Controls Guide

Apply ISO/IEC 27018:2025 when a public-cloud provider processes PII for customers, including contracts, subprocessors, disclosure, deletion, breaches, and evidence.

ISO/IEC 27018 Cloud Privacy Controls Guide

Use ISO/IEC 27035 to prepare for, detect, report, assess, respond to, recover from, and learn from information security incidents.

ISO/IEC 27035 Incident Response Guide

Manage acquirer-supplier roles, relationship agreements, ICT supply chains, cloud services, assurance, monitoring, change, and exit under the ISO/IEC 27036 series.

ISO/IEC 27036 Supplier Security Guide

ISO/IEC 42001:2023 guide to AIMS scope, Clauses 4-10, AI risk and impact assessment, Annex controls, operating evidence, certification, and framework comparisons.

ISO/IEC 42001 AI Management System Guide

Apply the six NIST CSF 2.0 Functions, Current and Target Profiles, Tiers, implementation examples, evidence, and action planning.

NIST CSF 2.0 Implementation Guide

Build cybersecurity supply chain risk management across enterprise governance, acquisition, engineering, operations, suppliers, and system lifecycles.

NIST SP 800-161 Rev. 1 C-SCRM Guide

Risk-tailored SSDF v1.1 guidance for software producers and acquirers across PO, PS, PW, RV, evidence, supplier assurance, and vulnerability response.

NIST SP 800-218 SSDF Implementation Guide

Plain-language guidance for selecting and tailoring NIST SP 800-53 Rev. 5 controls, assigning common and system-specific responsibility, assessing with SP 800-53A, and managing evidence and findings.

NIST SP 800-53 Rev. 5 Controls Guide

Plan incident roles, playbooks, communications, evidence, recovery, and legal overlays across the NIST SP 800-61 Rev. 3 and CSF 2.0 lifecycle.

NIST SP 800-61 Rev. 3 Incident Response Guide

Check covered products and consumer services, operator duties, accessibility evidence, CE marking, and EN 301 549 alignment under the EU Accessibility Act.

EU Accessibility Act Timeline and Implementation Guide

Check connected-product scope, user and third-party data access, B2B and B2G sharing, unfair terms, smart contracts, and cloud switching.

EU Data Act Timeline, Scope Guide, and FAQ

Check Annex I product scope, operator and trader roles, due diligence statements, geolocation, risk assessment, country benchmarking, and application dates under the EUDR.

EU Deforestation Regulation (EUDR) Timeline and Implementation Guide

Review gatekeeper designation, core platform services, Articles 5-7 obligations, Article 11 reports, interoperability, key dates, and penalties under the DMA.

EU Digital Markets Act Timeline and Implementation Guide

Map financial-entity scope, ICT risk management, incident reporting, resilience testing and TLPT, third-party risk, registers, and oversight under DORA.

EU DORA Timeline and Compliance Guide

Check NIS2 applicability, governance, cybersecurity risk-management measures, significant-incident reporting, and implementation evidence.

EU NIS2 Timeline and Compliance Guide

Review the amended 2027 CSRD scope, ESRS reporting routes, double materiality, value-chain limits, assurance, and digital reporting.

EU CSRD Scope, ESRS Reporting, and Assurance Guide

Check device qualification, operator roles, Annex VIII classification, conformity assessment, QMS and technical evidence, clinical evaluation, UDI/EUDAMED, PMS, vigilance, and legacy transition.

EU MDR Scope, Classification, Evidence, and Transition Guide

Check connectable-product scope and exceptions, economic-operator roles, the three security requirements, statements, deemed-compliance routes, records, dates, and OPSS enforcement.

UK PSTI Product Security Scope, Controls, Evidence, and Enforcement Guide

Apply the CPRA amendments within the CCPA framework, including scope, consumer rights, sensitive information, GPC, contracts, 2026 regulations, deadlines, and evidence.

US CPRA Timeline and Implementation Guide

Map LGPD territorial scope, controller and operator roles, legal bases, rights, RIPDs, incidents, international transfers, and ANPD enforcement.

Brazil LGPD Timeline and Implementation Guide

Classify battery categories and map operator duties, labelling, CE conformity, due diligence, battery passports, collection, recycling, and application dates.

EU Batteries Regulation Timeline and Implementation Guide

Apply the amended CSDDD scope and 2029 application date under Directive (EU) 2026/470, including due diligence, evidence, reporting, and national enforcement.

EU CSDDD Timeline and Implementation Guide

Classify intermediary-service tiers and map moderation, redress, platform and marketplace duties, transparency cycles, VLOP/VLOSE assurance, and enforcement under the DSA.

EU Digital Services Act Timeline and Implementation Guide

Separate electronic identification, trust services, qualified status, trusted lists, signatures, seals, time stamps, QWACs, and EU Digital Identity Wallet roles.

