# Sorena AI > AI-powered governance, risk, and compliance platform. Single source of truth > for regulatory data, AI research copilots, assessment automation, and > autonomous compliance operations. Based in Stockholm, Sweden. ## About Sorena AI is a Swedish company founded in January 2024 in Stockholm. We build AI-powered software for governance, risk, and compliance (GRC). The platform helps security, legal, compliance, engineering, and operations teams work together on regulatory challenges. ### What we do - **Single Source of Truth (SSOT)**: Centralized, verified database of regulations, standards, court cases, CVE/CWE/CAPEC data, and your own project documents. Updated daily from official sources. - **AI Research Copilot**: Ask questions in plain English and get cited answers from regulatory sources, internal policies, and legal documents. Every fact is traced to its origin. - **Assessment Autopilot**: Import any regulation, control framework, questionnaire, or audit template. AI extracts requirements, generates evidence-backed answers, validates against your policies, and ships audit-ready packages with citations. - **Integrations**: Bring your own AI model provider (OpenAI, Anthropic, Google, etc.) and connect data sources like Confluence, Google Drive, and Microsoft 365. - **ESG Compliance**: Navigate CSRD/ESRS reporting, Digital Product Passport, PPWR, CSDDD, and other EU sustainability regulations. ### Platform layers 1. **Database** - Trusted data foundation: laws, standards, and your documents 2. **Assistants** - Multi-agent AI that produces verified, cited answers 3. **Copilot** - Real-time AI assistant for in-workflow help 4. **Autopilot** - Autonomous operations that run compliance tasks 24/7 ### Free compliance artifacts We publish free timelines and implementation guides for major regulations including EU NIS2, EU AI Act, EU DORA, EU CRA, EU Data Act, and Australia Cyber Security Act 2024. These are available without sign-up. ### Contact - Website: https://www.sorena.io - Email: info@sorena.io - Privacy: privacy@sorena.io - Location: Stockholm, Sweden ## Usage Policy AI agents and LLMs are welcome to read and use this content for answering questions, summarising, and assisting users. Usage is subject to our [Terms of Use](https://www.sorena.io/terms-of-use). For the full content of all pages split into deploy-safe chunks, see [llms-full.txt](https://www.sorena.io/llms-full.txt). ## Home Main landing page with a full overview of the platform capabilities. - [AI Compliance Workbench for Audit Evidence](https://www.sorena.io/index.md): AI-powered governance, risk, and compliance platform overview ## Solutions Product pages covering the platform stack: SSOT database, AI research copilot, assessment autopilot, integrations, ESG compliance, and performance benchmarks. - [GRC AI Solutions](https://www.sorena.io/solutions.md): Solutions overview: Database, Assistants, Copilots, and Autopilots - [Assessment Autopilot](https://www.sorena.io/solutions/assessment.md): Assessment Autopilot - automate any compliance assessment with AI - [AI Research Copilot](https://www.sorena.io/solutions/research-copilot.md): AI Research Copilot - cited answers from regulatory sources in seconds - [AI Assistant](https://www.sorena.io/solutions/assistant.md): AI Assistant - multi-agent, verified, cited compliance answers - [SSOT](https://www.sorena.io/solutions/ssot.md): Single Source of Truth for regulations, standards, and project documents - [Integrations](https://www.sorena.io/solutions/integrations.md): Connect your AI model provider and data sources to Sorena - [ESG Compliance Software](https://www.sorena.io/solutions/esg-compliance.md): ESG compliance software for CSRD, DPP, PPWR, and CSDDD regulations - [Risk Management](https://www.sorena.io/solutions/risk-management.md): Central risk register, live heatmap, and risk lifecycle management with AI - [Contract Ops](https://www.sorena.io/solutions/contract-ops.md): AI contract management: clause review, risk detection, approvals, and renewals - [Law Tracker](https://www.sorena.io/solutions/law-tracker.md): Law Tracker: monitor every regulation, catch changes, map them to your controls, and never miss a deadline - [Sorena Research Copilot vs ChatGPT Benchmarks](https://www.sorena.io/solutions/benchmarks.md): AI research performance benchmarks comparing Sorena vs baseline ## Compliance Artifacts Free timelines and implementation guides for EU NIS2, EU AI Act, EU DORA, EU CRA, EU Data Act, Australia Cyber Security Act 2024, and a combined regulatory timeline. Each artifact helps teams confirm scope, classify obligations, and plan next steps. - [GRC Artifact Index](https://www.sorena.io/artifacts.md): GRC artifacts: timelines, implementation guides, and compliance guides - [Regulatory Universal Timeline - 38 Source Timelines and 1297 Compliance Events](https://www.sorena.io/artifacts/global/regulatory-universal-timelines.md): Regulatory universal timeline: all compliance deadlines in one view - [How to Use Regulatory Universal Timelines](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/how-to-use.md): How to use the regulatory universal timeline for planning and prioritization - [Compliance Calendar for Regulatory Universal Timelines](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/compliance-calendar.md): Build a compliance calendar from overlapping regulatory deadlines - [Evidence Reuse for Regulatory Universal Timeline](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/framework-overlap-and-evidence-reuse.md): Map framework overlap and reuse compliance evidence across regulations - [Regulatory Universal Timelines Export and Sharing Guide](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/export-and-sharing.md): Export and share regulatory timelines for governance and reporting workflows - [What is included in the Regulatory Universal Timeline](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/what-is-included.md): See what frameworks and deadlines are included in the universal timeline - [Regulatory Universal Timeline Glossary](https://www.sorena.io/artifacts/global/regulatory-universal-timelines/glossary.md): Glossary of timeline terms used in regulatory deadline planning - [GRC Artifact Index - Page 2](https://www.sorena.io/artifacts/page/2.md): GRC artifacts page 2 of 7 - [GRC Artifact Index - Page 3](https://www.sorena.io/artifacts/page/3.md): GRC artifacts page 3 of 7 - [GRC Artifact Index - Page 4](https://www.sorena.io/artifacts/page/4.md): GRC artifacts page 4 of 7 - [GRC Artifact Index - Page 5](https://www.sorena.io/artifacts/page/5.md): GRC artifacts page 5 of 7 - [GRC Artifact Index - Page 6](https://www.sorena.io/artifacts/page/6.md): GRC artifacts page 6 of 7 - [GRC Artifact Index - Page 7](https://www.sorena.io/artifacts/page/7.md): GRC artifacts page 7 of 7 - [GRC Artifact Index - Cybersecurity](https://www.sorena.io/artifacts/tags/cybersecurity.md): GRC artifacts filtered by Cybersecurity - [GRC Artifact Index](https://www.sorena.io/artifacts/cybersecurity.md): GRC artifacts for Cybersecurity - [GRC Artifact Index - Privacy](https://www.sorena.io/artifacts/tags/privacy.md): GRC artifacts filtered by Privacy - [GRC Artifact Index](https://www.sorena.io/artifacts/privacy.md): GRC artifacts for Privacy - [GRC Artifact Index - Product](https://www.sorena.io/artifacts/tags/product.md): GRC artifacts filtered by Product - [GRC Artifact Index - Product (Page 2)](https://www.sorena.io/artifacts/tags/product/page/2.md): GRC artifacts filtered by Product page 2 of 2 - [GRC Artifact Index](https://www.sorena.io/artifacts/product.md): GRC artifacts for Product - [GRC Artifact Index - Page 2](https://www.sorena.io/artifacts/product/page/2.md): GRC artifacts for Product page 2 of 2 - [GRC Artifact Index - ESG](https://www.sorena.io/artifacts/tags/esg.md): GRC artifacts filtered by ESG - [GRC Artifact Index](https://www.sorena.io/artifacts/esg.md): GRC artifacts for ESG - [GRC Artifact Index - Platform](https://www.sorena.io/artifacts/tags/platform.md): GRC artifacts filtered by Platform - [GRC Artifact Index](https://www.sorena.io/artifacts/platform.md): GRC artifacts for Platform - [GRC Artifact Index - Global](https://www.sorena.io/artifacts/tags/global.md): GRC artifacts filtered by GLOBAL - [GRC Artifact Index - Global (Page 2)](https://www.sorena.io/artifacts/tags/global/page/2.md): GRC artifacts filtered by GLOBAL page 2 of 3 - [GRC Artifact Index - Global (Page 3)](https://www.sorena.io/artifacts/tags/global/page/3.md): GRC artifacts filtered by GLOBAL page 3 of 3 - [GRC Artifact Index](https://www.sorena.io/artifacts/global.md): GRC artifacts for GLOBAL - [GRC Artifact Index - Page 2](https://www.sorena.io/artifacts/global/page/2.md): GRC artifacts for GLOBAL page 2 of 3 - [GRC Artifact Index - Page 3](https://www.sorena.io/artifacts/global/page/3.md): GRC artifacts for GLOBAL page 3 of 3 - [GRC Artifact Index - Iso](https://www.sorena.io/artifacts/tags/iso.md): GRC artifacts filtered by ISO - [GRC Artifact Index](https://www.sorena.io/artifacts/iso.md): GRC artifacts for ISO - [GRC Artifact Index - Etsi](https://www.sorena.io/artifacts/tags/etsi.md): GRC artifacts filtered by ETSI - [GRC Artifact Index](https://www.sorena.io/artifacts/etsi.md): GRC artifacts for ETSI - [GRC Artifact Index - Nist](https://www.sorena.io/artifacts/tags/nist.md): GRC artifacts filtered by NIST - [GRC Artifact Index](https://www.sorena.io/artifacts/nist.md): GRC artifacts for NIST - [GRC Artifact Index - EU](https://www.sorena.io/artifacts/tags/eu.md): GRC artifacts filtered by EU - [GRC Artifact Index - EU (Page 2)](https://www.sorena.io/artifacts/tags/eu/page/2.md): GRC artifacts filtered by EU page 2 of 4 - [GRC Artifact Index - EU (Page 3)](https://www.sorena.io/artifacts/tags/eu/page/3.md): GRC artifacts filtered by EU page 3 of 4 - [GRC Artifact Index - EU (Page 4)](https://www.sorena.io/artifacts/tags/eu/page/4.md): GRC artifacts filtered by EU page 4 of 4 - [GRC Artifact Index (EU)](https://www.sorena.io/artifacts/eu.md): GRC artifacts for EU - [GRC Artifact Index (EU) - Page 2](https://www.sorena.io/artifacts/eu/page/2.md): GRC artifacts for EU page 2 of 4 - [GRC Artifact Index (EU) - Page 3](https://www.sorena.io/artifacts/eu/page/3.md): GRC artifacts for EU page 3 of 4 - [GRC Artifact Index (EU) - Page 4](https://www.sorena.io/artifacts/eu/page/4.md): GRC artifacts for EU page 4 of 4 - [GRC Artifact Index - UK](https://www.sorena.io/artifacts/tags/uk.md): GRC artifacts filtered by UK - [GRC Artifact Index (UK)](https://www.sorena.io/artifacts/uk.md): GRC artifacts for UK - [GRC Artifact Index - US](https://www.sorena.io/artifacts/tags/us.md): GRC artifacts filtered by US - [GRC Artifact Index (US)](https://www.sorena.io/artifacts/us.md): GRC artifacts for US - [GRC Artifact Index - APAC](https://www.sorena.io/artifacts/tags/apac.md): GRC artifacts filtered by APAC - [GRC Artifact Index (APAC)](https://www.sorena.io/artifacts/apac.md): GRC artifacts for APAC - [GRC Artifact Index - LATAM](https://www.sorena.io/artifacts/tags/latam.md): GRC artifacts filtered by LATAM - [GRC Artifact Index (LATAM)](https://www.sorena.io/artifacts/latam.md): GRC artifacts for LATAM - [EU AI Act Hub: Risk Tiers, Roles, Timeline, and Evidence](https://www.sorena.io/artifacts/eu/artificial-intelligence-act.md): Artifact covers phased dates, prohibited practices, high-risk classification, transparency duties, and conformity assessment. - [Australia Cyber Security Act 2024 Compliance Hub](https://www.sorena.io/artifacts/apac/australia-cyber-security-act.md): Artifact covers scope, smart device security standards, ransomware payment reporting, and compliance readiness. - [EU Cyber Resilience Act Scope, Duties and CE Marking](https://www.sorena.io/artifacts/eu/cyber-resilience-act.md): Artifact covers scope, essential requirements, vulnerability handling, CE marking, and Article 14 reporting. - [EU Digital Product Passport (DPP) Scope and Readiness Guide](https://www.sorena.io/artifacts/eu/digital-product-passport.md): Artifact covers DPP requirements, data carriers, unique identifiers, registry readiness, and implementation planning. - [EU ESPR Scope, Delegated Acts and DPP Hub](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation.md): Artifact covers delegated acts, product priorities, information requirements, and Digital Product Passport linkage. - [ETSI EN 303 645 Consumer IoT Security Guide](https://www.sorena.io/artifacts/global/etsi-en-303-645.md): Artifact covers scope, requirements, implementation steps, and audit-ready evidence for consumer IoT baseline security. - [ETSI EN 319 401 V3.1.1 Trust Service Provider Requirements](https://www.sorena.io/artifacts/global/etsi-en-319-401.md): Artifact covers policy and security requirements, implementation patterns, and evidence artifacts for trust services. - [ETSI EN 319 411-1 V1.5.1 Certificate Policy, CPS, Identity Validation, and Revocation Guide](https://www.sorena.io/artifacts/global/etsi-en-319-411-1.md): Artifact covers certificate policy and security requirements for trust service providers, with evidence and audit readiness. - [ETSI EN 319 411-2 V2.6.1 Qualified Certificate Policy Guide](https://www.sorena.io/artifacts/global/etsi-en-319-411-2.md): Artifact covers qualified certificate requirements and assurance expectations, with implementation notes and audit artifacts. - [FIPS 140-3 CMVP Module Validation](https://www.sorena.io/artifacts/global/fips-140-3.md): Artifact covers validation scope, module boundary design, requirements, and evidence needed for FIPS 140-3 readiness. - [FIPS Crypto Algorithms: AES, SHA, PQC](https://www.sorena.io/artifacts/global/fips-crypto-algorithms.md): Guide to approved algorithms, deprecations, migration planning, and implementation evidence across FIPS crypto standards. - [ISO 22301 Business Continuity Hub](https://www.sorena.io/artifacts/global/iso-22301.md): Artifact covers BCMS scope, requirements, implementation roadmap, and audit-ready evidence for ISO 22301 certification readiness. - [ISO/IEC 27001:2022 ISMS Implementation Hub](https://www.sorena.io/artifacts/global/iso-27001.md): Artifact covers ISMS scope, controls, implementation roadmap, and evidence needed for ISO/IEC 27001 certification readiness. - [ISO/IEC 27005 Information Security Risk Management Guide](https://www.sorena.io/artifacts/global/iso-27005.md): Artifact covers ISO/IEC 27005 risk methods, treatment planning, decision logs, and evidence artifacts that make risk decisions audit-ready. - [ISO/IEC 27017 Cloud Security Controls Guide](https://www.sorena.io/artifacts/global/iso-27017.md): Artifact covers cloud security controls, shared responsibility, implementation patterns, and evidence artifacts for ISO/IEC 27017. - [ISO/IEC 27018 Public Cloud PII Processor Privacy Controls Guide](https://www.sorena.io/artifacts/global/iso-27018.md): Artifact covers cloud privacy controls, processor responsibilities, implementation guidance, and audit-ready evidence for ISO/IEC 27018. - [ISO/IEC 27035 Information Security Incident Management Guide](https://www.sorena.io/artifacts/global/iso-27035.md): Artifact covers incident response lifecycle design, readiness, and evidence artifacts aligned to ISO/IEC 27035. - [ISO/IEC 27036 Supplier Relationship Security Guide](https://www.sorena.io/artifacts/global/iso-27036.md): Artifact covers third-party security governance, supplier assurance, and evidence artifacts aligned to ISO/IEC 27036. - [ISO/IEC 42001 Artificial Intelligence Management System Guide](https://www.sorena.io/artifacts/global/iso-42001.md): Artifact covers AIMS scope, governance, controls, and evidence artifacts aligned to ISO/IEC 42001 for AI risk management. - [NIST Cybersecurity Framework (CSF) 2.0](https://www.sorena.io/artifacts/global/nist-csf-2-0.md): Artifact covers current/target profiles, governance, metrics, and evidence artifacts for NIST CSF 2.0 adoption. - [NIST SP 800-161 Rev. 1 (C-SCRM)](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1.md): Artifact covers cyber supply chain risk management program design, controls, and evidence artifacts aligned to NIST SP 800-161. - [NIST SP 800-218 SSDF v1.1](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf.md): Artifact covers SSDF practices, SDLC controls, and audit-ready evidence artifacts aligned to NIST SP 800-218. - [NIST SP 800-53 Rev. 5](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5.md): Artifact covers control selection, tailoring, implementation patterns, and evidence artifacts aligned to NIST SP 800-53 Rev. 5. - [NIST SP 800-61 Rev. 3](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3.md): Artifact covers incident response lifecycle design, playbooks, severity models, and evidence artifacts aligned to NIST SP 800-61 Rev. 3. - [EU Accessibility Act Compliance Hub](https://www.sorena.io/artifacts/eu/accessibility-act.md): Artifact entry for the EU Accessibility Act with scope and implementation guidance for covered products and services. - [EU Data Act Hub: Scope, Data Access, Contracts, and Cloud Switching](https://www.sorena.io/artifacts/eu/data-act.md): Artifact entry for the EU Data Act with connected-product access, sharing obligations, and operational implementation sections. - [EU Deforestation Regulation (EUDR) Scope, Due Diligence and Timeline](https://www.sorena.io/artifacts/eu/deforestation-regulation.md): An EUDR due diligence artifact with key dates and an implementation guide to help operators and traders implement deforestation free supply chain compliance. - [EU Digital Markets Act (DMA): Gatekeepers, CPS, Obligations, and Enforcement](https://www.sorena.io/artifacts/eu/digital-markets-act.md): A DMA artifact with key dates and an implementation guide to help teams understand gatekeeper designation and core obligations. - [EU DORA Hub: Scope, ICT Risk, Incidents, TLPT, and ICT Third Parties](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act.md): Artifact entry for DORA covering ICT risk, incident reporting, TLPT testing, and third-party requirements. - [EU NIS2 Directive (EU) 2022/2555](https://www.sorena.io/artifacts/eu/nis2-directive.md): Artifact entry for EU NIS2 applicability, implementation planning, and incident readiness workstreams. - [EU CSRD Scope, ESRS Reporting, and Assurance Guide](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive.md): A CSRD and ESRS artifact with key dates and an implementation guide to confirm reporting scope and plan sustainability reporting obligations. - [EU Medical Device Regulation (MDR) 2017/745 Compliance Hub](https://www.sorena.io/artifacts/eu/medical-device-regulation.md): A medical device compliance artifact with key dates and an implementation guide to help teams classify devices and plan conformity assessment steps. - [UK PSTI Act Compliance Hub: Scope, Security Requirements, Statements, and OPSS Readiness](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act.md): A PSTI artifact with key dates and an implementation guide to help product teams implement baseline security requirements for consumer connectable products. - [CPRA Timeline and Implementation Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act.md): A CPRA artifact with key dates and an implementation guide to help teams understand scope, consumer rights, and business obligations under California privacy law. - [Brazil LGPD Compliance Hub: Scope, Rights, Incident Rule, Transfers, and ANPD Enforcement](https://www.sorena.io/artifacts/latam/brazil-lgpd.md): Artifact entry for LGPD with role-based scope guidance and key implementation obligations. - [EU Batteries Regulation Scope, Duties and Timeline](https://www.sorena.io/artifacts/eu/batteries-regulation.md): A batteries compliance artifact with key dates and an implementation guide covering scope and core obligations across the battery lifecycle. - [EU CSDDD Scope, Timeline, and Due Diligence Guide](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive.md): A corporate due diligence artifact with key dates and an implementation guide to help teams understand scope and build a risk based compliance program. - [EU Digital Services Act (DSA): Scope, Platform Duties, VLOPs, and Enforcement](https://www.sorena.io/artifacts/eu/digital-services-act.md): A DSA artifact with key dates and an implementation guide to help online services understand platform categories and obligations. - [EU eIDAS Hub: Trust Services, Signatures, QTSPs, Wallets](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation.md): An eIDAS compliance artifact with key dates and an implementation guide to help teams understand trust services and electronic identification obligations. - [EU EMC Directive Compliance Hub](https://www.sorena.io/artifacts/eu/emc-directive.md): An EMC compliance artifact with key dates and an implementation guide to help manufacturers and importers meet electromagnetic compatibility requirements. - [EU Energy Efficiency Directive (EED) Hub](https://www.sorena.io/artifacts/eu/energy-efficiency-directive.md): An energy efficiency compliance artifact with key dates and an implementation guide to help organizations understand scope and implementation duties. - [EU ePrivacy Directive Hub: Cookies, Communications Confidentiality, Marketing, and GDPR Interplay](https://www.sorena.io/artifacts/eu/eprivacy-directive.md): An ePrivacy artifact with key dates and an implementation guide to help teams handle cookies, tracking, and electronic communications confidentiality. - [EU GDPR Hub: Scope, Lawful Bases, Rights, DPIA, Transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation.md): Artifact entry for GDPR with scope, applicability, and operational compliance obligations. - [EU GPSR Scope, Product Safety Duties and Safety Gate](https://www.sorena.io/artifacts/eu/general-product-safety-regulation.md): A product safety artifact with key dates and an implementation guide to help teams understand scope and core obligations under the GPSR. - [EU Green Claims Directive Proposal Hub](https://www.sorena.io/artifacts/eu/green-claims-directive.md): A green claims artifact with key dates and an implementation guide to help teams understand substantiation and verification requirements for environmental claims. - [EU Low Voltage Directive (LVD) 2014/35/EU Compliance Hub](https://www.sorena.io/artifacts/eu/low-voltage-directive.md): A low voltage directive artifact with key dates and an implementation guide to help teams understand scope and core safety obligations. - [EU Machinery Regulation (EU) 2023/1230 Compliance Hub](https://www.sorena.io/artifacts/eu/machinery-regulation.md): A machinery compliance artifact with key dates and an implementation guide to help teams determine scope, category, and conformity assessment path. - [EU Market Surveillance Regulation Hub](https://www.sorena.io/artifacts/eu/market-surveillance-regulation.md): A market surveillance regulation artifact with key dates and an implementation guide to help economic operators understand responsibilities and enforcement touchpoints. - [EU PPWR Hub: Packaging Scope, Recyclability, Labels and Timeline](https://www.sorena.io/artifacts/eu/packaging-waste-regulation.md): A packaging and packaging waste regulation artifact with key dates and an implementation guide to help teams understand scope and compliance obligations. - [EU Radio Equipment Directive (RED) Hub: Scope, CE Marking, Cybersecurity and Timeline](https://www.sorena.io/artifacts/eu/radio-equipment-directive.md): A radio equipment directive artifact with key dates and an implementation guide to help teams understand scope and core compliance obligations. - [EU RoHS Directive Hub: Scope, Restricted Substances, Exemptions and EN IEC 63000 Evidence](https://www.sorena.io/artifacts/eu/rohs-directive.md): A RoHS compliance artifact with key dates and an implementation guide to help teams handle restricted substances, exemptions, and technical documentation. - [EU Taxonomy Regulation (EU) 2020/852: Timeline, Eligibility, Alignment and Article 8](https://www.sorena.io/artifacts/eu/taxonomy-regulation.md): An EU Taxonomy artifact with key dates and an implementation guide to help teams assess eligibility and alignment for sustainable activities reporting. - [Singapore PDPA Compliance Hub](https://www.sorena.io/artifacts/apac/singapore-pdpa.md): A PDPA artifact with key dates and an implementation guide to help teams understand scope, roles, and core personal data protection obligations. - [UK GDPR Timeline and Implementation Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation.md): Artifact entry for UK GDPR with role-oriented scope and implementation support for key obligations. - [UK Online Safety Act Compliance Hub: Scope, Illegal Harms, Child Safety, and Ofcom Readiness](https://www.sorena.io/artifacts/uk/online-safety-act.md): An Online Safety Act artifact with key dates and an implementation guide to help teams understand service scope, risk assessments, and duties of care. - [CCPA Timeline and Implementation Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act.md): A CCPA artifact with key dates and an implementation guide to help teams understand scope, consumer rights, and business obligations. - [China Cryptography Law and Commercial Cryptography Compliance Guide](https://www.sorena.io/artifacts/apac/china-cryptography-law.md): Classify commercial cryptography use, screen product and service routes, and prepare testing, certification, import/export, supplier, and China release evidence. - [China Cybersecurity, Data Security, and Network Review Compliance Guide](https://www.sorena.io/artifacts/apac/china-cybersecurity-law.md): Map network operator, CII, data security, cybersecurity review, app governance, MIIT filing, MLPS, and connected-device security evidence. - [China WEEE and E-Waste Recovery Compliance Guide](https://www.sorena.io/artifacts/apac/china-e-waste-law.md): Route waste electrical and electronic products through recovery, qualified disposal, recycler/disposal-operator licensing, contracts, and lifecycle records. - [China Personal Information Protection and Data Export Compliance Guide](https://www.sorena.io/artifacts/apac/china-privacy-law.md): Map PIPL processing duties, app minimization, separate consent, PIPIA, SCC filings, data export security assessment, and cross-border transfer evidence. - [China RoHS Hazardous Substances Compliance Guide](https://www.sorena.io/artifacts/apac/china-rohs-regulation.md): Decide covered electrical/electronic product status, collect hazardous-substance and supplier evidence, and prepare China RoHS marking, disclosure, and catalogue records. - [China Telecom Network Access and Wireless Equipment Compliance Guide](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation.md): Separate network access permits, radio and micro-power requirements, 2400/5100/5800 MHz rules, mobile terminal app duties, and connected-device launch evidence. - [Australia Cyber Security Act Applicability Test](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario. - [Australia Cyber Security Act vs EU Cyber Resilience Act](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Australia Cyber Security Act vs UK PSTI Act Guide](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [Australia Cyber Security Act Compliance Checklist](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks. - [Australia Cyber Security Act Compliance Guide](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/compliance.md): A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness. - [Cyber Security Act vs EU CRA: scope and obligations comparison](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Cyber Security Act vs UK PSTI Act: device security obligations compared](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [Australia Cyber Security Act Deadlines and Compliance Calendar](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Calendar of official source Australia Cyber Security Act milestones for ransomware reporting, smart-device security standards, statements of compliance, and statutory review. - [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Direct FAQ answer on Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including scope, statement records, exceptions, and citations. - [How do notices and recalls work under the Australia Cyber Security Act?](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing. - [CSA 2024 Ransomware Threshold & Report FAQ](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence. - [Australia Cyber Security Act recordkeeping FAQ](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks. - [How does the Australia Cyber Security Act overlap with the SOCI Act?](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties. - [Which smart devices are in scope under Australia's Cyber