EU eIDAS Timeline and Implementation Guide

Classify apparatus and fixed installations, assess emissions and immunity, document standards and testing, prepare the EU declaration and CE marking, and manage operator evidence under Directive 2014/30/EU.

EU EMC Directive Compliance Hub

Review the energy-efficiency-first principle, enterprise thresholds, audits and energy management, public-sector duties, data-centre reporting, and implementation evidence.

EU Energy Efficiency Directive Timeline and Implementation Guide

Apply communications confidentiality, service security, traffic and location data rules, terminal-equipment access, consent exemptions, direct marketing, and GDPR interplay.

EU ePrivacy Timeline and Implementation Guide

Map GDPR scope, roles, lawful bases, rights, accountability evidence, incidents, processors, international transfers, and operating deadlines.

EU GDPR Timeline and Implementation Guide

Check consumer-product scope, safety assessments, economic-operator and responsible-person duties, traceability, marketplace duties, recalls, and notifications under the GPSR.

EU GPSR Timeline and Implementation Guide

Track the proposal's uncertain status and review scope, substantiation, verification, labels, comparisons, enforcement scenarios, and adopted consumer-law overlap.

EU Green Claims Directive Proposal and Claim-Governance Hub

Classify LVD voltage scope and exclusions, then connect Annex I safety objectives, internal production control, technical documentation, EU declarations, CE marking, standards updates, and post-market duties.

EU Low Voltage Directive Compliance Hub

Classify machinery, related products and partly completed machinery; identify economic-operator roles; map Annex III and Annex I; select the Article 25 route; and prepare release and transition evidence.

EU Machinery Regulation Compliance Hub

Determine product scope, assign Article 4 economic-operator roles, document distance sales, and prepare evidence for authority requests, customs controls, and corrective action.

EU Market Surveillance Regulation Compliance Hub

Classify packaging and operator roles, then map substances, recyclability, recycled content, minimisation, reuse, labelling, conformity, EPR and transition evidence under Regulation (EU) 2025/40.

EU PPWR Packaging Compliance Hub

Classify radio equipment, map Article 3 essential requirements, plan conformity and CE evidence, and track cybersecurity and common-charger dates under RED.

EU RED Directive Timeline and Implementation Guide

Classify electrical and electronic equipment, check the ten restricted substances and exemptions, and prepare CE technical documentation under RoHS.

EU RoHS Timeline and Implementation Guide

Separate economic-activity eligibility from alignment, DNSH, minimum safeguards, delegated-act criteria, and Article 8 disclosure planning.

EU Taxonomy Timeline and Implementation Guide

Map Singapore PDPA scope, accountability, consent and notification, DPO information, data intermediaries, breach notification, DNC checks, transfers, and evidence.

Singapore PDPA Timeline and Implementation Guide

UK GDPR guide to scope, roles, lawful bases, rights, accountability, breaches, children, automated decisions, international transfers, and 2025-2026 amendments.

UK GDPR Timeline and Implementation Guide

Check regulated user-to-user and search-service scope, illegal-content duties, child-access assessments, child-risk assessments, deadlines, and Ofcom evidence.

UK Online Safety Act Timeline and Implementation Guide

Apply the CCPA with its CPRA amendments and 2026 regulations, including scope, rights, GPC, contracts, risk assessments, cybersecurity audits, ADMT, data brokers, and enforcement.

US CCPA Timeline and Implementation Guide

A combined view of regulatory deadlines across frameworks. See what is coming and when, then tailor a custom view for your organisation with Sorena.

Regulatory Universal Timeline

Classify commercial cryptography use, screen product and service routes, and prepare testing, certification, import/export, supplier, and China release evidence.

China Cryptography Law and Commercial Cryptography Compliance Guide

Map network operator, CII, data security, cybersecurity review, app governance, MIIT filing, MLPS, and connected-device security evidence.

China Cybersecurity, Data Security, and Network Review Compliance Guide

Route waste electrical and electronic products through recovery, qualified disposal, recycler/disposal-operator licensing, contracts, and lifecycle records.

China WEEE and E-Waste Recovery Compliance Guide

Map PIPL processing duties, app minimization, separate consent, PIPIA, SCC filings, data export security assessment, and cross-border transfer evidence.

China Personal Information Protection and Data Export Compliance Guide

Apply the China RoHS function-and-voltage scope, actor duties, substance information, environmental protection use period marking, and additional catalogue/conformity route.

China RoHS Hazardous Substances Compliance Guide

Separate network access permits, radio and micro-power requirements, 2400/5100/5800 MHz rules, mobile terminal app duties, and connected-device launch evidence.

GRC Artifact Index

ISO/IEC 27036 Supplier Security Guide

Guidance tailored to your needs