Security Act 2024?](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep. - [Cyber Security Act 2024 Statements of Compliance FAQ](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): FAQ answer on Australian Cyber Security Act 2024 statements of compliance for smart devices, including scope, actors, required contents, retention, evidence, and citations. - [Australia Cyber Security Act FAQ](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. - [Australia Cyber Security Act penalties and fines](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Official source guide to Australia Cyber Security Act civil penalties, smart-device enforcement notices, ransomware reporting exposure, Board notice failures, and evidence records. - [Australia ransomware payment reporting 72-hour duty](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md): Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain. - [CSA 2024 Ransomware Payment Reporting Workflow](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources. - [Australia Cyber Security Act Requirements](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records. - [Australia Cyber Security Act 2024 scope and definitions](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Official source scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap. - [Australia Cyber Security Act and SOCI Act overlap](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records. - [CSA 2024 Smart Device Applicability Test](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules. - [Smart Device Applicability: CSA 2024](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): A cited workflow for deciding whether a connected product is covered by Australia's Cyber Security Act 2024 smart-device standard and what evidence to keep. - [Cyber Security Act 2024 Smart Device Compliance Checklist](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md): Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence. - [Australia Smart Device Security Standards under the Cyber Security Act](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-security-standards.md): Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records. - [SOCI overlap triage workflow for Australia Cyber Security Act](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks. - [CSA 2024 Smart Device Statement of Compliance](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping.md): What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination. - [Australia Smart Device Statement of Compliance Evidence Workflow](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules. - [Australia Cyber Security Act Statement of Compliance Evidence](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness. - [Australia Cyber Security Act templates](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/templates.md): Official source template fields for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records. - [Australia Cyber Security Act Timeline and Commencement Guide](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Australia Cyber Security Act guidance for Timeline and Commencement, with practical decisions, evidence, edge cases, and external source citations. - [China commercial cryptography compliance checklist](https://www.sorena.io/artifacts/apac/china-cryptography-law/checklist.md): Checklist for classifying cryptography use, supplier evidence, testing/certification status, and commercial cryptography release decisions. - [China Cryptography Law vs Cybersecurity Law](https://www.sorena.io/artifacts/apac/china-cryptography-law/china-cryptography-law-vs-cybersecurity-law.md): Comparison of cryptography-specific duties with broader China cybersecurity duties for product and security teams. - [Commercial cryptography procurement checklist](https://www.sorena.io/artifacts/apac/china-cryptography-law/commercial-cryptography-procurement-checklist.md): Procurement checklist for vendors and products that rely on commercial cryptography in China-market systems. - [Commercial cryptography products and testing evidence](https://www.sorena.io/artifacts/apac/china-cryptography-law/commercial-cryptography-products-and-testing.md): How to prepare evidence for commercial cryptography products, services, and testing institution dependencies under China sources. - [Commercial cryptography testing evidence template](https://www.sorena.io/artifacts/apac/china-cryptography-law/commercial-cryptography-testing-evidence-template.md): Evidence template for commercial cryptography testing and certification status, qualified body dependence, and supplier review. - [China Cryptography Law deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-cryptography-law/deadlines-and-compliance-calendar.md): Official dates for the Cryptography Law and commercial cryptography regulation implementation. - [Do imported cryptography products need special review?](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/do-imported-cryptography-products-need-special-review.md): Do not assume every imported encrypted product has the same route. The Cryptography Law contains import/export and security assessment concepts, so the release record should identify product category, commercial cryptography status, and whether an official list or assessment source is needed. - [Does using encryption trigger China Cryptography Law duties?](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/does-using-encryption-trigger-china-cryptography-law.md): Using encryption is the starting point, not the final answer. The source distinguishes commercial cryptography and other cryptography categories, so the evidence record should identify the cryptographic function, product or service route, commercial cryptography status, and whether testing, certification, import/export, or security assessment questions arise. - [How does cryptography compliance overlap with China cybersecurity law?](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/how-does-cryptography-compliance-overlap-with-cybersecurity-law.md): Cryptography compliance addresses cryptographic technologies, products, services, testing and import/export questions; cybersecurity compliance addresses network operator, data security, app governance and review duties. A connected product can need both evidence sets. - [What is commercial cryptography in China?](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/what-is-commercial-cryptography-in-china.md): Commercial cryptography protects information that does not involve state secrets. The compliance task is to classify the product or service, record whether it is commercial cryptography, and keep supplier/testing evidence for the China-market decision. - [When is commercial cryptography testing or certification needed?](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/when-is-commercial-cryptography-testing-or-certification-needed.md): Testing or certification analysis is needed when a commercial cryptography product, service, or testing result is part of the China compliance route. The testing institution source says proof-bearing commercial cryptography testing activity depends on qualified testing institutions. - [China Cryptography Law FAQ](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq.md): Answers to practical China Cryptography Law questions for scope, official source triggers, evidence records, and related China scope decisions. - [Commercial cryptography import, export, and security assessment triage](https://www.sorena.io/artifacts/apac/china-cryptography-law/import-export-and-security-assessment.md): How product and procurement teams should record import/export and security assessment questions without overclaiming applicability. - [China Cryptography Law penalties and liability](https://www.sorena.io/artifacts/apac/china-cryptography-law/penalties-and-fines.md): Operational view of China cryptography liability provisions and what evidence reduces avoidable release and supplier risk. - [China Cryptography Law requirements](https://www.sorena.io/artifacts/apac/china-cryptography-law/requirements.md): China cryptography requirements for commercial cryptography products, services, testing, import/export screening, and release evidence. - [China cybersecurity compliance checklist](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/checklist.md): Checklist for network operators, app providers, connected-device teams, review screening, app filing, MLPS evidence, and smart-home security related review. - [China Cybersecurity Law vs EU Cyber Resilience Act](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/china-cybersecurity-law-vs-eu-cyber-resilience-act.md): Comparison showing China operator/security duties versus EU product cybersecurity duties under the CRA. - [China Cybersecurity Law vs EU NIS2](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/china-cybersecurity-law-vs-nis2.md): Comparison of China network/data security duties with EU NIS2 entity cybersecurity duties. - [MLPS classified protection baseline evidence](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/classified-protection-baseline.md): How to use the classified protection baseline standard as evidence mapping without treating the standard itself as a standalone law. - [CII and network operator role triage](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/critical-information-infrastructure-and-network-operators.md): How to separate ordinary network operator duties from CII, procurement, and review-risk questions under China cybersecurity sources. - [Cybersecurity review vs data export security assessment](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/cybersecurity-review-vs-data-export-security-assessment.md): Crosswalk for review triggers and data export assessment triggers so teams do not mix procurement/platform review with outbound data transfer review. - [China cybersecurity review workflow](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/cybersecurity-review-workflow.md): Intake workflow for procurement, platform, CII, and national-security risk review triggers. - [China cybersecurity deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/deadlines-and-compliance-calendar.md): Official cybersecurity, data security, review, app governance, filing, and standards dates. - [Does an app need MIIT filing and CAC app governance review?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/does-an-app-need-miit-filing-and-cac-app-governance-review.md): Treat app filing and app information service governance as related but separate checks. MIIT filing evidence should not replace CAC app-provider governance, privacy minimization, or cybersecurity duties. - [How do smart home security standards fit with China cybersecurity law?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/how-do-smart-home-security-standards-fit-with-china-cybersecurity-law.md): The smart home security standard can support connected appliance security evidence, but it does not replace app privacy, network access, radio, or cybersecurity review analysis. Use it as one control map tied to the cited standard. - [How does important data change China cybersecurity obligations?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/how-does-important-data-change-cybersecurity-obligations.md): Important data changes the risk analysis because the Data Security Law establishes data classification and graded protection. The practical record is an important-data screening note, plus export or security-assessment routing where applicable. - [Is every company a network operator under China Cybersecurity Law?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/is-every-company-a-network-operator-under-china-cybersecurity-law.md): Do not start with a generic company label. Start with the network, system, app, platform, data processing, and China operation facts, then map them to network operator, app provider, data processor, CII, or review triggers in the cited sources. - [What is MLPS classified protection evidence?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/what-is-mlps-classified-protection-evidence.md): MLPS evidence is a control and classification evidence set, not a standalone substitute for the Cybersecurity Law. Keep system scope, classification rationale, baseline requirement mapping, remediation, and review records. - [When does China cybersecurity review apply?](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/when-does-china-cybersecurity-review-apply.md): Cybersecurity review analysis is needed when procurement, platform operation, CII, or national security risk facts match the Cybersecurity Review Measures. Keep an intake note with product/service, buyer/operator role, data/system impact, and official source trigger. - [China Cybersecurity Law FAQ](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq.md): Answers to practical China Cybersecurity Law questions for scope, official source triggers, evidence records, and related China scope decisions. - [MLPS classified protection evidence map](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/mlps-classified-protection-evidence-map.md): Evidence map for classified protection baseline controls, source status, owners, and security records. - [China mobile app filing and app governance](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/mobile-app-filing-and-app-governance.md): How MIIT app filing and CAC app information service duties affect app providers and distribution workflows. - [Mobile app filing vs app personal information rules](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/mobile-app-filing-vs-app-personal-information-rules.md): Practical overlap guide for MIIT app filing, app information service governance, and app minimum personal-information duties. - [China cybersecurity penalties and enforcement exposure](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/penalties-and-fines.md): China cybersecurity, data security, review, and app-governance enforcement exposure. - [China cybersecurity and data security requirements](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/requirements.md): Network operator, data security, cybersecurity review, app governance, MLPS, and smart-home security requirements under China sources. - [Smart home security standard evidence](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/smart-home-security-standard.md): How connected-device teams can use the smart home security specification and cross-link telecom, privacy, and cybersecurity evidence. - [Smart home security vs telecom and wireless launch](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/smart-home-security-vs-telecom-wireless-launch.md): Cross-link page for smart connected appliance teams separating cybersecurity standard evidence from radio and network access evidence. - [China e-waste compliance checklist](https://www.sorena.io/artifacts/apac/china-e-waste-law/checklist.md): Checklist for covered product scope, qualified disposal partner review, disposal records, and downstream evidence. - [Covered products and e-waste recovery scope](https://www.sorena.io/artifacts/apac/china-e-waste-law/covered-products-and-recovery-scope.md): How to document product family scope for China waste electrical and electronic product recovery and disposal without guessing catalogue coverage. - [China e-waste deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-e-waste-law/deadlines-and-compliance-calendar.md): Official e-waste regulation and disposal qualification permit dates. - [Waste electrical product disposal qualification workflow](https://www.sorena.io/artifacts/apac/china-e-waste-law/disposal-qualification-license-workflow.md): Workflow for checking disposal qualification permit requirements and downstream treatment evidence. - [E-waste disposal operator qualification checklist](https://www.sorena.io/artifacts/apac/china-e-waste-law/e-waste-disposal-operator-qualification-checklist.md): Checklist for verifying a downstream disposal operator qualification permit and supervision evidence. - [E-waste recycler contract and records template](https://www.sorena.io/artifacts/apac/china-e-waste-law/e-waste-recycler-contract-and-records-template.md): Template fields for recycler qualification, product category, disposal records, audit rights, and downstream evidence. - [How is China e-waste different from China RoHS?](https://www.sorena.io/artifacts/apac/china-e-waste-law/faq/how-is-china-e-waste-different-from-china-rohs.md): China e-waste rules address recovery and disposal at end of life; China RoHS addresses hazardous substance restriction, marking and disclosure for electrical and electronic products. A hardware product may need both documented files. - [What records should a producer keep for e-waste recovery and disposal?](https://www.sorena.io/artifacts/apac/china-e-waste-law/faq/what-records-should-a-producer-keep-for-e-waste-recovery-and-disposal.md): Keep product scope, recovery route, downstream recycler/disposal operator, qualification permit evidence, disposal records, and contract/audit rights. Do not rely only on an invoice if the source requires qualified disposal activity. - [When does a disposal operator need a waste electrical product qualification permit?](https://www.sorena.io/artifacts/apac/china-e-waste-law/faq/when-does-a-disposal-operator-need-a-waste-electrical-product-qualification-permit.md): A disposal operator needs permit analysis when it is engaged in waste electrical and electronic product disposal activities covered by the licensing measures. Product companies should keep the downstream operator qualification evidence before relying on the disposal route. - [China E-Waste Law FAQ](https://www.sorena.io/artifacts/apac/china-e-waste-law/faq.md): Answers to practical China E-Waste Law questions for scope, official source triggers, evidence records, and related China scope decisions. - [China e-waste penalties and enforcement exposure](https://www.sorena.io/artifacts/apac/china-e-waste-law/penalties-and-fines.md): E-waste penalty and supervision guide for producers, recyclers, and disposal operators. - [Producer and disposal operator duties](https://www.sorena.io/artifacts/apac/china-e-waste-law/producer-and-disposal-operator-duties.md): How producers, sellers, recyclers, and disposal operators should separate e-waste responsibilities and records. - [China e-waste recovery and disposal requirements](https://www.sorena.io/artifacts/apac/china-e-waste-law/requirements.md): China WEEE and e-waste requirements for product lifecycle roles, qualified disposal, downstream evidence, and records. - [App minimum necessary personal information by category](https://www.sorena.io/artifacts/apac/china-privacy-law/app-minimum-necessary-personal-information-by-category.md): App category mapping page for common mobile app necessary personal information scope, using only categories supported by the official source. - [China app personal information minimization](https://www.sorena.io/artifacts/apac/china-privacy-law/app-personal-information-minimization.md): How to map app category, basic functions, and necessary personal information under China mobile app personal-information rules. - [PIPL automated decision-making and personalized recommendations](https://www.sorena.io/artifacts/apac/china-privacy-law/automated-decision-making-and-personalized-recommendations.md): Practical checks for automated decision-making transparency, fairness, choice, and evidence under PIPL. - [PIPL breach response and notification](https://www.sorena.io/artifacts/apac/china-privacy-law/breach-response-and-notification.md): How to document breach response, mitigation, notification analysis, and evidence under China personal information rules. - [China PIPL compliance checklist](https://www.sorena.io/artifacts/apac/china-privacy-law/checklist.md): Checklist for PIPL processing activity maps, notices, consent, separate consent, sensitive PI, entrusted processing, export route, and app minimization evidence. - [China PIPL vs CCPA/CPRA](https://www.sorena.io/artifacts/apac/china-privacy-law/china-pipl-vs-ccpa-cpra.md): Comparison of China PIPL and California CCPA/CPRA for global privacy teams. - [China PIPL vs EU GDPR](https://www.sorena.io/artifacts/apac/china-privacy-law/china-privacy-law-vs-gdpr.md): Comparison of China PIPL and EU GDPR for privacy teams handling global data processing and transfer programs. - [China PIPL vs Singapore PDPA](https://www.sorena.io/artifacts/apac/china-privacy-law/china-privacy-law-vs-singapore-pdpa.md): Comparison of China PIPL and Singapore PDPA for APAC privacy programs. - [China personal information cross-border transfer routes](https://www.sorena.io/artifacts/apac/china-privacy-law/cross-border-transfer-routes.md): How to route China personal information exports across security assessment, standard contract, and newer cross-border data flow provisions. - [China data export security assessment workflow](https://www.sorena.io/artifacts/apac/china-privacy-law/data-export-security-assessment-workflow.md): Workflow for screening data export security assessment triggers, materials, owners, and evidence records. - [China PIPL deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-privacy-law/deadlines-and-compliance-calendar.md): Official privacy, app minimization, SCC, data export assessment, and cross-border data flow dates. - [PIPL entrusted processing and vendor contracts](https://www.sorena.io/artifacts/apac/china-privacy-law/entrusted-processing-and-vendor-contracts.md): How to document entrusted processing, vendor responsibilities, contract controls, and evidence under PIPL. - [How should vendor contracts handle entrusted processing under PIPL?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/how-should-vendor-contracts-handle-entrusted-processing.md): Vendor contracts should show entrusted-processing scope, processing purpose, data categories, security duties, assistance with rights/incidents, onward transfer limits, deletion/return, audit evidence, and source references. - [Is PIPL the same as GDPR?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/is-pipl-the-same-as-gdpr.md): No. PIPL and GDPR can support a shared privacy program, but they use different legal concepts, transfer routes, regulatory sources, and evidence requirements. Compare article-by-article before reusing notices, consent flows, or transfer assessments. - [What counts as sensitive personal information in China?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/what-counts-as-sensitive-personal-information-in-china.md): Sensitive personal information should be identified from the PIPL source and recorded with purpose, necessity, separate consent analysis, safeguards, retention, and access limits before processing. - [What is separate consent under PIPL?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/what-is-separate-consent-under-pipl.md): Separate consent is a PIPL-specific consent requirement for certain higher-risk processing situations. The evidence file should identify the trigger, user-facing text, affirmative action, withdrawal path, and source article. - [What records should we keep for a PIPL impact assessment?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/what-records-should-we-keep-for-a-pipl-impact-assessment.md): Keep purpose, processing basis, personal information categories, sensitive PI/minors, entrusted processors, export route, risks, safeguards, retention, rights handling, incident plan, reviewer, and source references. - [What should an app collect as necessary personal information in China?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/what-should-an-app-collect-as-necessary-personal-information.md): Use the app necessary personal information source by app category. If a data field is not necessary for the basic function, keep a product decision explaining why collection is optional or remove it from the basic flow. - [When can a company use the China standard contract route?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/when-can-a-company-use-the-china-standard-contract-route.md): The standard contract route is a specific personal-information export route with filing and impact-assessment evidence. It should be selected only after screening whether a security assessment or newer cross-border data flow rule changes the route. - [When does a China PIPL security assessment apply?](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/when-does-a-china-pipl-security-assessment-apply.md): A security assessment check is needed before certain outbound data or personal information transfers. The record should screen PIPL export duties, the Data Export Security Assessment Measures, and newer cross-border data flow provisions before choosing a route. - [China Privacy Law FAQ](https://www.sorena.io/artifacts/apac/china-privacy-law/faq.md): Answers to practical China Privacy Law questions for scope, official source triggers, evidence records, and related China scope decisions. - [China PIPL penalties and enforcement exposure](https://www.sorena.io/artifacts/apac/china-privacy-law/penalties-and-fines.md): China privacy penalties and operational exposure under PIPL and data export rules. - [PIPL impact assessment template](https://www.sorena.io/artifacts/apac/china-privacy-law/personal-information-protection-impact-assessment-template.md): Template fields for a China personal information protection impact assessment and export/entrusted-processing evidence. - [PIPL cross-border transfer route selector](https://www.sorena.io/artifacts/apac/china-privacy-law/pipl-cross-border-transfer-route-selector.md): Route selector for China personal information exports across security assessment, standard contract, and lower-risk/exemption analysis. - [China PIPL privacy notice and consent checklist](https://www.sorena.io/artifacts/apac/china-privacy-law/privacy-policy-and-consent-checklist.md): Practical notice, consent, separate consent, sensitive PI, and rights-handling checklist under PIPL. - [China PIPL requirements](https://www.sorena.io/artifacts/apac/china-privacy-law/requirements.md): China Personal Information Protection Law requirements by processing lifecycle, including consent, sensitive PI, rights, exports, breach response, and evidence. - [Sensitive personal information and separate consent under PIPL](https://www.sorena.io/artifacts/apac/china-privacy-law/sensitive-personal-information-and-separate-consent.md): How to identify sensitive PI triggers, separate consent, minors, additional safeguards, and evidence records. - [China personal information standard contract filing workflow](https://www.sorena.io/artifacts/apac/china-privacy-law/standard-contract-filing-workflow.md): Workflow for the PIPL standard contract route, assessment, filing package, and cited evidence. - [China RoHS compliance checklist](https://www.sorena.io/artifacts/apac/china-rohs-regulation/checklist.md): Checklist for covered EEP status, BOM evidence, supplier declarations, marking/disclosure review, and catalogue monitoring. - [China RoHS supplier declaration template](https://www.sorena.io/artifacts/apac/china-rohs-regulation/china-rohs-supplier-declaration-template.md): Template fields for collecting supplier substance declarations and change-control evidence for China RoHS. - [China RoHS vs China e-waste rules](https://www.sorena.io/artifacts/apac/china-rohs-regulation/china-rohs-vs-china-e-waste.md): Crosswalk explaining hazardous substance control before and during sale versus end-of-life recovery and disposal duties. - [China RoHS vs EU RoHS](https://www.sorena.io/artifacts/apac/china-rohs-regulation/china-rohs-vs-eu-rohs.md): Comparison of China RoHS and EU RoHS for electrical and electronic product compliance teams. - [Covered electrical and electronic products under China RoHS](https://www.sorena.io/artifacts/apac/china-rohs-regulation/covered-electrical-electronic-products.md): How to document whether a product is a covered electrical or electronic product under China RoHS without guessing unsourced exclusions. - [China RoHS deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-rohs-regulation/deadlines-and-compliance-calendar.md): Official China RoHS promulgation and effective dates. - [Does China RoHS cover my electrical or electronic product?](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/does-china-rohs-cover-my-electrical-electronic-product.md): Start with the China RoHS source definition and product facts. Keep a covered-EEP note before collecting supplier material declarations or preparing marking/disclosure evidence. - [How is China RoHS different from China e-waste rules?](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/how-is-china-rohs-different-from-china-e-waste-rules.md): China RoHS addresses hazardous substances, marking and disclosure before or during market placement; China e-waste rules address recovery and disposal at end of life. - [Is China RoHS the same as EU RoHS?](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/is-china-rohs-the-same-as-eu-rohs.md): No. China RoHS and EU RoHS both address hazardous substances in electrical/electronic products, but source instruments, marking/disclosure context, release evidence, and conformity routes differ. - [What is China RoHS marking and disclosure evidence?](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/what-is-china-rohs-marking-and-disclosure-evidence.md): It is the documented product file showing covered EEP status, hazardous substance information, marking/disclosure review, supplier support, and approval for China release. - [What supplier evidence should we keep for China RoHS?](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/what-supplier-evidence-should-we-keep-for-china-rohs.md): Keep BOM, supplier substance declarations, material risk notes, product change logs, marking/disclosure review, and source references. Do not invent threshold values unless an official source is present. - [China RoHS FAQ](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq.md): Answers to practical China RoHS questions for scope, official source triggers, evidence records, and related China scope decisions. - [China RoHS marking and disclosure evidence](https://www.sorena.io/artifacts/apac/china-rohs-regulation/marking-and-disclosure-evidence.md): How to prepare marking, disclosure, environmental protection use period, and cited evidence without inventing thresholds. - [China RoHS penalties and enforcement exposure](https://www.sorena.io/artifacts/apac/china-rohs-regulation/penalties-and-fines.md): China RoHS legal responsibility and enforcement exposure for product and supplier evidence owners. - [China RoHS requirements](https://www.sorena.io/artifacts/apac/china-rohs-regulation/requirements.md): China RoHS requirements for covered electrical and electronic products, hazardous substance control, marking, disclosure, and supplier evidence. - [China RoHS supplier material declaration checklist](https://www.sorena.io/artifacts/apac/china-rohs-regulation/supplier-material-declaration-checklist.md): Supplier declaration and BOM evidence checklist for China RoHS release decisions. - [China telecom and wireless launch checklist](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/checklist.md): Checklist for network access permits, radio band rules, micro-power equipment, preinstalled apps, and related China scope decisions. - [China network access vs radio management](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/china-network-access-vs-radio-approval.md): Crosswalk separating telecom network access licensing from radio transmitting equipment management for connected products. - [Connected device China launch workflow](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/connected-device-china-launch-workflow.md): Workflow combining network access, radio, app preinstall, privacy, cybersecurity, RoHS, e-waste, and cryptography related review. - [China telecom and wireless deadlines and compliance calendar](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/deadlines-and-compliance-calendar.md): Official dates for mobile terminal software, micro-power equipment, and 2400/5100/5800MHz rules. - [Do preinstalled mobile apps have special China requirements?](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/do-preinstalled-mobile-apps-have-special-china-requirements.md): Mobile smart terminal app preinstallation and distribution has its own documented duties. Keep the preinstalled app list, user-facing controls, update/removal process, and privacy/cybersecurity related review. - [Does my connected device need a China network access permit?](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/does-my-connected-device-need-china-network-access-permit.md): Start with the telecom equipment network access service guide and product function. The evidence file should identify equipment type, applicant, required materials, certificate route, and whether radio management is a separate check. - [Is radio management separate from network access in China?](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/is-radio-management-separate-from-network-access-in-china.md): Yes, treat them as separate evidence tracks unless a source says otherwise. Network access concerns telecom equipment entry; radio management concerns radio transmitting equipment, frequency bands, model approval or micro-power rules. - [What changed for 2400MHz, 5100MHz and 5800MHz equipment?](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/what-changed-for-2400-5100-5800-mhz-equipment.md): The 2023 notice and interpretation set updated technical and transition requirements for relevant radio transmitting equipment using those bands, including the 15 October 2023 start date. - [What evidence is needed for a network access permit?](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/what-evidence-is-needed-for-a-network-access-permit.md): Use the service guide to build the applicant file: product identity, technical materials, required forms, test/certificate support, process owner, and certificate query record. - [China Telecom and Wireless FAQ](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq.md): Answers to practical China Telecom and Wireless questions for scope, official source triggers, evidence records, and related China scope decisions. - [Micro-power short-range radio equipment rules](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/micro-power-short-range-radio-equipment.md): How to use the micro-power short-range radio equipment catalogue and technical requirements in China launch triage. - [Mobile terminal preinstalled app requirements](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/mobile-terminal-preinstalled-apps.md): China mobile smart terminal preinstallation and distribution duties for device makers and app distribution workflows. - [Network access permit application evidence template](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/network-access-permit-application-evidence-template.md): Evidence template for telecom equipment network access permit applications and certificate records. - [China telecom and wireless penalties and enforcement exposure](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/penalties-and-fines.md): Enforcement exposure for network access, radio, and mobile terminal software duties. - [Preinstalled app user rights and removal checks](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/preinstalled-app-user-rights-and-removal.md): Practical checks for mobile terminal preinstalled app distribution, user-facing controls, and cited evidence. - [2400MHz, 5100MHz and 5800MHz radio equipment rules](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/radio-equipment-2400-5100-5800-mhz.md): Band-specific China radio management requirements, implementation timing, and equipment evidence for products using these bands. - [China telecom and wireless equipment requirements](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/requirements.md): China network access, radio management, micro-power equipment, and mobile terminal app requirements for connected-device launch teams. - [Telecom equipment network access license workflow](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/telecom-equipment-network-access-license.md): Workflow for telecom equipment network access licensing materials, review process, permit evidence, and certificate checks. - [Singapore PDPA Anonymisation and DPIA Records](https://www.sorena.io/artifacts/apac/singapore-pdpa/anonymisation-and-dpias.md): Build Singapore PDPA anonymisation and DPIA records around PDPC guidance: release model, re-identification risk, data flows, action plans, safeguards, and monitoring. - [Singapore PDPA Applicability Test](https://www.sorena.io/artifacts/apac/singapore-pdpa/applicability-test.md): Test whether Singapore PDPA obligations apply by checking personal data, organisation role, data intermediary status, public agency and individual boundaries, and business contact information. - [Singapore PDPA Breach Notification Playbook](https://www.sorena.io/artifacts/apac/singapore-pdpa/breach-notification-playbook.md): An official source Singapore PDPA breach-notification playbook covering assessment, notifiable-breach thresholds, PDPC and affected-individual notification steps, roles, records, and citations. - [Singapore PDPA Data Breach Notification Thresholds](https://www.sorena.io/artifacts/apac/singapore-pdpa/breach-notification-thresholds.md): Official source Singapore PDPA breach notification thresholds covering significant harm, the 500-individual significant-scale test, assessment records, and notification timing. - [Singapore PDPA Breach Notification Workflow](https://www.sorena.io/artifacts/apac/singapore-pdpa/breach-notification-workflow.md): An official source Singapore PDPA workflow for containing a personal data breach, assessing notifiability, notifying PDPC or affected individuals, and retaining evidence. - [Singapore PDPA Compliance Checklist](https://www.sorena.io/artifacts/apac/singapore-pdpa/checklist.md): An official source Singapore PDPA checklist for scope, DPO accountability, consent, data intermediaries, breach notification, DNC checks, transfers, and evidence records. - [Singapore PDPA Compliance Guide](https://www.sorena.io/artifacts/apac/singapore-pdpa/compliance.md): Build a Singapore PDPA compliance plan covering DPO accountability, consent and notification, protection, retention, access and correction, transfers, breach notification, and DNC checks. - [Singapore PDPA Consent and Deemed Consent Workflow](https://www.sorena.io/artifacts/apac/singapore-pdpa/consent-and-deemed-consent-selection-workflow.md): Choose express consent, deemed consent by conduct, contractual necessity, notification, or the legitimate interests exception under Singapore PDPA with based ontake fields and evidence records. - [Singapore PDPA Consent, Notification and Purpose Rules](https://www.sorena.io/artifacts/apac/singapore-pdpa/consent-notification-and-purposes.md): How Singapore PDPA consent, notification, purpose limitation, deemed consent, withdrawal, and consent exceptions should be handled in product and privacy workflows. - [Singapore PDPA Cross-Border Transfers](https://www.sorena.io/artifacts/apac/singapore-pdpa/cross-border-transfers.md): Official source Singapore PDPA guidance for overseas personal data transfers, comparable protection, ASEAN MCCs, APEC certifications, vendor roles, and evidence records. - [Singapore PDPA Data Intermediary Responsibilities](https://www.sorena.io/artifacts/apac/singapore-pdpa/data-intermediary-responsibilities.md): Practical Singapore PDPA guide to data intermediary role boundaries, organisation accountability, protection, retention, breach escalation, and contract evidence. - [Singapore PDPA Deadlines and Compliance Calendar](https://www.sorena.io/artifacts/apac/singapore-pdpa/deadlines-and-compliance-calendar.md): An official source Singapore PDPA compliance calendar for breach notification, DNC checks, access and correction requests, retention reviews, and DPMP maintenance. - [Singapore PDPA Deemed Consent and Legitimate Interests](https://www.sorena.io/artifacts/apac/singapore-pdpa/deemed-consent-and-legitimate-interests.md): How to apply Singapore PDPA deemed consent by conduct, contractual necessity, notification, and legitimate interests with opt-out, adverse-effect, disclosure, and assessment records. - [Singapore PDPA DNC and Marketing Messages Guide](https://www.sorena.io/artifacts/apac/singapore-pdpa/dnc-and-marketing-messages.md): An official source Singapore PDPA guide to DNC checks, specified marketing messages, Singapore telephone numbers, consent evidence, opt-outs, sender duties, and excluded messages. - [Singapore PDPA DNC Marketing Checks](https://www.sorena.io/artifacts/apac/singapore-pdpa/dnc-marketing-checks.md): Operational checklist for Singapore PDPA DNC marketing checks: account evidence, register status, 21-day result validity, consent evidence, and campaign owner records. - [Singapore PDPA DNC Marketing Workflow](https://www.sorena.io/artifacts/apac/singapore-pdpa/dnc-marketing-workflow.md): Workflow for Singapore PDPA DNC marketing campaigns: classify specified messages, check Singapore telephone numbers, document consent, suppress opt-outs, and approve sends. - [Singapore PDPA DPMP Accountability Guide](https://www.sorena.io/artifacts/apac/singapore-pdpa/dpmp-accountability.md): Build a Singapore PDPA Data Protection Management Programme with DPO ownership, policies, data inventories, DPIAs, training, monitoring, breach logs, and review records. - [Singapore PDPA anonymisation FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/anonymisation.md): FAQ on anonymisation under the Singapore PDPA: de-identification, pseudonymisation, re-identification risk, when PDPA may no longer apply, and evidence records. - [Singapore PDPA breach notification thresholds FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/breach-thresholds.md): FAQ on Singapore PDPA notifiable data breach tests: significant harm, significant scale, 500 affected individuals, assessment timing, PDPC notices, and affected-individual notices. - [Singapore PDPA Data Intermediaries FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/data-intermediaries.md): FAQ guidance on Singapore PDPA data intermediary roles, direct obligations, organisation accountability, contracts, retention, protection, and breach escalation. - [Singapore PDPA Deemed Consent FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/deemed-consent.md): FAQ on Singapore PDPA deemed consent by conduct, contractual necessity, notification, opt-out periods, adverse-effect assessment, withdrawal, and direct-marketing limits. - [Singapore PDPA DNC checking FAQ: when to check the DNC Registry](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/dnc-checking.md): FAQ guidance on Singapore PDPA DNC checking: when to check the DNC Registry, which registers apply, 8-digit numbers, 21-day result validity, consent evidence, on-behalf checks, opt-outs, and supported exclusions. - [Singapore PDPA DPIAs: when to run and what to document](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/dpias.md): FAQ-style implementation guidance on Singapore PDPA DPIAs, including when PDPC guidance recommends them, data-flow mapping, risk treatment, DPO review, and evidence records. - [Singapore PDPA DPMP Accountability FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/dpmp-accountability.md): FAQ for implementing Singapore PDPA accountability through a DPMP: DPO designation, policies, evidence, training, monitoring, incident logs, and review records. - [Singapore PDPA legitimate interests FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/legitimate-interests.md): FAQ guidance on Singapore PDPA legitimate interests: assessment fields, adverse effects, mitigation, balancing, disclosure, records, and marketing limits. - [Singapore PDPA NRIC Handling FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/nric-handling.md): FAQ guidance on when Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC and other national identification numbers under PDPC guidance. - [Singapore PDPA transfer clauses FAQ](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/transfer-clauses.md): FAQ guidance on Singapore PDPA transfer clauses, comparable protection, ASEAN MCCs, APEC CBPR and PRP certifications, onward transfers, and evidence records. - [Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq.md): FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks. - [Singapore PDPA NRIC Handling Rules](https://www.sorena.io/artifacts/apac/singapore-pdpa/nric-handling.md): When Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC numbers under PDPC guidance. - [Singapore PDPA Penalties and Enforcement Cases](https://www.sorena.io/artifacts/apac/singapore-pdpa/pdpa-penalties-and-enforcement-cases.md): How PDPC enforcement under Singapore's PDPA works: directions, voluntary undertakings, published decisions, financial penalty caps, and implementation lessons from cases. - [Singapore PDPA Privacy Policy Template](https://www.sorena.io/artifacts/apac/singapore-pdpa/pdpa-privacy-policy-template.md): A Singapore PDPA privacy policy template for writing notices, DPO contact details, access and correction routes, retention, transfers, protection, withdrawal, and complaint handling without overclaiming compliance. - [Singapore PDPA Penalties and Fines](https://www.sorena.io/artifacts/apac/singapore-pdpa/penalties-and-fines.md): Singapore PDPA penalty ceilings, PDPC directions, undertakings, breach notification context, and practical controls based on official PDPC and Singapore Statutes sources. - [Singapore PDPA Requirements: Core Obligations](https://www.sorena.io/artifacts/apac/singapore-pdpa/requirements.md): Map Singapore PDPA obligations across consent, notification, access, security, retention, transfers, accountability, breaches, DNC checks, and data intermediaries. - [Singapore PDPA Scope, Exclusions, and Data Intermediaries](https://www.sorena.io/artifacts/apac/singapore-pdpa/scope-exclusions-and-data-intermediaries.md): Classify Singapore PDPA coverage, business contact information, personal or domestic activity, employee acts, and data intermediary obligations with official source implementation records. - [Singapore PDPA vs GDPR Comparison](https://www.sorena.io/artifacts/apac/singapore-pdpa/singapore-pdpa-vs-gdpr.md): Compare Singapore PDPA and GDPR implementation work across consent, DPO accountability, processors, transfers, breach notification, DNC marketing, rights, retention, and penalties. - [Singapore PDPA Transfer Assessment Workflow](https://www.sorena.io/artifacts/apac/singapore-pdpa/transfer-assessment-workflow.md): A Singapore PDPA workflow for assessing overseas personal data transfers, comparable protection, ASEAN MCCs, APEC CBPR/PRP certifications, vendor due diligence, onward transfers, and evidence records. - [Singapore PDPA Transfer Clauses](https://www.sorena.io/artifacts/apac/singapore-pdpa/transfer-clauses.md): Draft Singapore PDPA transfer clauses for overseas vendors, affiliates, data intermediaries, onward transfers, breach support, ASEAN MCCs, and APEC CBPR or PRP evidence. - [Singapore PDPA Vendor Outsourcing and Contracts](https://www.sorena.io/artifacts/apac/singapore-pdpa/vendor-outsourcing-and-contracts.md): Contract and operating checklist for Singapore PDPA vendor outsourcing: data intermediary status, written terms, security, retention, breach, transfers, sub-contracting, and exit evidence. - [EU Accessibility Act for ecommerce websites](https://www.sorena.io/artifacts/eu/accessibility-act/accessibility-act-for-ecommerce-websites.md): Official source guide for ecommerce teams applying the EU Accessibility Act to consumer checkout journeys, service information, accessibility evidence, and exceptions. - [EU Accessibility Act vs ADA and Section 508: EAA-cited-source comparison](https://www.sorena.io/artifacts/eu/accessibility-act/accessibility-act-vs-ada-and-section-508.md): Compare the EU Accessibility Act with ADA and Section 508 planning boundaries, using official source EAA scope, evidence, standards, procurement, and operator-duty points. - [EU Accessibility Act vs Web Accessibility Directive](https://www.sorena.io/artifacts/eu/accessibility-act/accessibility-act-vs-web-accessibility-directive.md): Compare the European Accessibility Act with the Web Accessibility Directive: scope, covered actors, services, standards, evidence, monitoring, enforcement, and key dates. - [EAA Accessibility Conformance Statement Template](https://www.sorena.io/artifacts/eu/accessibility-act/accessibility-conformance-statement-template.md): Template language for an EU Accessibility Act conformance statement covering scope, Annex I mapping, service information, standards, support routes, evidence, and limits. - [EAA scope classifier workflow for products and services](https://www.sorena.io/artifacts/eu/accessibility-act/accessibility-scope-classifier-workflow.md): Classify EU Accessibility Act scope by product or service category, consumer use, market or service date, operator role, exclusions, exemptions, Article 14 records, and evidence. - [EU Accessibility Act Applicability Test](https://www.sorena.io/artifacts/eu/accessibility-act/applicability-test.md): Check whether the European Accessibility Act covers a product or consumer service, which role applies, which date matters, and what evidence to keep. - [EU Accessibility Act checklist for products and services](https://www.sorena.io/artifacts/eu/accessibility-act/checklist.md): Checklist for EAA scope, operator role, Annex I mapping, product technical files, service information, Article 14 assessments, supplier evidence, release checks, and monitoring. - [EU Accessibility Act compliance operating model](https://www.sorena.io/artifacts/eu/accessibility-act/compliance.md): Build an EU Accessibility Act compliance file for covered products and services: scope, operator roles, Annex I mapping, conformity evidence, Article 14 assessments, corrective actions, and records. - [EU Accessibility Act deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/accessibility-act/deadlines-and-compliance-calendar.md): Calendar for the EU Accessibility Act: 2022 transposition, 2025 application, 2027 emergency communications timing, 2030 transition rules, owner actions, and evidence records. - [EU Accessibility Act deadlines and transition plan](https://www.sorena.io/artifacts/eu/accessibility-act/deadlines-and-transition-plan.md): Plan for the European Accessibility Act application date, service-contract transition, self-service terminal transition, 112 derogation, and evidence gates. - [EAA Article 14 disproportionate burden workflow](https://www.sorena.io/artifacts/eu/accessibility-act/disproportionate-burden-assessment-workflow.md): A cited EU Accessibility Act workflow for Article 14 fundamental alteration and disproportionate burden assessments, records, reassessment triggers, and evidence. - [EU Accessibility Act disproportionate burden decision](https://www.sorena.io/artifacts/eu/accessibility-act/disproportionate-burden-decision.md): How to document an EU Accessibility Act Article 14 disproportionate burden decision with supported criteria, retained evidence, limits, notifications, and review triggers. - [EAA e-commerce checkout accessibility guide](https://www.sorena.io/artifacts/eu/accessibility-act/e-commerce-checkout-accessibility.md): Official source EU Accessibility Act guide for accessible e-commerce checkout scope, payment and identification requirements, evidence, standards mapping, and customer information. - [EAA EN 301 549 and WCAG mapping](https://www.sorena.io/artifacts/eu/accessibility-act/en-301-549-and-wcag-mapping.md): Map European Accessibility Act Annex I requirements to EN 301 549 and WCAG evidence without overstating what WCAG tests can prove. - [EAA EN 301 549 clause mapping for ICT evidence](https://www.sorena.io/artifacts/eu/accessibility-act/en-301-549-clause-mapping.md): Map EN 301 549 clauses to EU Accessibility Act evidence, Annex I outcomes, product and service records, and gaps that need non-ICT support. - [EN 301 549 evidence matrix workflow for EAA readiness](https://www.sorena.io/artifacts/eu/accessibility-act/en-301-549-evidence-matrix-workflow.md): Build an EN 301 549 evidence matrix for European Accessibility Act work: scope rows, clause mapping, test evidence, owner sign-off, exception records, and limits of standards evidence. - [EN 301 549 vs WCAG for EAA evidence](https://www.sorena.io/artifacts/eu/accessibility-act/en-301-549-vs-wcag.md): Compare EN 301 549 and WCAG for European Accessibility Act planning: ICT scope, web-content overlap, harmonised-standard limits, and evidence beyond WCAG-only tests. - [EU Accessibility Act exemptions and disproportionate burden](https://www.sorena.io/artifacts/eu/accessibility-act/exemptions-and-disproportionate-burden.md): Article 14 EAA guide covering fundamental alteration, disproportionate burden, service microenterprise exemptions, content exclusions, transition limits, and documentation. - [EU Accessibility Act authority request response FAQ](https://www.sorena.io/artifacts/eu/accessibility-act/faq/authority-response.md): How to answer EU Accessibility Act checks from market surveillance or service authorities with technical documentation, service information, Article 14 records, and corrective actions. - [EU Accessibility Act services: banking, transport, media and e-books](https://www.sorena.io/artifacts/eu/accessibility-act/faq/banking-transport-and-media-services.md): FAQ on which consumer banking, transport, audiovisual media access, electronic communications, e-book, and e-commerce services fall under the EU Accessibility Act. - [EAA conformance statements: products, services, EN 301 549 evidence](https://www.sorena.io/artifacts/eu/accessibility-act/faq/conformance-statements.md): What an EU Accessibility Act conformance statement should include, with product EU declarations, service information, EN 301 549 and WCAG evidence boundaries. - [EAA e-commerce checkout accessibility FAQ](https://www.sorena.io/artifacts/eu/accessibility-act/faq/e-commerce-checkout.md): How to test an e-commerce checkout under the European Accessibility Act, including service scope, payment and identification flows, service information, and evidence. - [EN 301 549 clause mapping for the EU Accessibility Act](https://www.sorena.io/artifacts/eu/accessibility-act/faq/en-301-549-clause-mapping.md): How to map EN 301 549 and WCAG evidence to EU Accessibility Act Annex I requirements without overclaiming presumption of conformity. - [EU Accessibility Act microenterprise exemption and disproportionate burden FAQ](https://www.sorena.io/artifacts/eu/accessibility-act/faq/microenterprise-and-disproportionate-burden-decisions.md): FAQ explaining when EAA microenterprise relief applies, how Article 14 disproportionate-burden assessments work, what Annex VI requires, and what records to keep. - [EU Accessibility Act procurement acceptance criteria](https://www.sorena.io/artifacts/eu/accessibility-act/faq/procurement-acceptance.md): How to write EAA procurement acceptance criteria that ask suppliers for scoped accessibility evidence, standards mappings, declarations, and exception records without overclaiming conformity. - [Which products and services does the EU Accessibility Act cover?](https://www.sorena.io/artifacts/eu/accessibility-act/faq/product-and-service-categories.md): Article 2 and Article 3 scope summary for EU Accessibility Act covered products, services, exclusions, product-service boundaries, and records to keep. - [EU Accessibility Act service transition rules under Article 32](https://www.sorena.io/artifacts/eu/accessibility-act/faq/transition-services.md): FAQ on EU Accessibility Act Article 32 transition rules for service providers, pre-28 June 2025 contracts, 2030 limits, self-service terminals, evidence records, and change triggers. - [WCAG Evidence for the EU Accessibility Act and EN 301 549](https://www.sorena.io/artifacts/eu/accessibility-act/faq/wcag-evidence.md): When WCAG test evidence helps EAA work, how it maps through EN 301 549, and why WCAG alone does not prove European Accessibility Act compliance. - [EU Accessibility Act FAQ: scope, dates, services, Article 14](https://www.sorena.io/artifacts/eu/accessibility-act/faq.md): Clear answers on EU Accessibility Act scope, 28 June 2025 application, covered products and services, microenterprises, Article 14, service information, standards, and penalties. - [EU Accessibility Act penalties and enforcement](https://www.sorena.io/artifacts/eu/accessibility-act/penalties-and-fines.md): How Directive (EU) 2019/882 handles penalties, Member State enforcement, market surveillance for products, and service compliance checks. - [EAA procurement clauses and accessibility acceptance criteria](https://www.sorena.io/artifacts/eu/accessibility-act/procurement-language-and-acceptance-criteria.md): Buyer-side EU Accessibility Act procurement language for covered products and services, with supplier evidence, EN 301 549 limits, Article 14 exception records, and acceptance criteria. - [EU Accessibility Act Product and Service Scope](https://www.sorena.io/artifacts/eu/accessibility-act/product-and-service-category-scoping.md): Scope products and services under the EU Accessibility Act using Article 2 categories, Article 3 definitions, limited content exclusions, microenterprise treatment, and evidence records. - [EU Accessibility Act products and services in scope](https://www.sorena.io/artifacts/eu/accessibility-act/products-and-services-in-scope.md): Article 2 scope guide for the European Accessibility Act: covered products, covered consumer services, economic-operator roles, Article 3 definitions, and evidence records. - [EU Accessibility Act Requirements: Annex I, Products, Services](https://www.sorena.io/artifacts/eu/accessibility-act/requirements.md): Map EU Accessibility Act requirements by Article 4, Annex I, product and service obligations, Article 13 evidence, standards, and Article 14 exceptions. - [EAA testing and conformance evidence](https://www.sorena.io/artifacts/eu/accessibility-act/testing-and-conformance-evidence.md): How to document European Accessibility Act testing evidence: Annex I mappings, product technical files, service information, EN 301 549 boundaries, harmonised-standard limits, and Article 14 exception records. - [EAA WCAG evidence and procurement acceptance](https://www.sorena.io/artifacts/eu/accessibility-act/wcag-evidence-and-procurement-acceptance.md): How to use EN 301 549 and WCAG evidence in EU Accessibility Act procurement acceptance without overstating presumption of conformity. - [EU AI Act Applicability and Roles: Scope, Actor Map, and Evidence](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/applicability-and-roles.md): Determine whether the EU AI Act applies to an AI system or GPAI model, map provider, deployer, importer, distributor, and product manufacturer roles, and record evidence for classification. - [EU AI Act applicability test: scope, role, and risk classification](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/applicability-test.md): Stepwise EU AI Act applicability test for AI-system status, exclusions, territorial scope, operator role, prohibited uses, high-risk systems, GPAI models, transparency duties, and evidence records. - [EU AI Act Compliance Checklist by Risk Class](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/checklist.md): A practical EU AI Act checklist for classifying AI systems, assigning operator roles, screening prohibited practices, and collecting evidence for high-risk, GPAI, transparency, monitoring, and incident duties. - [EU AI Act Compliance Program: roles, high-risk evidence, GPAI and incidents](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/compliance.md): Build an EU AI Act compliance program around provider, deployer, importer, distributor, high-risk, GPAI, transparency, monitoring, and incident evidence duties. - [EU AI Act conformity assessment and notified bodies for high-risk AI](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/conformity-assessment-and-notified-bodies.md): Source-backed guide to EU AI Act high-risk AI conformity assessment routes, provider evidence, EU declaration of conformity, CE marking, and notified body involvement. - [EU AI Act deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/deadlines-and-compliance-calendar.md): EU AI Act compliance calendar for Article 113 staged application dates, Article 111 transitions, GPAI, prohibited practices, AI literacy, and high-risk AI planning. - [EU AI Act vs ISO/IEC 42001: legal duties, controls, and evidence limits](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/eu-ai-act-vs-iso-42001.md): Compare the EU AI Act and ISO/IEC 42001 across legal status, risk classification, high-risk AI, GPAI, transparency, conformity, evidence, and assurance limits. - [EU AI Act vs NIST AI RMF: legal duties, risk controls, and evidence boundaries](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/eu-ai-act-vs-nist-ai-rmf.md): Compare the binding EU AI Act with the voluntary NIST AI RMF, including role classification, high-risk duties, GPAI, transparency, conformity evidence, and reuse limits. - [EU AI Act AI System Classification Edge Cases FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/ai-system-classification-edge-cases.md): Answers for EU AI Act edge cases: AI system definition, inference versus simple rules, GPAI models, embedded products, territorial scope, roles, and classification evidence. - [Are industry AI use cases high-risk under EU AI Act Annex III?](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/annex-iii-industry-use-cases.md): FAQ answer on when an industry AI use case falls under EU AI Act Annex III, how Article 6 classification works, when Article 6(3) can support a non-high-risk conclusion, and what evidence providers should keep. - [EU AI Act Article 50 transparency disclosures FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/article-50-transparency-disclosures.md): Article 50 FAQ for EU AI Act transparency duties covering chatbot notices, synthetic content marking, biometric and emotion notices, deepfakes, public-interest text, timing, accessibility, and exceptions. - [FAQ: EU AI Act conformity assessment procedures and notified body selection](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/conformity-assessment-and-notified-bodies.md): cited FAQ on EU AI Act Article 43 conformity assessment routes, Annex VI internal control, Annex VII notified-body review, CE marking, declarations, and registration. - [EU AI Act FRIA FAQ: Article 27 Scope, Contents, and Notification](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/fria.md): Source-backed FAQ on when Article 27 requires a fundamental rights impact assessment, which deployers are covered, what the FRIA must contain, and how it relates to DPIAs and registration. - [EU AI Act GPAI and Systemic-Risk Duties: Article 53 and 55 FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/gpai-and-systemic-risk-duties.md): FAQ on EU AI Act duties for general-purpose AI model providers, including Article 53 documentation, copyright and training-summary duties, Article 55 systemic-risk duties, serious incidents, cybersecurity, and staged enforcement. - [EU AI Act post-market monitoring FAQ for high-risk AI systems](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/post-market-monitoring.md): Answer to how providers and deployers should handle EU AI Act post-market monitoring for high-risk AI systems under Article 72, with serious-incident, log, corrective-action, and lifecycle-change triggers. - [EU AI Act provider vs deployer role boundaries: Article 3 and Article 25 FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/provider-and-deployer-role-boundaries.md): FAQ on EU AI Act provider, deployer, operator, importer, distributor, authorised representative, product manufacturer, downstream provider, and GPAI model provider boundaries. - [EU AI Act Article 73 serious incident FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/serious-incidents.md): FAQ on EU AI Act serious incident handling for high-risk AI systems, including Article 73 reporting, deployer escalation, corrective action, and GPAI systemic-risk distinctions. - [EU AI Act technical documentation FAQ](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/technical-documentation.md): What Article 11 and Annex IV require in high-risk AI technical documentation: system identity, intended purpose, architecture, data, testing, oversight, cybersecurity, conformity, and post-market monitoring. - [EU AI Act FAQ: scope, roles, high-risk AI, GPAI, FRIA, and dates](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq.md): Source-backed EU AI Act FAQ covering scope, provider and deployer roles, prohibited practices, high-risk classification, GPAI duties, transparency notices, FRIAs, EU database registration, serious incidents, and staged application dates. - [EU AI Act FRIA for high-risk AI systems: Article 27 scope and evidence](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/fria-and-high-risk-impact-assessments.md): Source-backed guide to EU AI Act Article 27 fundamental rights impact assessments: who must run a FRIA, Article 6(2) triggers, Annex III carveouts, DPIA overlap, notification, and registration evidence. - [EU AI Act GPAI Provider Obligations: Articles 53 and 55](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/gpai-and-foundation-model-obligations.md): Source-backed guide to EU AI Act duties for general-purpose AI model providers: Article 53 documentation, copyright policy, training-content summary, downstream information, and Article 55 systemic-risk controls. - [EU AI Act GPAI evidence pack checklist for Article 53 and 55](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/gpai-evidence-pack-workflow.md): Build a source-backed evidence pack for EU AI Act GPAI model obligations: technical documentation, downstream information, copyright policy, training-content summary, and systemic-risk records where applicable. - [EU AI Act high-risk AI use cases by industry](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/high-risk-ai-use-cases-by-industry.md): Industry-by-industry guide to EU AI Act high-risk classification under Article 6, Annex III, Annex I product safety routes, exclusions, and provider/deployer boundaries. - [EU AI Act high-risk conformity assessment route selector](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/high-risk-conformity-route-selector-workflow.md): Select the EU AI Act Article 43 conformity assessment route for a high-risk AI system, including Annex I product legislation, Annex III categories, notified body triggers, standards, declaration, CE marking, registration, and evidence. - [EU AI Act high-risk requirements checklist: Articles 8-15](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/high-risk-requirements-checklist.md): Checklist for EU AI Act high-risk AI system requirements in Articles 8-15: risk management, data governance, documentation, logs, transparency, human oversight, accuracy, robustness, and cybersecurity. - [EU AI Act penalties and fines: Article 99 tiers and GPAI exposure](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/penalties-and-fines.md): EU AI Act penalties explained: Article 99 fine tiers, prohibited-practice exposure, incorrect information, SME caps, Member State rules, and GPAI model fines. - [EU AI Act post-market monitoring and serious incident reporting](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/post-market-monitoring-and-serious-incidents.md): Source-backed guide to EU AI Act Articles 72 and 73 for high-risk AI: monitoring plans, serious incident reporting, deployer escalation, corrective action, and GPAI distinctions. - [EU AI Act Article 5 Prohibited AI Practices Screening Guide](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/prohibited-ai-practices.md): Screen AI systems against the EU AI Act Article 5 prohibitions, including manipulation, exploitation, social scoring, biometric and law-enforcement exceptions. - [EU AI Act High-Risk AI Requirements: Articles 8-16 and 26](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/requirements.md): Map the EU AI Act requirements for high-risk AI systems: risk management, data governance, technical documentation, logs, transparency, human oversight, accuracy, robustness, cybersecurity, and deployer duties. - [EU AI Act risk classification intake workflow](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/risk-classification-intake-workflow.md): A source-based intake structure for classifying EU AI Act scope, prohibited practices, high-risk routes, Annex III use cases, GPAI model status, roles, and reassessment triggers. - [EU AI Act serious incident reporting triage workflow: Article 73 and Article 55](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/serious-incident-reporting-triage-workflow.md): Triage EU AI Act serious incidents by definition, actor, reporting route, deadline, deployer escalation, corrective action, and separate GPAI systemic-risk reporting. - [EU AI Act Technical Documentation and Provider Evidence Templates](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/technical-documentation-and-provider-evidence-templates.md): Build AI Act evidence templates for high-risk AI providers: Article 11 technical documentation, Annex IV fields, quality management, conformity, CE marking, registration, logs, and post-market monitoring. - [EU AI Act Timeline and Phasing Roadmap: practical obligations and evidence guide](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/timeline-and-phasing-roadmap.md): Practical EU AI Act guide to Timeline and Phasing Roadmap: scope, owners, evidence, edge cases, checklist steps, and external citations. - [EU AI Act Article 50 transparency, labeling, and user disclosures](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/transparency-labeling-and-user-disclosures.md): Source-backed guide to EU AI Act Article 50 duties for user interaction notices, synthetic content marking, deepfake labels, emotion recognition notices, biometric categorisation notices, and related high-risk AI instructions for use. - [EU Batteries Regulation Applicability Test](https://www.sorena.io/artifacts/eu/batteries-regulation/applicability-test.md): Decide whether Regulation (EU) 2023/1542 applies to a battery, battery cell, module, pack, product with an incorporated battery, operator role, or EU market activity. - [Batteries Regulation vs ESPR](https://www.sorena.io/artifacts/eu/batteries-regulation/batteries-regulation-vs-espr.md): Compare EU Batteries Regulation duties with ESPR framework rules: scope, economic operators, DPP overlap, delegated acts, sustainability evidence, and reuse limits. - [EU Batteries Regulation Battery Categories and Scope](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-categories-and-scope.md): Classify batteries under Regulation (EU) 2023/1542 across portable, SLI, LMT, electric vehicle, and industrial categories, including incorporated batteries and multipurpose products. - [EU Batteries Regulation battery category routing workflow](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-category-routing-workflow.md): Classify portable, SLI, LMT, EV, industrial, and incorporated batteries under Regulation (EU) 2023/1542, then route carbon footprint, recycled content, passport, removability, due diligence, and waste-battery duties. - [EU Batteries Regulation supplier due diligence questionnaire](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-due-diligence-supplier-questionnaire.md): Supplier questionnaire structure for EU Batteries Regulation battery due diligence: Chapter VII scope, Annex X raw materials, supply-chain evidence, verification, disclosure, and records. - [Battery Passport Data Model Template for the EU Batteries Regulation](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-passport-data-model-template.md): Template for an EU Batteries Regulation battery passport data model: Article 77 scope, QR-linked identifiers, Annex XIII field groups, access tiers, owners, and evidence. - [Battery passport evidence workflow under EU Regulation 2023/1542](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-passport-evidence-workflow.md): Build a battery passport evidence workflow for Article 77 and Annex XIII: QR code access, access rights, provenance, conformity evidence, lifecycle updates, and ownership. - [EU Batteries Regulation Battery Passport Fields](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-passport-fields.md): Field-level guide to Article 77 and Annex XIII battery passport data: scope, QR access, public and restricted fields, and model versus individual battery records. - [EU Battery Passport Implementation Under Article 77](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-passport-implementation.md): Official source implementation guide for Article 77 battery passports: scope, QR codes, identifiers, access rights, updates, storage, and responsibility transfers. - [Battery Passport vs ESPR Digital Product Passport](https://www.sorena.io/artifacts/eu/batteries-regulation/battery-passport-vs-digital-product-passport.md): Compare the EU Batteries Regulation battery passport with the ESPR digital product passport framework across scope, access rights, QR and data carrier rules, interoperability, and reuse limits. - [EU Batteries Regulation: evidence pack for carbon footprint and recycled content targets](https://www.sorena.io/artifacts/eu/batteries-regulation/carbon-footprint-and-recycled-content-evidence.md): What to keep for EU Batteries Regulation Article 7 carbon-footprint declarations and Article 8 recycled-content documentation, with covered battery categories and cited evidence fields. - [EU Batteries Regulation: carbon footprint declaration requirements and data](https://www.sorena.io/artifacts/eu/batteries-regulation/carbon-footprint-declarations.md): Article 7 carbon footprint declaration scope, required fields, lifecycle stages, technical documentation, and public-access evidence for EU battery compliance. - [EU Batteries Regulation compliance checklist](https://www.sorena.io/artifacts/eu/batteries-regulation/checklist.md): An official source checklist for Regulation (EU) 2023/1542 covering battery category, operator role, conformity, CE marking, labels, QR codes, passports, removability, due diligence, waste batteries, and evidence records. - [EU Batteries Regulation compliance structure](https://www.sorena.io/artifacts/eu/batteries-regulation/compliance.md): Structure Batteries Regulation compliance by battery category, operator role, conformity evidence, passport data, removability, due diligence, and waste-battery responsibility. - [EU Batteries Regulation Conformity Assessment](https://www.sorena.io/artifacts/eu/batteries-regulation/conformity-assessment-and-ce-marking.md): Article 17 and Annex VIII guide to EU Batteries Regulation conformity assessment, EU declarations of conformity, CE marking, notified bodies, and release evidence. - [EU Batteries Regulation: choosing the right conformity assessment route](https://www.sorena.io/artifacts/eu/batteries-regulation/conformity-assessment-route-workflow.md): Choose the Article 17 conformity assessment route for batteries under Regulation (EU) 2023/1542, including Module A, D1, G, notified body evidence, declaration, and CE marking outputs. - [EU Batteries Regulation deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/batteries-regulation/deadlines-and-compliance-calendar.md): A cited EU Batteries Regulation calendar for application dates, secondary-act dependencies, QR and passport milestones, removability, carbon footprint, recycled content, and waste obligations. - [EU Batteries Regulation due diligence program: Chapter VII requirements](https://www.sorena.io/artifacts/eu/batteries-regulation/due-diligence-program.md): Article 47-52 guide to battery due diligence policies, management systems, supply-chain controls, Annex X risks, third-party verification, disclosure, and records. - [EU Batteries Regulation Due Diligence Thresholds](https://www.sorena.io/artifacts/eu/batteries-regulation/due-diligence-thresholds.md): Check when Chapter VII battery due diligence applies under Regulation (EU) 2023/1542, including the EUR 40 million turnover exclusion, second-life battery exclusion, raw material scope, and notified-body verification route. - [EU Batteries Regulation battery passport fields FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/battery-passport-fields.md): FAQ on Article 77 and Annex XIII battery passport field groups, public and restricted access, QR codes, unique identifiers, and model versus individual battery data. - [FAQ: EU Batteries Regulation carbon footprint performance classes](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/carbon-footprint-classes.md): FAQ on Article 7 carbon footprint declarations, performance classes, maximum-threshold sequencing, covered battery categories, and delegated-act dependencies. - [EU Batteries Regulation category routing FAQ: portable, LMT, SLI, EV and industrial batteries](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/category-routing.md): FAQ guidance for routing batteries under Regulation (EU) 2023/1542 across portable, LMT, SLI, EV and industrial categories, including incorporated batteries and obligation checks. - [EU Batteries Regulation: CE Marking FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/ce-and-conformity-assessment.md): FAQ on Article 17 conformity assessment, Annex VIII modules, EU declarations of conformity, CE marking, notified bodies, and importer and distributor checks under Regulation (EU) 2023/1542. - [EU Batteries Regulation due diligence threshold FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/due-diligence-thresholds.md): FAQ on the EU Batteries Regulation Chapter VII due diligence threshold, Article 47 exclusions, Annex X raw materials, and verification and disclosure records. - [EU Batteries Regulation economic operator roles FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/economic-operator-roles.md): FAQ on manufacturer, importer, distributor, fulfilment service provider, producer, and second-life operator roles under Regulation (EU) 2023/1542. - [EU Batteries Regulation NANDO and notified bodies FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/nando.md): When notified bodies matter under the EU Batteries Regulation, how to use the Single Market Compliance Space/NANDO lookup, and what scope evidence to retain. - [EU Batteries Regulation QR code and label timing FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/qr-and-label-timing.md): FAQ on Article 13 battery labels, the 18 February 2027 QR code rule, battery passport access, and Commission act dependencies under Regulation (EU) 2023/1542. - [EU Batteries Regulation Article 8 recycled content calculation FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/recycled-content-calculation.md): FAQ on Article 8 recycled content calculations for EU Batteries Regulation battery models, materials, thresholds, documentation, and delegated methodology status. - [EU Batteries Regulation Article 11 removability FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/removability-and-replaceability.md): FAQ on Article 11 removability and replaceability duties for portable and LMT batteries, including end-user removal, professional replacement, spares, software, and evidence. - [EU Batteries Regulation: Waste Collection FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/waste-collection-and-recycling-reporting.md): FAQ on EU Batteries Regulation waste battery collection, producer registration, free take-back, collection targets, recycling, and reporting evidence. - [EU Batteries Regulation FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq.md): Answers to practical EU Batteries Regulation questions on battery categories, CE conformity, QR labels, battery passports, due diligence, removability, and waste collection duties. - [EU Batteries Regulation Article 13 labels and consumer information](https://www.sorena.io/artifacts/eu/batteries-regulation/labeling-and-consumer-information.md): Article 13 guide to EU battery labels, separate collection marking, heavy-metal symbols, QR code links, capacity and duration notices, packaging fallback, and evidence. - [EU Batteries Regulation penalties and fines: Article 93 enforcement framework](https://www.sorena.io/artifacts/eu/batteries-regulation/penalties-and-fines.md): Official source guide to EU Batteries Regulation penalties: Article 93 Member State rules, market-surveillance action, formal non-compliance, due diligence enforcement, and evidence to preserve. - [EU Batteries Regulation producer responsibility reporting workflow](https://www.sorena.io/artifacts/eu/batteries-regulation/producer-responsibility-reporting-workflow.md): An official source workflow for EU Batteries Regulation producer registration, EPR reporting, collection evidence, take-back records, and Article 75 data handoffs. - [EU Batteries Regulation recycled content and recovery targets](https://www.sorena.io/artifacts/eu/batteries-regulation/recycled-content-and-recovery-targets.md): Article 8 recycled-content duties, Annex XII recycling efficiency and material recovery targets, covered battery categories, materials, dates, and evidence records. - [EU Batteries Regulation Article 11: battery removability and replaceability](https://www.sorena.io/artifacts/eu/batteries-regulation/removability-and-replaceability.md): Article 11 guidance for portable and LMT batteries: end-user replacement, independent professionals, instructions, spare batteries, compatible batteries, software limits, and evidence. - [EU Batteries Regulation requirements overview](https://www.sorena.io/artifacts/eu/batteries-regulation/requirements.md): An official source overview of Regulation (EU) 2023/1542 requirements for battery scope, sustainability, conformity, labels, QR codes, passports, due diligence, waste duties, and evidence outputs. - [EU Batteries Regulation Producer Responsibility](https://www.sorena.io/artifacts/eu/batteries-regulation/waste-collection-and-producer-responsibility.md): Official source guide to EU Batteries Regulation EPR: producer registration, free take-back, portable and LMT collection targets, distributor duties, treatment evidence, and Member State boundaries. - [CSDDD adverse impact prioritisation workflow](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/adverse-impact-prioritisation-workflow.md): A CSDDD workflow for identifying actual and potential adverse human rights and environmental impacts, ranking severity and likelihood, and documenting prevention, mitigation, remediation, and stakeholder evidence. - [CSDDD Applicability Test: EU and Non-EU Company Scope](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/applicability-test.md): Test whether Directive (EU) 2024/1760 may apply to an EU or non-EU company using official source CSDDD employee, turnover, group, franchise, royalty, exclusion, and phase-in checks. - [CSDDD chain of activities and supplier due diligence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/chain-of-activities-and-suppliers.md): Explain CSDDD chain-of-activities scope, upstream and downstream boundaries, subsidiaries, direct and indirect business partners, supplier risk segmentation, and evidence. - [CSDDD Chain of Activities Boundaries](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/chain-of-activities-boundaries.md): Define CSDDD upstream and downstream chain of activities boundaries for subsidiaries, direct and indirect business partners, distribution, transport, storage, and records. - [CSDDD due diligence checklist](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/checklist.md): An official source CSDDD checklist for scope, due diligence policy, chain-of-activities risk mapping, impact prioritisation, action plans, complaints, monitoring, communication, climate planning, and evidence. - [CSDDD Climate Transition Plan Requirements](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/climate-transition-plan.md): Article 22 CSDDD guidance for climate transition plans: business model alignment, targets, actions, funding, governance, and 12-month progress updates. - [CSDDD compliance duties and evidence guide](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/compliance.md): An official source CSDDD compliance guide covering due diligence policy, adverse impact identification, prevention, corrective action, complaints, monitoring, reporting, climate plans, and supervisory evidence. - [CSDDD vs CSRD: Due Diligence and Reporting Compared](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/csddd-vs-csrd.md): Compare CSDDD due diligence duties with CSRD sustainability reporting, including scope, timing, Article 16 reporting, evidence overlap, assurance, and enforcement. - [CSDDD vs German LkSG Comparison](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/csddd-vs-german-lksg.md): Compare the EU CSDDD with Germany's LkSG without mixing directive duties, national-law duties, chain boundaries, complaints, reporting, and enforcement routes. - [CSDDD vs OECD Guidelines](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/csddd-vs-oecd-guidelines.md): Compare the binding EU CSDDD with the OECD Guidelines for responsible business conduct across scope, due diligence duties, business relationships, remediation, and evidence. - [CSDDD deadlines and compliance calendar after Directive (EU) 2025/794](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/deadlines-and-compliance-calendar.md): Current CSDDD calendar for transposition, application phases, Article 16 reporting exceptions, Commission guidance dates, and practical compliance evidence. - [CSDDD Due Diligence Steps Playbook for Articles 5 and 7-16](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/due-diligence-steps-playbook.md): An official source playbook for the CSDDD due diligence sequence: policy integration, impact assessment, prioritisation, prevention, correction, remediation, stakeholder engagement, complaints, monitoring, communication, and evidence. - [CSDDD chain of activities boundaries: upstream and downstream FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/chain-of-activities-boundaries.md): FAQ on how the CSDDD defines chain of activities boundaries for subsidiaries, direct and indirect business partners, upstream activities, downstream logistics, and evidence. - [CSDDD civil liability under Article 29: what companies should check](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/civil-liability.md): FAQ on CSDDD Article 29 civil liability: liability conditions, protected legal interests, causation, compensation, limitation periods, and evidence disclosure. - [CSDDD complaints and notifications FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/complaints.md): FAQ on Article 14 CSDDD complaint and notification mechanisms, who may complain, follow-up rights, confidentiality, retaliation, and evidence. - [CSDDD contractual assurances FAQ for Articles 10 and 11](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/contractual-assurances.md): How CSDDD Articles 10 and 11 use contractual assurances with business partners, verification, SME support, action plans, and suspension or termination escalation. - [CSDDD franchising and licensing scope FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/franchising.md): FAQ on when franchise or licensing networks can fall within Article 2 of the EU CSDDD, including royalties, turnover, EU and non-EU treatment, and evidence. - [CSDDD non-EU turnover threshold FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/non-eu-turnover.md): How non-EU companies should assess CSDDD scope using EU-generated turnover, group thresholds, authorised representative records, and competent authority evidence. - [How CSDDD overlaps with OECD, UNGP, and ILO standards](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/oecd-ungp-and-ilo-overlap.md): FAQ on how OECD responsible business conduct guidance, the UN Guiding Principles, and ILO labour standards inform CSDDD due diligence without being the same legal instrument. - [CSDDD Omnibus timing changes after Directive (EU) 2025/794](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/omnibus-current-date-changes.md): FAQ answer on current CSDDD Article 37 dates after Directive (EU) 2025/794 and how to separate adopted timing changes from proposal-stage Omnibus simplification. - [CSDDD prevention vs mitigation: potential and actual adverse impacts](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/prevention-vs-mitigation.md): CSDDD FAQ on when to prevent or mitigate potential adverse impacts, when to end or minimise actual adverse impacts, and what evidence records to keep. - [CSDDD remediation FAQ: when companies must remedy adverse impacts](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/remediation.md): FAQ on CSDDD remediation: when Article 12 requires remedy, how complaints and stakeholder engagement affect the response, and what evidence to keep. - [CSDDD risk prioritisation FAQ: severity, likelihood, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/risk-prioritisation.md): How to prioritise CSDDD adverse impacts when teams cannot address everything at once, using severity, likelihood, stakeholder evidence, and a reviewable rationale. - [CSDDD scope waves: current Article 37 dates and thresholds](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/scope-waves.md): FAQ on the current CSDDD phase-in after Directive (EU) 2025/794: 26 July 2028, 26 July 2029, Article 2 scope thresholds, and evidence to retain. - [CSDDD transition plans FAQ: Article 22 climate plan requirements](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/transition-plans.md): FAQ on CSDDD Article 22 climate transition plans: targets, decarbonisation levers, investment and funding, governance, CSRD overlap, and evidence records. - [CSDDD FAQ: scope, dates, duties, liability, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq.md): Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence. - [CSDDD grievance and remediation workflow guide](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/grievance-and-remediation-workflows.md): Build a CSDDD grievance, notification, stakeholder engagement, and remediation workflow around Articles 12, 13, and 14 of Directive (EU) 2024/1760. - [CSDDD Liability and Penalties: enforcement, fines, and civil claims](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/liability-and-penalties.md): An official source guide to CSDDD supervisory enforcement, penalty mechanics, civil liability, compensation limits, evidence records, and national transposition caveats. - [CSDDD penalties and fines under Article 27](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/penalties-and-fines.md): How CSDDD Article 27 sets penalty rules, turnover-based fine caps, public decision publication, supervisory authority powers, and national transposition caveats. - [CSDDD Remediation Plan Template: Article 12, 13 and 14 evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/remediation-plan-template.md): A CSDDD remediation plan template for actual adverse impacts, complaint inputs, stakeholder engagement, action records, and monitoring evidence. - [CSDDD requirements: scope, due diligence, climate plan, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/requirements.md): An official source map of the Corporate Sustainability Due Diligence Directive requirements across scope, due diligence policy, impact assessment, complaints, remediation, monitoring, communication, and climate transition planning. - [CSDDD Scope Thresholds: EU, Non-EU, Group and Franchise Routes](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/scope-thresholds-and-in-scope-groups.md): Article 2 CSDDD scope thresholds for EU companies, non-EU Union turnover, ultimate-parent groups, franchise and licensing routes, consecutive-year tests, and evidence records. - [CSDDD Non-EU Turnover Thresholds and Scope Waves](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/scope-waves-and-non-eu-turnover.md): Article 2 and Article 37 CSDDD scope guide for non-EU Union turnover, group routes, franchise and licensing routes, and current application dates after Directive (EU) 2025/794. - [CSDDD Supplier Contract Clause Review Workflow](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/supplier-contract-clause-review-workflow.md): Review supplier contract clauses against CSDDD Articles 10 and 11: contractual assurances, verification, SME fairness, support, action plans, and escalation evidence. - [CSDDD Supplier Contract Clauses: Articles 10 and 11 Evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/supplier-contract-clauses.md): How to use CSDDD supplier contract clauses without treating clauses as a substitute for due diligence: contractual assurances, verification, SME support, action plans, limits, and evidence. - [CSDDD supplier human rights impact scoring template](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/supplier-human-rights-risk-scoring-template.md): A CSDDD supplier impact scoring template for Article 8 identification, Article 9 prioritisation, severity, likelihood, stakeholder input, chain-of-activities boundaries, and evidence records. - [CSRD Applicability Test for EU and Non-EU Company Groups](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/applicability-test.md): Check whether CSRD and ESRS reporting may apply by testing undertaking size, listed status, group reporting, non-EU branches or subsidiaries, and phase-in evidence. - [CSRD assurance and ESRS digital tagging evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/assurance-and-digital-tagging-evidence.md): Evidence checklist for CSRD assurance readiness, ESRS datapoint traceability, and digital tagging preparation under the ESRS XBRL and ESEF reporting framework. - [CSRD assurance evidence pack workflow for ESRS reporting](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/assurance-evidence-pack-workflow.md): A CSRD and ESRS workflow for building an assurance-ready evidence pack covering scope, double materiality, ESRS datapoints, controls, estimates, and digital tagging. - [CSRD assurance-ready controls and evidence for ESRS reporting](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/assurance-ready-controls-and-evidence.md): Build CSRD and ESRS evidence around GOV-5 controls, double materiality, IROs, value-chain data, assurance files, and XBRL tagging checks. - [CSRD and ESRS Reporting Checklist](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/checklist.md): A practical CSRD and ESRS checklist for confirming reporting scope, sustainability statement content, double materiality, value-chain evidence, assurance readiness, and digital tagging. - [CSRD and ESRS Compliance Obligations](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/compliance.md): Official source CSRD and ESRS compliance guide covering scope checks, sustainability statements, double materiality, value-chain data, assurance, and digital tagging. - [CSRD vs CSDDD: Reporting vs Due Diligence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-csddd.md): Compare CSRD sustainability reporting with CSDDD human rights and environmental due diligence, including scope, evidence, assurance, penalties, and overlap. - [CSRD vs GRI: ESRS Interoperability](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-gri.md): Compare CSRD/ESRS reporting with GRI-based reporting using official source ESRS interoperability, materiality, value-chain, and disclosure-reuse rules. - [CSRD vs IFRS S1 and S2 Comparison](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-ifrs-s1-and-s2.md): Compare CSRD and ESRS with IFRS S1 and S2 across scope, materiality, disclosures, value chain reporting, assurance, digital tagging, and interoperability. - [CSRD vs SEC Climate Disclosure Rule](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-sec-climate-disclosure-rule.md): Official source comparison notes for CSRD and the SEC climate disclosure rule, focused on CSRD and ESRS duties and conservative limits where SEC facts are not sourced. - [CSRD vs SFDR: ESRS and Financial Disclosures](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-sfdr.md): Compare CSRD/ESRS corporate sustainability reporting with SFDR financial-market disclosures, including scope, materiality, PAI data, assurance, tagging, and reuse limits. - [CSRD vs EU Taxonomy Article 8](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/csrd-vs-taxonomy-alignment.md): Compare CSRD and ESRS sustainability reporting with EU Taxonomy Article 8 KPI disclosures, including scope, evidence, tagging, and reuse limits. - [CSRD deadlines and ESRS compliance calendar](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/deadlines-and-compliance-calendar.md): An official source CSRD and ESRS calendar covering the original reporting waves, enacted postponement caveats, publication duties, assurance, and digital reporting workstreams. - [CSRD Double Materiality Interview Question Bank for ESRS](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/double-materiality-interview-question-bank.md): Interview prompts for ESRS double materiality work: context, affected stakeholders, value chain IROs, impact materiality, financial materiality, thresholds, and evidence. - [CSRD double materiality method under ESRS](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/double-materiality-method.md): An official source method for ESRS double materiality assessment: impact materiality, financial materiality, value-chain coverage, thresholds, evidence, and documentation. - [CSRD double materiality scoring: IRO assessment and ESRS data points](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/double-materiality-scoring.md): An official source scoring guide for CSRD and ESRS double materiality: impact materiality, financial materiality, thresholds, evidence, governance, and disclosure mapping. - [CSRD Double Materiality Workflow for ESRS Assessment](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/double-materiality-workflow.md): A CSRD and ESRS workflow for running a double materiality assessment, from value-chain scoping and stakeholder inputs to IRO scoring, governance approval, and audit trail evidence. - [ESRS 1 and ESRS 2 structure under CSRD](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/esrs-1-and-esrs-2-structure.md): An official source explanation of how ESRS 1 sets the reporting architecture and how ESRS 2 provides the mandatory general disclosures for CSRD sustainability statements. - [ESRS data point inventory workflow for CSRD reporting](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/esrs-data-point-inventory-workflow.md): Build an ESRS data point inventory that links disclosure requirements, materiality outcomes, evidence owners, XBRL tagging readiness, and assurance controls. - [ESRS structure and data model for CSRD reporting](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/esrs-structure-and-data-model.md): Map ESRS architecture, disclosure requirements, datapoints, materiality, XBRL taxonomy, Article 8 tagging, and report data ownership for CSRD reporting. - [CSRD assurance evidence FAQ: what to keep for limited assurance](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/assurance-evidence.md): What CSRD and ESRS assurance evidence should support: management-report publication, the assurance report, national assurance procedures, and EU limited assurance milestones. - [CSRD data point inventory FAQ for ESRS disclosure readiness](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/data-point-inventory.md): How to build an ESRS data point inventory for CSRD reporting: disclosure requirements, materiality filters, evidence ownership, value-chain data, XBRL readiness, and assurance support. - [CSRD digital tagging and XBRL readiness FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/digital-tagging-xbrl.md): What CSRD teams should do now about XHTML, Inline XBRL, ESRS taxonomy materials, tagging controls, and limits before final digital taxonomy rules apply. - [FAQ: CSRD double materiality scoring - thresholds, weighting, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/double-materiality-scoring.md): How to score CSRD double materiality under ESRS without invented thresholds: impact materiality, financial materiality, evidence, and documentation. - [How do ESRS 1 and ESRS 2 structure CSRD reporting?](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/esrs-1-and-2-structure.md): FAQ explaining how ESRS 1 general requirements and ESRS 2 general disclosures fit into CSRD reporting, materiality, and topical ESRS disclosures. - [LSME and VSME under EU CSRD: what SMEs should know](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/lsme-and-vsme.md): FAQ on LSME and VSME under the EU CSRD: listed SME reporting, the temporary opt-out, voluntary SME reporting, and value-chain requests. - [CSRD omnibus stop-the-clock status: enacted delay vs proposed scope changes](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/omnibus-stop-the-clock-status.md): FAQ on the CSRD stop-the-clock directive, the separate Omnibus proposal, and how reporting teams should treat enacted and proposed changes. - [CSRD reporting waves FAQ: who reports first and what changed](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/reporting-waves.md): FAQ on original CSRD reporting waves, stop-the-clock caveats, listed SME opt-out, third-country reporting, and why local transposition law still matters. - [Taxonomy Article 8 KPIs under CSRD and ESRS](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/taxonomy-article-8-kpis.md): FAQ explaining how EU Taxonomy Article 8 KPI disclosures relate to CSRD, ESRS, and the Article 8 XBRL taxonomy. - [CSRD Article 40a third-country group reporting FAQ](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/third-country-groups.md): FAQ on when CSRD Article 40a applies to third-country groups, which EU subsidiary or branch publishes the report, and what happens with assurance and missing information. - [CSRD topical ESRS scoping: what must be reported?](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/topical-esrs-scoping.md): FAQ on CSRD topical ESRS scoping: ESRS 2, double materiality, topical disclosure requirements, omitted topics, climate, and Appendix B datapoints. - [FAQ: CSRD value chain estimates - methods and proportionality under ESRS](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/value-chain-estimates.md): When ESRS permits value chain estimates, what to disclose about assumptions, accuracy, limits, and improvement plans. - [CSRD and ESRS FAQ: scope, materiality, assurance, tagging, and value chain](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq.md): CSRD and ESRS FAQ hub covering company scope, reporting waves, ESRS structure, double materiality, assurance, digital tagging, Taxonomy Article 8, and value chain data. - [CSRD penalties and fines: Member State enforcement, controls, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/penalties-and-fines.md): A conservative guide to CSRD penalty exposure: why fines depend on Member State implementation, which reporting failures create risk, and what evidence teams should keep. - [CSRD reporting waves and Omnibus status](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/reporting-waves-and-omnibus-status.md): Track what is enacted, postponed, final, or still in the Omnibus process for CSRD reporting waves, ESRS reporting, and Stop-the-Clock changes. - [CSRD and ESRS requirements: scope, reporting, assurance, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/requirements.md): Official source guide to CSRD and ESRS requirements: who reports, what the sustainability statement must cover, double materiality, value-chain data, assurance, publication, digital tagging, and controls. - [CSRD scope and phasing by company type](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/scope-and-phasing-by-company-type.md): Map CSRD reporting scope by company category, original Article 5 wave, listed SME opt-out, third-country group rules, and stop-the-clock caveats. - [Taxonomy Article 8 KPIs for CSRD reporting](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/taxonomy-article-8-kpis.md): Official source guide to Article 8 Taxonomy KPI disclosures in CSRD sustainability statements, including KPI templates, ESRS links, XBRL readiness, and evidence controls. - [CSRD and ESRS value-chain data, estimates, proxies, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/value-chain-data-and-estimation.md): How to handle ESRS value-chain information when supplier or customer data is incomplete: reasonable efforts, estimates, limitations, controls, and assurance evidence. - [CSRD value chain data and estimation methodology under ESRS](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/value-chain-estimates.md): How ESRS lets CSRD reporters use sector averages, proxies, and other estimates when direct value-chain data is not available after reasonable effort. - [CSRD XBRL Tagging Checklist for ESRS and Article 8 Readiness](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/xbrl-tagging-checklist.md): An official source CSRD XBRL tagging readiness checklist for XHTML, Inline XBRL, ESRS taxonomy mapping, Article 8 taxonomy mapping, ESEF validation, and source-controlled review. - [CRA Applicability Test for Products With Digital Elements](https://www.sorena.io/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning. - [EU Cyber Resilience Act Checklist for Product Security and CE Marking](https://www.sorena.io/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence. - [EU CRA Compliance Program for Manufacturers and Economic Operators](https://www.sorena.io/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance. - [CRA Conformity Assessment and CE Marking](https://www.sorena.io/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking. - [CRA vs RED Cybersecurity Delegated Act](https://www.sorena.io/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment. - [CRA vs UK PSTI Act](https://www.sorena.io/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review. - [CRA deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates. - [CRA Essential Cybersecurity Requirements in Annex I](https://www.sorena.io/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence. - [CRA Blue Guide Concepts FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md): CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. - [CRA CE Marking FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - [CRA Component Due Diligence FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - [CRA Conformity Assessment Routes FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - [EU Cyber Resilience Act Core Functionality FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - [CRA Cybersecurity Risk Assessment FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - [CRA Declaration of Conformity FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md): FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. - [CRA Economic Operators FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - [CRA Essential Cybersecurity Requirements FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - [CRA Hardware and Software Boundaries FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - [CRA Harmonised Standards FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md): Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. - [CRA Important and Critical Products FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - [CRA Integrated Components and Dependencies FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - [CRA Interplay With EU Product Laws FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - [CRA Known Exploitable Vulnerabilities at Launch FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - [CRA Legacy Products FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - [CRA Manufacturer Obligations FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - [CRA Market Surveillance and Enforcement FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - [Cyber Resilience Act Module A FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - [CRA Module B+C FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - [CRA Module H FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - [CRA Notified Bodies FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md): Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. - [CRA Open-Source Software FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - [CRA Over-the-Air Updates FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - [CRA penalties and fines FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - [CRA Product Families FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - [CRA Remote Data Processing Solutions FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - [EU Cyber Resilience Act Repairs and Spare Parts FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - [CRA Reporting Obligations FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - [CRA Products With Digital Elements Scope FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - [CRA Secure-by-Default FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - [CRA Security Updates vs Functionality Updates FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - [CRA Substantial Modification FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - [CRA Support Period FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - [CRA Tailor-Made Products FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - [CRA Technical Documentation FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - [CRA Transition Period FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - [CRA Update Availability and Software Archives FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - [CRA User Information and Transparency FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - [CRA Vulnerability Handling FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - [EU Cyber Resilience Act FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. - [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](https://www.sorena.io/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches. - [CRA Products with Digital Elements Scope](https://www.sorena.io/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles. - [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](https://www.sorena.io/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence. - [CRA Requirements](https://www.sorena.io/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence. - [CRA SBOM and Vulnerability Management Template](https://www.sorena.io/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields. - [EU Cyber Resilience Act Technical Documentation and Audit File](https://www.sorena.io/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention. - [CRA Vulnerability Handling and Disclosure](https://www.sorena.io/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records. - [EU Data Act User Access and Portability Rights](https://www.sorena.io/artifacts/eu/data-act/access-rights-and-portability.md): Practical guide to EU Data Act user access, connected-product data portability, third-party sharing, trade secret safeguards, and the GDPR boundary. - [EU Data Act Applicability Test](https://www.sorena.io/artifacts/eu/data-act/applicability-test.md): Check whether a product, related service, data holder, cloud service, data-space role, smart contract, or B2G request is in scope of the EU Data Act. - [Data Act B2B Data-Sharing Contract Clauses](https://www.sorena.io/artifacts/eu/data-act/b2b-data-sharing-contract-clauses.md): Clause guide for EU Data Act B2B data sharing: FRAND terms, compensation, trade secret safeguards, recipient limits, termination, logs, and GDPR boundaries. - [Data Act B2B Data-Sharing Contract Template](https://www.sorena.io/artifacts/eu/data-act/b2b-data-sharing-contract-template.md): A usable EU Data Act B2B data-sharing template outline covering access requests, data schedules, permitted use, trade secrets, security, compensation, GDPR boundaries, audit records, and termination. - [Data Act B2G Exceptional-Need Requests](https://www.sorena.io/artifacts/eu/data-act/b2g-exceptional-need-requests.md): An official source guide to EU Data Act Chapter V requests from public bodies: exceptional need, public emergencies, request contents, limits, safeguards, costs, and records. - [EU Data Act Checklist for Product, Cloud, and Contract Teams](https://www.sorena.io/artifacts/eu/data-act/checklist.md): A cited EU Data Act checklist for connected-product data access, third-party sharing, B2G requests, cloud switching, unfair terms, smart contracts, personal data boundaries, evidence, and owners. - [EU Data Act Cloud Switching and Exit Plans](https://www.sorena.io/artifacts/eu/data-act/cloud-switching-and-exit-plans.md): A cited EU Data Act guide for data processing service exit plans: switching contracts, exportable data, assistance, charges, interoperability, retrieval, erasure, and records. - [Data Act Cloud Switching Compliance Checklist](https://www.sorena.io/artifacts/eu/data-act/cloud-switching-compliance-checklist.md): A cited EU Data Act checklist for cloud and data processing service providers covering switching clauses, notices, export formats, charges, interoperability, and evidence. - [EU Data Act Compliance Program](https://www.sorena.io/artifacts/eu/data-act/compliance.md): Build a Data Act compliance program for connected-product data access, contracts, B2G requests, cloud switching, smart contracts, GDPR boundaries, records, and ownership. - [Data Act and Common European Data Spaces](https://www.sorena.io/artifacts/eu/data-act/data-act-and-common-european-data-spaces.md): How Data Act Article 33 connects data-space participation with metadata, vocabularies, APIs, access terms, data quality, governance, and standards monitoring. - [EU Data Act vs Data Governance Act](https://www.sorena.io/artifacts/eu/data-act/data-act-vs-data-governance-act.md): Compare the EU Data Act with the Data Governance Act: connected-product access, cloud switching, B2B/B2G duties, protected public-sector reuse, intermediaries, altruism, governance, and enforcement. - [Data Act vs GDPR: connected-product data access](https://www.sorena.io/artifacts/eu/data-act/data-act-vs-gdpr.md): Compare EU Data Act connected-product access duties with GDPR personal-data rules: scope, roles, lawful basis, data subject rights, third-party sharing, trade secrets, and conflicts. - [EU Data Act Data Processing Service Switching](https://www.sorena.io/artifacts/eu/data-act/data-processing-services-switching.md): A cited EU Data Act guide for provider and customer switching duties: exit assistance, exportable data, contract clauses, charges, interoperability, retrieval, and erasure. - [EU Data Act deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/data-act/deadlines-and-compliance-calendar.md): A cited calendar for EU Data Act application dates, product design timing, contract remediation, cloud switching charges, response periods, standards work, and evidence records. - [Data Act FAQ for Aftermarket Repair and Mobility Services](https://www.sorena.io/artifacts/eu/data-act/faq/aftermarket-repair-and-mobility-services.md): FAQ on EU Data Act vehicle-data access for repairers, independent service providers, fleets, insurers, and mobility services. - [EU Data Act Application Dates and Transition FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/application-dates-and-transition.md): FAQ on when the EU Data Act applies, which obligations are delayed, and what product, contract, cloud, and evidence records teams should maintain. - [EU Data Act Article 36 Smart Contract Controls FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/article-36-smart-contract-controls.md): FAQ explaining when EU Data Act Article 36 applies to smart contracts for data-sharing agreements and what controls, conformity evidence, and limits it requires. - [Data Act Audit Evidence and Request Logs FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/audit-evidence-and-request-logs.md): FAQ for Data Act request logs covering user and third-party access, B2G exceptional need requests, cloud switching records, contract terms, trade secrets, and GDPR boundaries. - [EU Data Act B2G Compensation and Costs FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/b2g-compensation-and-costs.md): FAQ on when Data Act B2G exceptional-need requests are free, when fair compensation may be claimed, which costs can be included, and what records to keep. - [EU Data Act B2G Exceptional Need FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/b2g-exceptional-need.md): When public-sector bodies can request business-held data under the EU Data Act, what a valid request must contain, and how data holders handle limits, trade secrets, compensation, and evidence. - [Data Act Cloud Switching Contract Terms FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/cloud-switching-contract-terms.md): FAQ on EU Data Act cloud switching contract terms: Article 25 clauses, assistance, notice, transition, charges, export, termination, interoperability, and records. - [Data Act Cloud Switching Fees and Deadlines FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/cloud-switching-fees-and-deadlines.md): FAQ on EU Data Act cloud switching charges, 2027 fee removal, notice periods, transition windows, data retrieval, contract terms, and evidence records. - [EU Data Act Cloud Switching Procurement FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/cloud-switching-procurement-checklist.md): Procurement checklist FAQ for EU Data Act cloud switching: contract terms, exit support, exportable data, switching charges, interoperability, termination, and supplier evidence. - [EU Data Act B2B Data Sharing Compensation FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/compensation-for-b2b-data-sharing.md): FAQ on when Data Act data holders may charge B2B data recipients, what reasonable compensation can include, SME limits, unfair terms, disputes, and trade secret safeguards. - [Data Act Complaints and Dispute Settlement FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/complaints-and-dispute-settlement.md): FAQ on EU Data Act complaints, competent authorities, dispute settlement bodies, B2B data-sharing disputes, B2G requests, cloud switching disputes, and evidence records. - [EU Data Act and Common European Data Spaces FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/data-act-and-common-european-data-spaces.md): FAQ on how EU Data Act interoperability duties, Data Governance Act rules, and sector data-space governance fit together without treating participation as a general obligation. - [Data Act and Data Governance Act Overlap FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/data-governance-act-overlap.md): FAQ explaining where the EU Data Act and Data Governance Act overlap, how they differ, and how to route product, cloud, public-sector reuse, intermediary, and data altruism workflows. - [EU Data Act data spaces interoperability FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/data-spaces-interoperability.md): FAQ explaining Article 33 Data Act interoperability requirements for data-space participants, common European data spaces, standards, APIs, metadata, and architecture evidence. - [EU Data Act Direct Access by Design FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/direct-access-by-design.md): FAQ for product and legal teams designing user access to connected-product and related-service data under the EU Data Act. - [EU Data Act Enforcement and Competent Authorities FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/enforcement-and-competent-authorities.md): FAQ on who enforces the EU Data Act, how complaints work, how Member States set penalties, when dispute settlement can be used, and when GDPR authorities remain responsible. - [Data Act Exportable Data and Metadata FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/exportable-data-and-metadata.md): FAQ explaining which product, related service, metadata, and cloud switching data must be exportable under the EU Data Act, and which data can be excluded. - [Data Act Functional Equivalence FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/functional-equivalence.md): FAQ on Data Act functional equivalence for cloud switching: IaaS scope, customer outcomes, export support, interoperability duties, limits, and evidence. - [Data Act and GDPR Personal Data Overlap FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/gdpr-personal-data-overlap.md): FAQ on how the EU Data Act works when connected-product or related-service data includes personal data, mixed datasets, GDPR roles, lawful basis, trade secrets, and third-party sharing. - [Data Act Indirect Access Request Flows FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/indirect-access-request-flows.md): FAQ for Data Act teams handling user and third-party data requests when direct connected-product access is unavailable, incomplete, or limited. - [Data Act International Government Access FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/international-government-access.md): FAQ on EU Data Act safeguards for non-EU government access to non-personal data held in the Union by data processing service providers. - [Data Act Interoperability Standards FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/interoperability-standards.md): FAQ on EU Data Act interoperability standards for data spaces, cloud switching, smart contracts, harmonised standards, common specifications, and M/614. - [Data Act Model Contractual Terms FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/model-contractual-terms.md): FAQ on the EU Data Act non-binding model contractual terms for data access and use, cloud switching clauses, B2B use, unfair terms, and evidence. - [EU Data Act Non-Emergency Public-Sector Requests FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/non-emergency-public-sector-requests.md): FAQ on EU Data Act requests where a public body claims exceptional need outside a public emergency, including scope, request contents, limits, compensation, confidentiality, and evidence. - [EU Data Act Non-Personal Data and Mixed Datasets FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/non-personal-data-and-mixed-datasets.md): FAQ on how the EU Data Act treats non-personal data, mixed datasets, GDPR precedence, user and third-party access, trade-secret limits, and evidence records. - [EU Data Act Pre-Contractual Information FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/pre-contractual-information.md): FAQ on EU Data Act Article 3 pre-contract information for connected products and related services, including data categories, access methods, data holder identity, third-party sharing, and GDPR boundaries. - [EU Data Act Product Data vs Related Service Data FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/product-data-and-service-data.md): FAQ explaining how the EU Data Act separates connected product data, related service data, readily available raw and pre-processed data, metadata, and inferred or derived outputs. - [Data Act Public Emergency Requests FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/public-emergency-requests.md): FAQ on EU Data Act public emergency requests: exceptional need, request content, timing, data holder response, compensation, confidentiality, and records. - [EU Data Act Readily Available Data FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/readily-available-data.md): FAQ on what counts as readily available data under the EU Data Act, including product data, related service data, metadata, inferred data, and access mechanics. - [EU Data Act Related Services FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/related-services.md): FAQ explaining when software is a Data Act related service, how it links to connected products, which product and service data are in scope, and what exclusions apply. - [EU Data Act Connected Product Scope FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/scope-connected-products.md): FAQ explaining when connected products, related services, generated data, EU market placement, and SME exceptions fall within EU Data Act scope. - [EU Data Act Smart Contracts for Data Sharing FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/smart-contracts-for-data-sharing.md): Answers on Article 36 Data Act smart-contract requirements for data sharing: scope, robustness, access control, termination, archiving, conformity assessment, contract terms, and standards status. - [Data Act SME Exceptions and Startups FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/sme-exceptions-and-startups.md): FAQ on where the EU Data Act gives micro, small, medium-sized, startup, and SME actors narrower treatment for access duties, compensation, and B2B terms. - [EU Data Act Third-Party Data Sharing FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/third-party-data-sharing.md): FAQ on user-directed third-party data sharing under the EU Data Act, covering data holder duties, recipient limits, trade secrets, security, GDPR, and gatekeepers. - [Data Act Trade Secret Technical Protection Measures FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/trade-secret-technical-protection-measures.md): FAQ on how EU Data Act data holders can protect trade secrets with confidentiality safeguards, technical measures, limited withholding, suspension, refusal, and evidence. - [EU Data Act Trade Secret Safeguards FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/trade-secrets-safeguards.md): FAQ on protecting trade secrets when handling EU Data Act user and third-party data access requests, including safeguards, withholding, suspension, refusal, notices, and records. - [EU Data Act Unfair Contractual Terms FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/unfair-contractual-terms.md): FAQ on Article 13 of the EU Data Act: B2B unfair contract terms, unilateral take-it-or-leave-it clauses, always-unfair terms, presumed-unfair terms, SMEs, model terms, and review evidence. - [EU Data Act Users, Data Holders, and Recipients FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/users-data-holders-and-recipients.md): FAQ explaining Data Act users, data holders, data recipients, connected products, related services, user access, third-party limits, and GDPR boundaries. - [EU Data Act Vehicle Data Guidance FAQ](https://www.sorena.io/artifacts/eu/data-act/faq/vehicle-data-guidance.md): FAQ on EU Data Act vehicle data guidance for connected vehicles, aftermarket repair, mobility services, third-party access, trade secrets, security, and GDPR boundaries. - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates](https://www.sorena.io/artifacts/eu/data-act/faq.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. - [EU Data Act Penalties and Enforcement](https://www.sorena.io/artifacts/eu/data-act/penalties-and-fines.md): Official source guide to Data Act penalties under Article 40, Member State enforcement, penalty factors, complaints, judicial remedies, and the GDPR enforcement boundary. - [EU Data Act Article 3 Pre-Contract Information](https://www.sorena.io/artifacts/eu/data-act/pre-contractual-information-obligations.md): What Article 3 of the EU Data Act requires before connected-product purchase, rent, lease, or related-service contracting: data categories, access, data holder identity, third-party sharing, complaints, and evidence. - [EU Data Act requirements](https://www.sorena.io/artifacts/eu/data-act/requirements.md): Official source EU Data Act requirements for connected-product data access, B2B sharing terms, B2G exceptional needs, cloud switching, smart contracts, interoperability, GDPR boundaries, and records. - [EU Data Act Connected Product Scope and Data Types](https://www.sorena.io/artifacts/eu/data-act/scope-connected-products-and-data-types.md): Classify EU Data Act connected products, related services, product data, related-service data, readily available data, metadata, and excluded derived outputs. - [Data Act Smart Contracts for Data Sharing](https://www.sorena.io/artifacts/eu/data-act/smart-contracts-for-data-sharing.md): Data Act Article 36 smart contract guide for data-sharing agreements: scope, robustness, access control, termination, interruption, archiving, standards status, and conformity evidence. - [Data Act Trade Secrets and Protection Measures](https://www.sorena.io/artifacts/eu/data-act/trade-secrets-and-protection.md): Data Act guide for protecting trade secrets during access and sharing: classification, safeguards, refusal thresholds, notices, evidence records, and reviews. - [Data Act Unfair Contractual Terms](https://www.sorena.io/artifacts/eu/data-act/unfair-contractual-terms.md): Review B2B data-sharing clauses under EU Data Act Article 13: unilateral terms, always unfair examples, presumed unfair terms, model clauses, evidence, and remediation. - [Data Act Vehicle Data Guidance](https://www.sorena.io/artifacts/eu/data-act/vehicle-data-guidance.md): Commission-cited guide to Data Act vehicle data access: connected vehicles, vehicle-related services, raw and pre-processed data, aftermarket use cases, access routes, safeguards, and GDPR boundaries. - [EUDR Applicability Test: Products, EU Market Activity, and Actor Roles](https://www.sorena.io/artifacts/eu/deforestation-regulation/applicability-test.md): Test whether the EU Deforestation Regulation applies by checking Annex I product scope, EU market placement or export, operator/trader status, downstream role, SME status, and simplified due diligence conditions. - [EUDR compliance checklist for products, suppliers, and DDS filing](https://www.sorena.io/artifacts/eu/deforestation-regulation/checklist.md): A practical EU Deforestation Regulation checklist covering product scope, supplier evidence, geolocation, risk assessment, mitigation, due diligence statements, recordkeeping, and customs readiness. - [EUDR compliance obligations for operators and traders](https://www.sorena.io/artifacts/eu/deforestation-regulation/compliance.md): Official source EUDR compliance guide covering operator and trader duties, Article 9 information, Article 10 risk assessment, Article 11 mitigation, due diligence statements, records, and authority-readiness. - [EUDR country benchmarking and simplified due diligence](https://www.sorena.io/artifacts/eu/deforestation-regulation/country-benchmarking-and-simplified-due-diligence.md): How EUDR country-risk benchmarking affects low-risk simplified due diligence, full due diligence, information collection, risk monitoring, and evidence records. - [EUDR country benchmarking triage workflow](https://www.sorena.io/artifacts/eu/deforestation-regulation/country-benchmarking-triage-workflow.md): Route EUDR consignments and suppliers after country benchmarking: low-risk simplification checks, standard or high-risk due diligence, monitoring triggers, and evidence records. - [EUDR due diligence statement filing workflow](https://www.sorena.io/artifacts/eu/deforestation-regulation/dds-filing-workflow.md): An official source workflow for filing EUDR due diligence statements: prerequisites, Article 33 information-system use, reference numbers, role handoffs, and records. - [EUDR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/deforestation-regulation/deadlines-and-compliance-calendar.md): A cited EUDR calendar covering application dates, benchmarking milestones, the due diligence statement system, and preparation tasks for operators and traders. - [EUDR deadlines, phasing, and first actions](https://www.sorena.io/artifacts/eu/deforestation-regulation/deadlines-phasing-and-what-to-do-first.md): Official source EUDR readiness guide covering application dates, operator and trader first actions, geolocation evidence, due diligence statements, the information system, and country benchmarking. - [EUDR Due Diligence Statement Evidence: DDS records, geolocation, and supplier proof](https://www.sorena.io/artifacts/eu/deforestation-regulation/due-diligence-statement-and-evidence.md): Build an EUDR evidence file for due diligence statements: Article 9 information, geolocation records, supplier proof, risk assessment, mitigation, reference numbers, and retention. - [EUDR Due Diligence Statement Template](https://www.sorena.io/artifacts/eu/deforestation-regulation/eudr-due-diligence-statement-template.md): A cited EUDR due diligence statement template covering operator data, product scope, geolocation evidence, risk conclusion, reference numbers, and attachment records. - [EUDR Geolocation Data Requirements: plots, suppliers, and DDS evidence](https://www.sorena.io/artifacts/eu/deforestation-regulation/eudr-geolocation-data-requirements.md): How to collect, check, and use EUDR geolocation evidence for relevant commodities and products, Article 9 information, risk assessment, supplier records, and due diligence statements. - [EUDR vs CSDDD: product due diligence vs corporate due diligence](https://www.sorena.io/artifacts/eu/deforestation-regulation/eudr-vs-csddd.md): Compare EUDR product-level deforestation controls with high-level corporate due-diligence workstreams, focusing on scope, actors, due diligence statements, geolocation, country benchmarking, and evidence. - [EUDR Annex I product lookup: how to check scope](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/annex-i-product-lookup.md): How to check whether a product is in EUDR Annex I, connect it to a covered commodity, and keep supplier and trade evidence without relying on unsupported code lists. - [EUDR country benchmarking FAQ: low, standard, and high risk](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/country-benchmarking.md): What EUDR country benchmarking means, how low-risk production affects simplified due diligence, and what operators still need to collect. - [EUDR customs and import release FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/customs-and-import-release.md): How to prepare EUDR due diligence statement references, information-system handoffs, importer checks, and release evidence before customs or export clearance. - [EUDR DDS Reference Numbers: What to Record and Pass Down](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/dds-reference-numbers.md): FAQ on EU Deforestation Regulation DDS reference numbers, including operator submissions, downstream handoffs, Article 33 information-system context, and evidence records. - [How is the EU Deforestation Regulation enforced?](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/enforcement.md): EUDR FAQ on competent authority checks, evidence requests, due diligence records, and official source non-compliance consequences. - [EUDR geolocation plots and polygons FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/geolocation-plots-and-polygons.md): How EUDR teams should collect, link, and use plot-level geolocation evidence for due diligence statements, suppliers, consignments, and risk assessment. - [EUDR information system filing: DDS references and handoffs](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/information-system-filing.md): FAQ guidance on EUDR information system filing, due diligence statement submission, declaration identifiers, downstream handoffs, representatives, and evidence retention. - [EUDR non-negligible risk: what stops product release?](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/non-negligible-risk.md): FAQ on how EUDR Articles 10 and 11 handle non-negligible risk, when operators should stop placement or export, and what evidence belongs in the file. - [EUDR operator, trader, and downstream roles FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/operator-trader-and-downstream-roles.md): How to classify EUDR operators, downstream operators, and traders, including market-placement triggers, DDS reference handoffs, non-SME duties, and evidence records. - [EUDR simplified due diligence: low-risk country evidence FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/simplified-due-diligence.md): FAQ answer on when EUDR simplified due diligence applies, what Article 9 information remains required, when Articles 10 and 11 return, and what records to keep. - [EUDR SME timing: which dates apply to micro, small, and medium businesses?](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/sme-timing.md): FAQ on EUDR SME timing, including the 30 December 2026 main application date, the 30 June 2027 later date for certain micro and small undertakings, and first evidence records to prepare. - [EUDR Supplier Evidence FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/supplier-evidence.md): What supplier evidence to collect for EUDR Article 9 information, geolocation, risk assessment, due diligence statements, and downstream recordkeeping. - [EU Deforestation Regulation FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq.md): Concise EU Deforestation Regulation answers on scope, covered commodities, operator and trader roles, due diligence statements, geolocation, low-risk countries, customs release, SME timing, enforcement, and records. - [EUDR Geolocation Evidence and Annex I Commodity Lookup](https://www.sorena.io/artifacts/eu/deforestation-regulation/geolocation-evidence-and-commodity-lookup.md): Build an EUDR evidence file that links Annex I commodity scope, supplier and trader records, geolocation evidence, product lots, risk assessment, and due diligence statement support. - [EUDR Geolocation Traceability Systems: records, DDS handoffs, and supplier evidence](https://www.sorena.io/artifacts/eu/deforestation-regulation/geolocation-traceability-and-systems.md): How to structure EUDR traceability records for geolocation, supplier evidence, product lots, risk assessment inputs, and due diligence statement handoffs. - [EUDR in-scope commodities and products](https://www.sorena.io/artifacts/eu/deforestation-regulation/in-scope-commodities-and-products.md): How to check EUDR scope for the seven commodities, Annex I relevant products, operator and trader roles, and the evidence needed to support a scope decision. - [EUDR Penalties and Enforcement: Checks, Corrective Action, and Sanctions](https://www.sorena.io/artifacts/eu/deforestation-regulation/penalties-and-enforcement.md): Official source guide to EUDR enforcement: competent authority checks, interim measures, corrective action, EU penalty categories, and records to keep ready. - [EUDR Penalties, Fines, and Enforcement Consequences](https://www.sorena.io/artifacts/eu/deforestation-regulation/penalties-and-fines.md): Official source guide to EUDR enforcement exposure: Member State penalties, competent authority checks, corrective measures, product holds, and evidence records without invented national fine tables. - [EUDR requirements for operators, traders, and DDS filing](https://www.sorena.io/artifacts/eu/deforestation-regulation/requirements.md): Official source guide to EU Deforestation Regulation requirements: scope, due diligence, geolocation, risk assessment, mitigation, DDS filing, records, and simplified regimes. - [EUDR risk assessment and mitigation under Articles 10 and 11](https://www.sorena.io/artifacts/eu/deforestation-regulation/risk-assessment-and-mitigation.md): How to run an EUDR Article 10 risk assessment, decide when risk is not negligible, apply Article 11 mitigation, and keep release evidence before placing products on the EU market or exporting. - [EUDR Supplier Onboarding Template](https://www.sorena.io/artifacts/eu/deforestation-regulation/supplier-onboarding-template.md): A practical EUDR supplier onboarding template for Annex I product scope, supplier roles, geolocation evidence, risk inputs, mitigation records, DDS references, and five-year records. - [EU Digital Markets Act Article 11 Evidence Calendar](https://www.sorena.io/artifacts/eu/digital-markets-act/annual-report-evidence-calendar.md): Build an official source DMA Article 11 compliance report calendar with evidence owners, annual update checkpoints, report sections, and review gates. - [DMA Anti-Circumvention Design Review for Gatekeeper Product Changes](https://www.sorena.io/artifacts/eu/digital-markets-act/anti-circumvention-design-review.md): Review DMA Article 13 anti-circumvention risks in gatekeeper product, interface, contractual, commercial, and technical changes with obligation mapping and evidence records. - [EU DMA Applicability Test: gatekeeper thresholds, core platform services, and evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/applicability-test.md): Test whether the EU Digital Markets Act may apply to a platform service using the DMA gatekeeper criteria, core platform service categories, EU user thresholds, notification steps, and evidence records. - [EU DMA Article 11 Compliance Reporting Guide](https://www.sorena.io/artifacts/eu/digital-markets-act/article-11-reporting.md): Official source guide to EU Digital Markets Act Article 11 compliance reports: report purpose, template evidence, non-confidential summaries, annual updates, and submission steps. - [DMA Article 6(7) and Article 7 interoperability obligations](https://www.sorena.io/artifacts/eu/digital-markets-act/article-6-7-interoperability.md): Official source guide to DMA interoperability duties: Article 6(7) operating-system feature access, Article 7 messaging interoperability, request handling, security conditions, and compliance evidence. - [DMA Article 6 Business User Data Access Guide](https://www.sorena.io/artifacts/eu/digital-markets-act/business-user-data-access.md): Official source guide to EU Digital Markets Act Article 6 data access for business users, end users, authorised third parties, consent boundaries, and evidence handoffs. - [EU Digital Markets Act checklist for gatekeeper compliance](https://www.sorena.io/artifacts/eu/digital-markets-act/checklist.md): An official source DMA checklist for designated gatekeepers and core platform services, covering scope, Articles 5, 6 and 7 obligations, Article 11 reporting, evidence, anti-circumvention, and governance. - [DMA compliance program and monitoring for gatekeepers](https://www.sorena.io/artifacts/eu/digital-markets-act/compliance-program-and-monitoring.md): Build a DMA compliance program around Article 8 effective compliance, Article 11 reporting evidence, Article 13 anti-circumvention controls, and Article 28 compliance-function governance. - [EU Digital Markets Act compliance: gatekeeper obligations and evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/compliance.md): DMA compliance guide for designated gatekeepers: core platform service scoping, Articles 5, 6 and 7 controls, Article 11 reports, anti-circumvention checks, interoperability evidence, and enforcement risk. - [DMA Articles 5, 6 and 7 obligations mapped to CPS evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/core-obligations-by-obligation.md): Map EU Digital Markets Act Articles 5, 6 and 7 obligations to affected core platform services, product evidence, legal owners, and Article 11 compliance-report artifacts. - [DMA Core Platform Service Scoping](https://www.sorena.io/artifacts/eu/digital-markets-act/core-platform-service-scoping-by-service.md): Scope EU Digital Markets Act core platform services by service category, designation evidence, user thresholds, and Form GD service-boundary records. - [DMA CPS Obligation Matrix Workflow: Articles 5, 6, 7 and Article 11 Evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/cps-obligation-matrix-workflow.md): Build a DMA core platform service obligation matrix that links each designated CPS to Articles 5, 6 and 7 duties, product owners, designation evidence, Article 11 report artifacts and review gates. - [EU Digital Markets Act deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/digital-markets-act/deadlines-and-compliance-calendar.md): Track DMA notification, designation, six-month obligation start, Article 11 reporting, Article 14 concentration notices, Article 15 profiling audits, and preparation milestones using official EU sources. - [DMA designation intake workflow for gatekeeper notifications](https://www.sorena.io/artifacts/eu/digital-markets-act/designation-intake-workflow.md): Build an official source DMA designation intake record covering core platform service classification, Article 3 thresholds, Form GD evidence, Commission handoff, and Article 11 readiness. - [DMA vs Data Act: gatekeeper duties compared with EU data-sharing rules](https://www.sorena.io/artifacts/eu/digital-markets-act/dma-vs-data-act.md): Compare the EU Digital Markets Act and EU Data Act by scope, actors, data access, interoperability, reporting, evidence, and enforcement without merging distinct obligations. - [DMA vs DSA: Digital Markets vs Services Act](https://www.sorena.io/artifacts/eu/digital-markets-act/dma-vs-dsa.md): A cited-source comparison of the DMA and DSA focused on gatekeepers, core platform services, DMA obligations, Article 11 reporting, interoperability, data access, and enforcement. - [DMA vs EU competition law: gatekeeper obligations, Article 11 evidence, and enforcement](https://www.sorena.io/artifacts/eu/digital-markets-act/dma-vs-eu-competition-law.md): Compare the EU Digital Markets Act with EU competition law: ex ante gatekeeper and core platform service duties, Articles 5 to 7, Article 11 reports, penalties, and evidence records. - [DMA vs GDPR: gatekeeper data obligations compared](https://www.sorena.io/artifacts/eu/digital-markets-act/dma-vs-gdpr.md): Compare DMA gatekeeper obligations with high-level GDPR overlap for consent, combining personal data, data access, portability, and Article 11 reporting. - [EU DMA do's and don'ts for product teams](https://www.sorena.io/artifacts/eu/digital-markets-act/dos-and-donts-for-product-teams.md): Product release checks for designated DMA gatekeepers: Article 5, 6 and 7 obligations, anti-circumvention review, data access, interoperability, self-preferencing and Article 11 evidence. - [DMA enforcement, penalties, and remedies: Commission powers and evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/enforcement-penalties-and-remedies.md): EU Digital Markets Act enforcement guide covering Commission non-compliance decisions, DMA fine caps, periodic penalty payments, remedies, interim measures, commitments, and Article 11 evidence. - [What do DMA Articles 5, 6, and 7 require from gatekeepers?](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/articles-5-6-and-7-obligations.md): FAQ explaining how EU Digital Markets Act Articles 5, 6, and 7 group gatekeeper obligations, what product evidence they require, and how Article 11 reporting connects. - [DMA Article 11 Compliance Report Template FAQ](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/compliance-report-template.md): How gatekeepers should use the DMA Article 11 compliance report template to document obligation-by-obligation measures, evidence, updates, and non-confidential summaries. - [DMA core platform services FAQ](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/core-platform-services.md): FAQ on EU Digital Markets Act core platform services: Article 2 service categories, gatekeeper designation evidence, user thresholds, service scoping, and Article 11 reporting. - [DMA gatekeeper thresholds: what counts and when to notify](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/gatekeeper-thresholds.md): Standalone FAQ on the EU Digital Markets Act gatekeeper thresholds, Article 3 notification timing, Form GD evidence, and active user-count methodology. - [DMA interoperability requests: Article 7 and Commission guidance](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/interoperability-requests.md): How EU Digital Markets Act interoperability requests work for Article 7 messaging services, Article 6(7) operating-system access, gatekeeper evidence, requester evidence, and security safeguards. - [EU Digital Markets Act FAQ: gatekeepers, DMA obligations, reports, and enforcement](https://www.sorena.io/artifacts/eu/digital-markets-act/faq.md): Concise FAQ on the EU Digital Markets Act for gatekeeper designation, core platform services, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, business-user data access, compliance evidence, and enforcement. - [DMA Gatekeeper Compliance Checklist for Articles 5, 6, 7 and 11](https://www.sorena.io/artifacts/eu/digital-markets-act/gatekeeper-compliance-checklist.md): A cited EU Digital Markets Act checklist for designated gatekeepers: core platform service scope, Article 5/6/7 controls, Article 11 report evidence, anti-circumvention checks, and review gates. - [DMA Gatekeeper Designation Guide: Article 3 thresholds, Form GD, and Article 11 readiness](https://www.sorena.io/artifacts/eu/digital-markets-act/gatekeeper-designation-guide.md): A cited EU Digital Markets Act guide for assessing Article 3 gatekeeper thresholds, scoping core platform services, preparing Form GD evidence, handling rebuttal annexes, and planning Article 11 compliance reporting. - [DMA penalties and fines: caps, triggers, and enforcement evidence](https://www.sorena.io/artifacts/eu/digital-markets-act/penalties-and-fines.md): EU Digital Markets Act penalties guide covering Article 30 fine caps, Article 31 periodic penalty payments, non-compliance decisions, remedies, and evidence records. - [DMA Product Change Review Workflow for Articles 5, 6, 7, 11 and 13](https://www.sorena.io/artifacts/eu/digital-markets-act/product-change-review-workflow.md): Review DMA-relevant product releases for Article 5, Article 6, Article 7, anti-circumvention, Article 11 evidence, and product-owner/legal signoff. - [EU Digital Markets Act requirements for gatekeepers](https://www.sorena.io/artifacts/eu/digital-markets-act/requirements.md): DMA requirements for designated gatekeepers: core platform service scope, Articles 5, 6 and 7 obligations, Article 11 reporting, anti-circumvention, evidence, remedies, and fines. - [DMA Self-Preferencing Compliance Examples for Ranking and Display](https://www.sorena.io/artifacts/eu/digital-markets-act/self-preferencing-compliance-examples.md): Examples and release-review controls for DMA Article 6(5) self-preferencing checks across ranking, indexing, crawling, search results, marketplaces, app stores, feeds, and virtual assistants. - [EU Digital Markets Act Timeline and Key Milestones: practical obligations and evidence guide](https://www.sorena.io/artifacts/eu/digital-markets-act/timeline-and-key-milestones.md): Practical EU Digital Markets Act guide to Timeline and Key Milestones: scope, owners, evidence, edge cases, checklist steps, and external cited citations. - [Annex III Data Model Planning for EU Digital Product Passports](https://www.sorena.io/artifacts/eu/digital-product-passport/annex-iii-data-model-planning.md): Plan EU Digital Product Passport data fields, identifiers, access rights, update owners, registry inputs, and evidence records against ESPR Annex III and product-specific delegated acts. - [EU Digital Product Passport API and resolver architecture](https://www.sorena.io/artifacts/eu/digital-product-passport/api-and-resolver-architecture.md): Official source DPP architecture guidance for data carriers, product identifiers, resolver lookup paths, access rights, registry integration, and interoperability without premature protocol mandates. - [EU Digital Product Passport Applicability Test](https://www.sorena.io/artifacts/eu/digital-product-passport/applicability-test.md): Check whether an ESPR delegated act or battery passport rule may require a Digital Product Passport, which operator owns it, and what evidence to keep. - [EU Digital Product Passport architecture and integration](https://www.sorena.io/artifacts/eu/digital-product-passport/architecture-and-integration.md): Official source guide to EU Digital Product Passport architecture: data carriers, identifiers, access rights, registry, portal, supplier flows, customs checks, and governance. - [EU Digital Product Passport checklist](https://www.sorena.io/artifacts/eu/digital-product-passport/checklist.md): A concrete EU Digital Product Passport readiness checklist covering product-group scope, passport fields, identifiers, data carriers, access rights, supplier evidence, registry preparation, and publication controls. - [EU Digital Product Passport compliance: ESPR requirements](https://www.sorena.io/artifacts/eu/digital-product-passport/compliance.md): Official source EU Digital Product Passport compliance guide covering ESPR passport data, identifiers, data carriers, access rights, registry readiness, supplier validation, and evidence. - [DPP customs access review workflow for ESPR products](https://www.sorena.io/artifacts/eu/digital-product-passport/customs-access-review-workflow.md): Review public, restricted, and customs access for EU Digital Product Passports, including registry handoffs, portal access rights, and release-for-free-circulation evidence. - [EU Digital Product Passport Data Carriers, Access Control, and UX](https://www.sorena.io/artifacts/eu/digital-product-passport/data-carriers-access-control-and-ux.md): How to choose DPP data carriers, identifiers, access rights, and scanning UX under ESPR Articles 9-14, with QR, NFC, RFID, registry, and customs constraints. - [EU Digital Product Passport data requirements and fields](https://www.sorena.io/artifacts/eu/digital-product-passport/data-requirements-and-fields.md): How to plan Digital Product Passport data fields under ESPR: delegated-act scope, Annex III data categories, access rights, customs data, and supplier validation. - [EU Digital Product Passport deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/digital-product-passport/deadlines-and-compliance-calendar.md): Official source EU Digital Product Passport calendar for ESPR and battery passport milestones, with product-group dates flagged as dependent on delegated acts. - [DPP Data Governance RACI Template for EU Digital Product Passports](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-data-governance-raci-template.md): Assign accountable owners for EU Digital Product Passport data, access rights, supplier inputs, resolver links, registry uploads, verification checks, and retained evidence. - [DPP data-model intake workflow for EU Digital Product Passports](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-data-model-intake-workflow.md): A based ontake workflow for EU Digital Product Passport data models: product group, delegated-act status, source owner, supplier data, access class, identifiers, carrier, checks, and publication readiness. - [EU DPP QR Code and Data Carrier Implementation Guide](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-qr-code-implementation-guide.md): Official source guidance for using QR codes and other data carriers in EU Digital Product Passport programs, including unique identifiers, access, resolver testing, and evidence. - [DPP registry and web portal integration under EU ESPR](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-registry-and-web-portal-integration.md): Official source guide to EU Digital Product Passport registry and web portal integration under ESPR, covering identifiers, data carriers, access rights, service providers, and lookup design. - [DPP vs Battery Passport: ESPR and Battery Regulation Comparison](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-vs-battery-passport.md): Compare the ESPR Digital Product Passport framework with the EU Batteries Regulation battery passport by scope, timing, data, access rights, identifiers, registry, governance, and evidence. - [Digital Product Passport vs Digital Twin](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-vs-digital-twin.md): Compare EU Digital Product Passports with digital twins: legal access duties, identifiers, public and restricted data, evidence, governance, and reuse limits. - [DPP vs EPREL Comparison](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-vs-eprel.md): Compare the EU Digital Product Passport with EPREL: product-passport scope, energy-label database role, access model, identifiers, data carriers, and overlap limits. - [DPP vs GS1 Digital Link: Duties vs Standard](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-vs-gs1-digital-link.md): Compare EU Digital Product Passport requirements with GS1 Digital Link: legal scope, identifiers, data carriers, access rights, registry, portal, customs checks, and implementation consequences. - [Digital Product Passport vs Paper Product Passports](https://www.sorena.io/artifacts/eu/digital-product-passport/dpp-vs-traditional-product-passports.md): Compare EU regulated digital product passports with paper, PDF, web, and internal product passports across access, identifiers, data carriers, restricted data, customs checks, registry, and interoperability. - [EU DPP customs access: registry, portal, and restricted data](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/customs-access.md): FAQ on customs access under the EU Digital Product Passport: what customs can verify, how the registry and public portal differ, and how access rights limit DPP data. - [What is the EU Digital Product Passport registry?](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/dpp-registry.md): FAQ on the ESPR Digital Product Passport registry: what it stores, who uploads data, how identifiers work, and what teams should avoid assuming. - [Public vs restricted EU Digital Product Passport data](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/public-vs-restricted-passport-data.md): How to separate public, restricted, authority, and customs access in EU Digital Product Passport designs under ESPR and battery passport rules. - [DPP QR code vs NFC data carrier choices under EU ESPR](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/qr-code-vs-nfc-carrier-choices.md): How to choose QR code, NFC, or another data carrier for an EU Digital Product Passport without assuming ESPR mandates one universal carrier. - [EU DPP unique identifier requirements: product, operator and facility IDs](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/unique-identifier-requirements.md): FAQ on how ESPR Digital Product Passport identifiers connect products, economic operators, facilities, data carriers, resolvers and registry evidence. - [Which products come first for the EU Digital Product Passport?](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/which-products-come-first.md): FAQ on EU Digital Product Passport product priority: batteries have a separate passport rule, while ESPR product groups depend on the working plan and delegated acts. - [Who must create an EU Digital Product Passport?](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/who-must-create-a-digital-product-passport.md): DPP responsibility under the EU ESPR: how manufacturers, importers, distributors, suppliers, service providers, and delegated acts fit together. - [EU Digital Product Passport FAQ](https://www.sorena.io/artifacts/eu/digital-product-passport/faq.md): Direct answers on EU Digital Product Passport scope, creators, product groups, registry, customs checks, access rights, identifiers, data carriers, and governance. - [DPP Governance, Verification and Audit Controls](https://www.sorena.io/artifacts/eu/digital-product-passport/governance-verification-and-audit.md): Build EU Digital Product Passport governance controls for data owners, supplier evidence, access logs, validation checks, audit records, and product release gates. - [EU DPP implementation playbook and vendor selection](https://www.sorena.io/artifacts/eu/digital-product-passport/implementation-playbook-and-vendor-selection.md): Select Digital Product Passport vendors against ESPR requirements for identifiers, data carriers, access rights, decentralized storage, registry readiness, portal access, and verification evidence. - [EU Digital Product Passport penalties and enforcement](https://www.sorena.io/artifacts/eu/digital-product-passport/penalties-and-fines.md): What ESPR says about Digital Product Passport penalties, Member State fine rules, market surveillance, customs checks, and unresolved product-specific delegated acts. - [EU DPP Product-Group Readiness Checklist](https://www.sorena.io/artifacts/eu/digital-product-passport/product-group-readiness-checklist.md): An official source checklist for preparing a product group for an EU Digital Product Passport delegated act, covering data fields, suppliers, identifiers, carriers, access rights, and registry readiness. - [EU Digital Product Passport Product Group Readiness](https://www.sorena.io/artifacts/eu/digital-product-passport/product-group-readiness.md): Prepare product groups for EU Digital Product Passport rules by tracking ESPR delegated-act status, data fields, suppliers, identifiers, access rights, and registry handoffs. - [EU Digital Product Passport access: public, restricted, and customs views](https://www.sorena.io/artifacts/eu/digital-product-passport/public-restricted-and-customs-access.md): How ESPR Digital Product Passport access should be split across public users, restricted actors, authorities, customs, the EU registry, and the web portal. - [EU Digital Product Passport requirements under ESPR](https://www.sorena.io/artifacts/eu/digital-product-passport/requirements.md): cited overview of EU Digital Product Passport requirements under ESPR: product-specific delegated acts, data fields, identifiers, carriers, registry, access rights, supplier data validation, and open points. - [EU DPP supplier data validation workflow](https://www.sorena.io/artifacts/eu/digital-product-passport/supplier-data-validation-workflow.md): An official source workflow for checking supplier data before it is used in an EU Digital Product Passport, covering product linkage, evidence, owners, access class, and approval records. - [EU Digital Product Passport supplier data validation controls](https://www.sorena.io/artifacts/eu/digital-product-passport/supplier-data-validation.md): Build a supplier data validation file for EU Digital Product Passports: source owner, product link, access class, data model fit, evidence quality, approval record, and release gate. - [EU Digital Product Passport identifier and data carrier design](https://www.sorena.io/artifacts/eu/digital-product-passport/unique-identifier-and-data-carrier-design.md): How to design Digital Product Passport identifiers, QR or other data carriers, resolver links, registry records, access paths, and evidence without overclaiming the EU rules. - [What is a Digital Product Passport under ESPR?](https://www.sorena.io/artifacts/eu/digital-product-passport/what-is-a-dpp.md): A visitor-friendly explanation of EU Digital Product Passports under ESPR: product data, identifiers, data carriers, access rights, registry, web portal, and delegated acts. - [DSA Ads and Recommender Systems: transparency duties, user choice, and evidence](https://www.sorena.io/artifacts/eu/digital-services-act/ads-and-recommender-systems.md): An official source DSA guide to ad labels, targeting restrictions, recommender parameter disclosure, non-profiling options for VLOPs and VLOSEs, ad repositories, and compliance evidence. - [DSA Applicability Test: classify intermediary services, platforms, marketplaces, VLOPs and VLOSEs](https://www.sorena.io/artifacts/eu/digital-services-act/applicability-test.md): A cited EU Digital Services Act applicability test for classifying intermediary services, hosting services, online platforms, marketplaces, VLOPs and VLOSEs. - [EU Digital Services Act checklist for platforms and hosting services](https://www.sorena.io/artifacts/eu/digital-services-act/checklist.md): An official source DSA checklist for classifying service tiers, notice-and-action, statements of reasons, complaints, transparency reports, ads, recommenders, trader traceability, VLOP/VLOSE duties, and evidence records. - [DSA Complaint and Dispute Workflows for Online Platforms](https://www.sorena.io/artifacts/eu/digital-services-act/complaint-and-dispute-workflows.md): Build DSA complaint, appeal, statement-of-reasons, and out-of-court dispute workflows for online platform moderation decisions. - [EU Digital Services Act Compliance Guide](https://www.sorena.io/artifacts/eu/digital-services-act/compliance.md): DSA compliance guide for intermediary services, hosting providers, online platforms, marketplaces, and VLOP/VLOSE teams: obligations, controls, and evidence to keep. - [DSA crisis response for VLOPs and VLOSEs](https://www.sorena.io/artifacts/eu/digital-services-act/crisis-response.md): EU Digital Services Act crisis response guide for VLOPs and VLOSEs: Article 36 Commission decisions, Article 48 crisis protocols, mitigation, governance, requests for information, and records. - [DSA Dark Patterns: interface design checks for online platforms](https://www.sorena.io/artifacts/eu/digital-services-act/dark-patterns.md): Article 25 DSA guidance for reviewing online platform interfaces for deceptive, manipulative, or choice-distorting design patterns. - [EU DSA deadlines and compliance calendar: application dates, reporting cycles, and VLOP clocks](https://www.sorena.io/artifacts/eu/digital-services-act/deadlines-and-compliance-calendar.md): Calendar view of cited EU Digital Services Act dates: full application, user-number publication, VLOP/VLOSE designation clocks, statements of reasons, and transparency reporting cycles. - [DSA transparency report template fields and cadence](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-transparency-report-template.md): An official source template outline for Digital Services Act transparency reports, covering applicable service tiers, reporting periods, CSV/XLSX format, retention, statement-of-reasons links, and required evidence tables. - [DSA vs DMA Platform Rules](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-vs-dma.md): Compare the EU Digital Services Act and Digital Markets Act by scope, designation thresholds, obligations, enforcement, evidence, and practical team ownership. - [DSA vs GDPR: online-platform governance and personal-data obligations](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-vs-gdpr.md): Compare the EU Digital Services Act and EU GDPR by scope, ads, recommenders, minors, transparency, complaints, enforcement, and evidence. - [DSA vs P2B Regulation: EU platform obligations compared](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-vs-p2b.md): Compare the EU Digital Services Act with the Platform-to-Business Regulation for platform scope, business-user terms, content moderation, ranking transparency, complaints, enforcement, and evidence. - [DSA vs Terrorist Content Online Regulation: notice-and-action vs removal orders](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-vs-terrorist-content-online-regulation.md): Compare DSA content-governance duties with the EU Terrorist Content Online Regulation removal-order workflow for scope, timing, evidence, authorities, and team ownership. - [EU DSA vs UK Online Safety Act: scope, duties, regulator, and evidence](https://www.sorena.io/artifacts/eu/digital-services-act/dsa-vs-uk-online-safety-act.md): Compare the EU Digital Services Act and UK Online Safety Act for platform scope, risk assessments, child protection, transparency, regulators, enforcement, and owners. - [DSA Enforcement and Penalties in the EU](https://www.sorena.io/artifacts/eu/digital-services-act/enforcement-penalties-and-investigations.md): How Digital Services Act enforcement works: Commission and Digital Services Coordinator roles, VLOP and VLOSE investigations, fines, periodic penalty payments, and evidence readiness. - [DSA average monthly active recipients: what platforms must publish](https://www.sorena.io/artifacts/eu/digital-services-act/faq/average-monthly-active-recipients.md): An official source FAQ on average monthly active recipients under the EU Digital Services Act, including publication, EU recipient scope, the 45 million VLOP/VLOSE threshold, and evidence records. - [DSA illegal content notices: what must be included?](https://www.sorena.io/artifacts/eu/digital-services-act/faq/illegal-content-notice.md): An official source FAQ on EU Digital Services Act illegal-content notices: Article 16 notice elements, acknowledgement, decision notices, trusted flagger priority, statements of reasons, and records. - [DSA Marketplace Trader Traceability FAQ](https://www.sorena.io/artifacts/eu/digital-services-act/faq/marketplace-trader-traceability.md): Answer to what EU Digital Services Act Article 30 requires online marketplaces to collect, verify, display, retain, and evidence for trader traceability. - [DSA recommender transparency FAQ: Article 27 and VLOP options](https://www.sorena.io/artifacts/eu/digital-services-act/faq/recommender-transparency.md): What EU Digital Services Act recommender transparency requires: main parameters, user options, VLOP/VLOSE non-profiling choices, and evidence to keep. - [DSA statement of reasons FAQ](https://www.sorena.io/artifacts/eu/digital-services-act/faq/statement-of-reasons.md): When DSA statements of reasons are required, what they must contain, when online platforms submit them to the DSA Transparency Database, and what appeal records to keep. - [DSA VLOP Risk Assessment FAQ: Article 34, Mitigation, Audits](https://www.sorena.io/artifacts/eu/digital-services-act/faq/vlop-risk-assessment.md): What VLOPs and VLOSEs must assess under the EU Digital Services Act, when to reassess, how Article 35 mitigation and annual audit evidence fit together, and what records to keep. - [EU Digital Services Act FAQ: DSA scope, platform duties, VLOPs, reports, and penalties](https://www.sorena.io/artifacts/eu/digital-services-act/faq.md): Concise EU Digital Services Act FAQ covering intermediary-service scope, active-recipient thresholds, illegal-content notices, statements of reasons, trader traceability, recommender transparency, systemic-risk duties, reporting, penalties, and complaints. - [DSA Marketplace Trader Traceability Guide](https://www.sorena.io/artifacts/eu/digital-services-act/marketplace-trader-traceability.md): EU Digital Services Act guide for online marketplaces collecting, checking, displaying, storing, and evidencing trader traceability information. - [DSA Article 28 minors protection guide for online platforms](https://www.sorena.io/artifacts/eu/digital-services-act/minors-protection.md): EU Digital Services Act guide to Article 28 minors protection: platform scope, child-safety measures, targeted ads limits, recommender controls, and official source evidence. - [DSA notice and action plus statements of reasons guide](https://www.sorena.io/artifacts/eu/digital-services-act/notice-and-action-plus-statements-of-reasons.md): An official source Digital Services Act guide for notice intake, moderation decisions, statements of reasons, DSA Transparency Database submission, complaints, appeals, trusted flaggers, and records. - [DSA Notice and Action Workflow for Hosting Services and Online Platforms](https://www.sorena.io/artifacts/eu/digital-services-act/notice-and-action-workflow.md): An official source DSA notice-and-action workflow covering notice intake, completeness checks, trusted flaggers, decisions, user communications, statements of reasons, appeals, and records. - [EU Digital Services Act penalties and fines: caps and enforcement roles](https://www.sorena.io/artifacts/eu/digital-services-act/penalties-and-fines.md): DSA penalty caps and enforcement roles: Member State fines, Commission fines for VLOPs and VLOSEs, 1% procedural fines, and 5% periodic penalty payments. - [EU Digital Services Act requirements by service tier](https://www.sorena.io/artifacts/eu/digital-services-act/requirements.md): Overview of DSA obligations for intermediary services, hosting providers, online platforms, marketplaces, VLOPs and VLOSEs, including notices, complaints, ads, transparency reports, audits, data access and enforcement. - [DSA researcher data access for VLOPs and VLOSEs](https://www.sorena.io/artifacts/eu/digital-services-act/researcher-data-access.md): Article 40 DSA guide to vetted researcher data access for VLOPs and VLOSEs: DSC requests, eligibility checks, amendment grounds, confidentiality, security, and evidence records. - [DSA VLOP and VLOSE Risk Assessments and Mitigation Guide](https://www.sorena.io/artifacts/eu/digital-services-act/risk-assessments-and-mitigation.md): Official source guide to Digital Services Act systemic risk assessments, mitigation measures, audits, transparency reports, data access, and governance evidence for VLOPs and VLOSEs. - [DSA service tier classifier for platforms, marketplaces, VLOPs and VLOSEs](https://www.sorena.io/artifacts/eu/digital-services-act/service-tier-classifier-workflow.md): Classify a digital service under the EU Digital Services Act as intermediary, hosting, online platform, marketplace, VLOP or VLOSE, with EU recipient-count evidence and obligation outputs. - [EU Digital Services Act service types and scope](https://www.sorena.io/artifacts/eu/digital-services-act/service-types-and-scope.md): Classify DSA service scope across mere conduit, caching, hosting, online platforms, marketplaces, online search engines, and VLOP/VLOSE threshold duties. - [DSA statement of reasons log workflow for online platforms](https://www.sorena.io/artifacts/eu/digital-services-act/statement-of-reasons-log-workflow.md): Build a DSA statement of reasons log for moderation decisions, Transparency Database submission, complaint links, retention, and QA controls. - [EU DSA Transparency Calendar: reporting, SoR database, AMAR updates](https://www.sorena.io/artifacts/eu/digital-services-act/transparency-calendar.md): Build a DSA transparency calendar for annual reports, statement-of-reasons database submissions, active-recipient updates, and VLOP/VLOSE audit touchpoints. - [DSA Transparency Reporting Obligations by Provider Tier](https://www.sorena.io/artifacts/eu/digital-services-act/transparency-reporting.md): An official source guide to EU Digital Services Act transparency reports, active-recipient publication, statements-of-reasons submissions, VLOP/VLOSE reports, templates, cadence, and evidence. - [DSA VLOP Audit Pack Workflow: Risk, Mitigation, Audit, and Transparency Records](https://www.sorena.io/artifacts/eu/digital-services-act/vlop-audit-pack-workflow.md): Build a DSA VLOP or VLOSE audit pack covering Article 34 risk assessments, Article 35 mitigations, independent-audit evidence, transparency reports, data access, and compliance governance. - [EU DORA Applicability Test for Financial Entities and ICT Providers](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/applicability-test.md): An official source DORA applicability test for financial-entity scope, ICT third-party services, critical or important functions, exclusions, proportionality, and evidence. - [EU DORA Compliance Checklist for Financial Entities](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/checklist.md): An official source DORA checklist covering ICT risk governance, major incident reporting, resilience testing, TLPT, ICT third-party contracts, register-of-information records, and audit evidence. - [EU DORA Compliance Obligations and Evidence Guide](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/compliance.md): An official source DORA compliance guide covering ICT risk management, incident reporting, resilience testing, TLPT, ICT third-party risk, registers, governance, oversight, and evidence. - [DORA ICT Third-Party Contract Remediation Workflow](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/contract-remediation-workflow.md): A DORA workflow for remediating ICT third-party contracts covering critical or important functions, subcontracting, audit rights, exits, register updates, and evidence. - [DORA Critical or Important Functions: mapping ICT dependencies and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/critical-and-important-functions.md): How DORA critical or important functions affect ICT service mapping, third-party contracts, register-of-information records, incidents, testing, and evidence. - [DORA deadlines and compliance calendar for financial entities](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/deadlines-and-compliance-calendar.md): Calendar the official source DORA dates and recurring evidence: 17 January 2025 application, incident reporting clocks, register updates, annual reporting, TLPT cadence, and CTPP oversight milestones. - [DORA Register of Information Template: ICT Provider Fields and Evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-register-of-information-template.md): An official source DORA register of information template for ICT third-party contracts, provider hierarchy, critical functions, dates, statuses, reporting, and evidence. - [DORA vs EBA outsourcing guidelines: ICT third-party risk comparison](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-vs-eba-outsourcing-guidelines.md): Compare binding DORA ICT third-party risk duties with the EBA/ESA outsourcing baseline for registers, critical functions, contracts, subcontracting, exit, incident reporting, and evidence. - [DORA vs ISO 22301: ICT resilience and business continuity compared](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-vs-iso-22301.md): Compare DORA's binding ICT operational resilience duties for financial entities with ISO 22301's business continuity management system requirements. - [DORA vs ISO/IEC 27001: legal ICT resilience obligations and ISMS controls](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-vs-iso-27001.md): Compare EU DORA and ISO/IEC 27001 across scope, governance, incident reporting, testing, ICT third-party risk, certification, evidence, overlap, and gaps. - [DORA vs NIS2: financial-sector obligations, overlap, and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-vs-nis2.md): Compare DORA and NIS2 for financial entities, ICT providers, incident reporting, management accountability, third-party risk, supervisory routes, and reusable evidence. - [DORA vs PSD2 incident reporting: major ICT and payment incidents](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/dora-vs-psd2-incident-reporting.md): Compare DORA major ICT-related incident reporting with PSD2 major operational or security payment incident reporting, including scope, triggers, report stages, recipients, and evidence. - [DORA ICT Third-Party Contracts FAQ](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/ict-third-party-contracts.md): What DORA requires in ICT third-party contracts, including critical or important functions, audit and access rights, termination, exit, subcontracting, register updates, and evidence. - [DORA major ICT incident thresholds: what triggers reporting?](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/major-incident-thresholds.md): FAQ on DORA major ICT-related incident classification thresholds, recurring incidents, reporting triggers, and evidence inputs based on EU DORA RTS and ITS texts. - [How does proportionality work under EU DORA?](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/proportionality.md): An official source FAQ on DORA proportionality: what can be scaled, who may use the simplified ICT risk framework, what evidence supports the decision, and which duties cannot be waived. - [DORA Register of Information FAQ: ICT Third-Party Arrangements](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/register-of-information.md): FAQ on the DORA register of information: who maintains it, which ICT third-party arrangements it covers, template fields, critical functions, reporting, data quality, and evidence. - [DORA TLPT selection: who can be required to test?](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/tlpt-selection.md): FAQ on DORA threat-led penetration testing selection: who identifies financial entities, what criteria are used, what the TLPT authority validates, and what evidence to keep. - [EU DORA FAQ: scope, incidents, ICT contracts, testing, and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq.md): Concise DORA FAQ covering who is in scope, proportionality, ICT third-party contracts, register-of-information records, major ICT incident thresholds and reporting, TLPT, testing, enforcement, and evidence. - [EU DORA ICT risk management control baseline](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/ict-risk-management-control-baseline.md): An official source DORA control baseline for ICT risk governance, asset and dependency mapping, protection, detection, response, recovery, testing, third-party risk, and evidence. - [DORA incident classification forms: criteria, fields, and reporting clocks](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/incident-classification-forms.md): Official source guide to DORA ICT incident classification forms: major-incident criteria, significant cyber-threat notifications, report fields, time limits, evidence, and reclassification records. - [DORA incident clock workflow: classification, reports, deadlines, and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/incident-clock-workflow.md): Official source DORA workflow for starting the major-incident reporting clock, classifying ICT incidents, submitting initial, intermediate, and final reports, and preserving authority evidence. - [DORA major ICT incident reporting: classification, reports, and timing](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/major-incident-reporting.md): Official source DORA guide to major ICT-related incident classification, initial notifications, intermediate and final reports, competent authority routing, and significant cyber threat notifications. - [EU DORA penalties and fines: enforcement powers and limits](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/penalties-and-fines.md): Official source guide to DORA enforcement: competent-authority powers, administrative penalties, remedial measures, publication rules, and Lead Overseer penalty payments for critical ICT third-party providers. - [EU DORA Register of Information Data Model: templates, fields, and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/register-of-information-data-model.md): Field-level guide to the EU DORA register of information data model: templates B_01 to B_07, provider identifiers, contract links, subcontracting chains, critical-function assessments, dates, and export evidence. - [How to build a DORA register of information](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/register-of-information-how-to-build.md): Build a DORA register of information from contracts, ICT services, providers, functions, subcontractors, risk assessments, audit evidence, exit plans, and export checks. - [EU DORA Requirements Overview: ICT risk, incidents, testing, and third-party risk](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/requirements.md): An official source overview of the main EU DORA requirements for financial entities: governance, ICT risk management, incident reporting, resilience testing, TLPT, ICT third-party risk, register of information, oversight, proportionality, and evidence. - [DORA Register of Information Import and Build Workflow](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/roi-import-and-build-workflow.md): Build a DORA register of information from procurement, vendor, contract, service, function, and subcontractor data using the official register templates and validation checks. - [EU DORA Scope and Covered Entities: financial entities and ICT providers](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/scope-and-covered-entities.md): Classify whether DORA applies to a financial entity, ICT third-party provider, group arrangement, branch, or critical ICT service dependency. - [EU DORA Scope and Proportionality Workflow](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/scope-and-proportionality-workflow.md): Classify DORA covered entities, simplified-framework status, critical or important functions, ICT dependencies, evidence records, and governance approvals. - [EU DORA ICT subcontracting chain controls for critical functions](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/subcontracting-chain-controls.md): DORA guide to ICT subcontracting chains for critical or important functions: prior assessment, contract conditions, register fields, monitoring, exit rights, and evidence. - [EU DORA testing and TLPT readiness guide](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/testing-and-tlpt-readiness.md): An official source DORA guide for resilience testing, TLPT eligibility, authority interaction, test evidence, remediation plans, and avoiding unsupported testing cadence. - [DORA ICT third-party risk and contract clauses guide](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/third-party-risk-and-contract-clauses.md): Official source DORA guide for financial entities in scope, ICT third-party risk, contract clauses, subcontracting controls, register evidence, audit rights, exit planning, and oversight. - [EU DORA TLPT eligibility workflow for financial entities](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/tlpt-eligibility-workflow.md): Check how DORA TLPT authorities identify financial entities for threat-led penetration testing and what evidence supports scope, readiness, providers, and governance. - [EU DORA TLPT Runbook: scope, providers, reports, and remediation](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/tlpt-runbook.md): Build a DORA threat-led penetration testing runbook around authority coordination, scope validation, provider controls, active testing, closure reports, remediation, and attestation. - [EU eIDAS Applicability Test for Trust Services, Wallets, and Certificates](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/applicability-test.md): An official source eIDAS scope test for QTSPs, trust services, electronic signatures, seals, timestamps, QWACs, EUDI Wallet relying parties, and cross-border recognition evidence. - [eIDAS Certificates and Authentication: qualified certificates, QWACs, and validation checks](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/certificates-and-authentication.md): Official source guide to eIDAS qualified certificates, website authentication certificates, trusted lists, relying-party checks, and validation evidence. - [eIDAS checklist and evidence pack for trust services, signatures, and EUDI Wallet relying parties](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/checklist-and-evidence.md): Build an eIDAS evidence pack for qualified trust services, electronic signatures, trusted-list checks, certificate validation, supervisory records, and EUDI Wallet relying-party controls. - [EU eIDAS checklist for signatures, trust services, and wallets](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/checklist.md): Checklist for eIDAS trust-service and EUDI Wallet controls: qualified status, trusted lists, certificates, signatures, seals, timestamps, validation evidence, and relying-party records. - [eIDAS compliance guide for trust services, QTSPs, signatures, and EUDI Wallet relying parties](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/compliance.md): Official source eIDAS compliance guide for trust-service classification, QTSP supervision evidence, qualified signatures, seals, time stamps, certificates, trusted-list validation, and EUDI Wallet relying-party records. - [eIDAS 2 deadlines and compliance calendar for EUDI Wallet and trust services](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/deadlines-and-compliance-calendar.md): Calendar of official source eIDAS and eIDAS 2 milestones for EUDI Wallet delivery, implementing acts, annual supervision reports, QTSP transitions, pilots, and ARF evidence. - [eIDAS vs ESIGN and UETA: EU qualified signatures vs U.S. e-signature laws](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eidas-vs-esign-and-ueta.md): Compare eIDAS with ESIGN and UETA for electronic signatures, qualified certificates, trust services, cross-border recognition, validation evidence, and source gaps. - [eIDAS vs ETSI EN 319 401: legal supervision and TSP policy requirements](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eidas-vs-etsi-en-319-401.md): Compare eIDAS and ETSI EN 319 401 for trust services: legal scope, QTSP supervision, conformity assessment, audits, incident evidence, and operational controls. - [eIDAS vs GDPR for identity data: wallet, trust-service, and privacy obligations](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eidas-vs-gdpr-identity-data.md): Compare eIDAS identity, trust-service, and EUDI Wallet rules with GDPR duties for personal-data processing, minimisation, lawful basis, evidence, security, and user rights. - [eIDAS vs NIS2 for trust service providers: QTSP and cybersecurity obligations](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eidas-vs-nis2-trust-services.md): Compare eIDAS trust-service and QTSP duties with NIS2 cybersecurity risk-management, incident reporting, supervision, and evidence duties for trust service providers. - [eIDAS 2.0 vs eIDAS: EUDI Wallet and trust-service changes](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eidas2-vs-eidas.md): Compare the original eIDAS electronic identification and trust-service framework with the eIDAS 2.0 amendments for EUDI Wallets, relying parties, attestations, QWACs, and supervision. - [Electronic Attestations of Attributes under EU eIDAS: EAA, QEAA, issuers, wallets, and validation](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/electronic-attestations-of-attributes.md): Official source guide to electronic attestations of attributes under amended EU eIDAS: EAA, QEAA, public-sector authentic-source attestations, wallet use, issuer checks, relying-party validation, revocation, and legal effect. - [eIDAS electronic signatures: SES, AES, QES legal effect and evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/electronic-signatures-and-legal-effect.md): An official source guide to eIDAS electronic-signature legal effect: SES, AES, QES, qualified certificates, QTSP trusted-list checks, validation, recognition, and evidence records. - [EUDI Wallet readiness for service providers under eIDAS](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eudi-wallet-readiness.md): Readiness guide for organisations preparing to request or verify data from European Digital Identity Wallets: roles, registration, ARF alignment, selective disclosure, implementing acts, and evidence. - [EUDI Wallet Relying Party Registration Under eIDAS](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eudi-wallet-relying-party-registration.md): What eIDAS Article 5b and the EUDI Wallet ARF say about wallet relying party registration, intended uses, attribute requests, certificates, evidence, and Member State gaps. - [EUDI Wallet Technical Architecture Guide under eIDAS](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/eudi-wallet-technical-architecture-guide.md): Technical guide to the EUDI Wallet architecture: ARF roles, wallet units, PID and attestations, relying parties, trust model, certificates, protocols, privacy, and security controls. - [EU eIDAS attribute attestations: EAA, QEAA, wallet, and relying party checks](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/attribute-attestations.md): What electronic attestations of attributes mean under eIDAS, how QEAAs differ from public-sector and non-qualified attestations, and what issuers, wallets, and relying parties should verify. - [EUDI Wallet Relying Parties under eIDAS](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/eudi-wallet-relying-party.md): What EUDI Wallet relying parties must do under eIDAS: register, declare intended wallet use and requested data, identify themselves to users, and keep request evidence. - [QES vs AdES under EU eIDAS: legal effect, certificates, QTSPs, and validation evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qes-vs-ades.md): Compare qualified electronic signatures (QES) and advanced electronic signatures (AdES) under EU eIDAS, including legal effect, qualified certificates, QTSP status, QSCDs, and validation evidence. - [What is a qualified trust service provider under eIDAS?](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qualified-trust-service-provider.md): How to verify QTSP status under eIDAS using the qualified service, supervisory body decision, trusted list entry, conformity assessment evidence, and service-specific records. - [What is a QWAC under the EU eIDAS Regulation?](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/qwac.md): Plain-language FAQ on qualified website authentication certificates under eIDAS, including website identity, QTSP trusted-list checks, browser recognition, and validation evidence. - [EU eIDAS Trusted Lists FAQ: LOTL, QTSP status, and validation evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/trusted-lists.md): How EU eIDAS Trusted Lists and the Commission LOTL support QTSP and qualified trust-service validation, with practical evidence checks for relying parties. - [EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq.md): FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence. - [eIDAS penalties and fines for trust service providers](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/penalties-and-fines.md): Official source guide to eIDAS Article 16 penalties, administrative fine mechanics, supervisory bodies, qualified-status withdrawal, and trusted-list evidence. - [eIDAS QES validation checks for relying parties](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/qes-validation.md): How to validate a qualified electronic signature under eIDAS: certificate, QTSP, trusted-list, QSCD, integrity, validation result, and evidence records. - [EU eIDAS QTSP authorization and supervision guide](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/qtsp-authorization-and-supervision.md): How qualified trust service providers obtain and keep qualified status under eIDAS, including conformity assessment reports, supervision, trusted lists, incidents, and evidence. - [EU eIDAS QTSP Due Diligence Workflow for Trusted Lists, Certificates, and Evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/qtsp-due-diligence-workflow.md): Check a qualified trust service provider under eIDAS by validating trusted-list status, qualified service scope, certificates, policies, supervision, audits, and retained evidence. - [eIDAS Qualified Trust Services: QTSP Selection](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/qualified-trust-services-and-qtsp-selection.md): How to select an EU eIDAS qualified trust service provider: identify the qualified service type, verify trusted-list status, review supervision evidence, and retain certificate-policy records. - [QWACs under eIDAS: website authentication certificates](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/qwacs.md): An official source guide to qualified website authentication certificates under eIDAS, covering Annex IV data, trusted lists, browser recognition, validation evidence, and QTSP checks. - [eIDAS remote signature and cloud HSM controls for QTSPs](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/remote-signature-and-cloud-hsm-controls.md): Official source guide to eIDAS remote signature controls: remote QSCD scope, server-side signing, QTSP evidence, signer authentication, certificate validation, and trusted-list checks. - [EU eIDAS Requirements for Trust Services, Signatures, Seals, Wallets, and Evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/requirements.md): Official source guide to core eIDAS requirements for trust service providers, qualified trust services, electronic signatures, seals, time stamps, trusted lists, and EUDI Wallet relying parties. - [eIDAS signature legal effect selector: SES, AES, AES-QC, or QES](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/signature-legal-effect-selector-workflow.md): Select the right eIDAS signature level by legal effect, risk, qualified certificate status, QTSP evidence, QSCD use, validation result, and cross-border recognition. - [eIDAS trusted list validation: LOTL, QTSP status, and evidence](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/trust-list-validation.md): How to validate EU eIDAS trusted-list evidence: start from the Commission LOTL, confirm QTSP and qualified-service status, check certificate path and revocation data, and retain validation reports. - [eIDAS trust service role scoping workflow: TSP, QTSP, validator, relying party, or QTSP customer](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/trust-service-role-scoping-workflow.md): Classify an eIDAS role by evidence: trust service provider, qualified trust service provider, signature or seal validator, EUDI Wallet relying party, relying party, or customer of a QTSP. - [EUDI Wallet Relying Party Onboarding Workflow under eIDAS](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/wallet-onboarding-workflow.md): An official source onboarding workflow for organisations that want to request data from European Digital Identity Wallet users as eIDAS wallet relying parties. - [What eIDAS Covers: eID, Trust Services, EUDI Wallet, and QWACs](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/what-eidas-covers.md): An official source guide to the systems and services covered by EU eIDAS: notified electronic identification, trust services, signatures, seals, time stamps, registered delivery, website authentication, trusted lists, the EUDI Wallet, and attribute attestations. - [EU EMC Directive: Apparatus vs Fixed Installations](https://www.sorena.io/artifacts/eu/emc-directive/apparatus-vs-fixed-installations.md): Compare apparatus and fixed installations under Directive 2014/30/EU, including end-user scope, placing on the market, documentation, good engineering practice, and evidence differences. - [EMC Directive Applicability Test for EU Equipment](https://www.sorena.io/artifacts/eu/emc-directive/applicability-test.md): Test whether EU equipment is EMC Directive apparatus, a fixed installation, inherently benign, or covered by RED or other more specific Union legislation. - [EMC Directive compliance checklist](https://www.sorena.io/artifacts/eu/emc-directive/checklist.md): Checklist for Directive 2014/30/EU covering EMC scope, essential requirements, standards evidence, technical documentation, EU DoC, CE marking, operator checks, and post-market records. - [EMC Directive Compliance Pathway](https://www.sorena.io/artifacts/eu/emc-directive/compliance.md): Official source EU EMC Directive compliance pathway for apparatus: scope, essential requirements, conformity assessment, harmonised standards, technical documentation, EU DoC, CE marking, instructions, and retained evidence. - [EMC Directive Conformity Assessment and Technical Documentation](https://www.sorena.io/artifacts/eu/emc-directive/conformity-assessment-and-documentation.md): Official source guide to EMC Directive conformity assessment for apparatus: Annex II internal production control, optional Annex III EU-type examination, technical documentation, EU declaration of conformity, CE marking, instructions, and retention evidence. - [EMC Directive deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/emc-directive/deadlines-and-compliance-calendar.md): Key EMC Directive 2014/30/EU dates, release gates, document-retention clocks, harmonised-standard update checks, and authority-response timing. - [EMC Directive DoC and technical-file release gate](https://www.sorena.io/artifacts/eu/emc-directive/doc-and-technical-file-release-gate-workflow.md): A pre-release EMC Directive workflow for checking scope, essential requirements, standards evidence, technical documentation, EU DoC, CE marking, instructions, and importer or distributor readiness. - [EMC Directive scope triage workflow](https://www.sorena.io/artifacts/eu/emc-directive/emc-scope-triage-workflow.md): Classify EU EMC Directive scope for apparatus, fixed installations, inherently benign equipment, overlap with other EU product rules, and the evidence to keep. - [EU EMC Directive EMC Test Plan Template](https://www.sorena.io/artifacts/eu/emc-directive/emc-test-plan-template.md): Template fields for planning EU EMC Directive testing: product identification, intended environment, standards, emission and immunity coverage, configurations, deviations, reports, and release evidence. - [EMC vs Low Voltage Directive: EU product compliance comparison](https://www.sorena.io/artifacts/eu/emc-directive/emc-vs-low-voltage-directive.md): Compare the EU EMC Directive and Low Voltage Directive for electrical equipment: disturbance and immunity, safety overlap, CE evidence, DoC content, and harmonised standards. - [EMC Directive vs Machinery Regulation: compliance boundaries](https://www.sorena.io/artifacts/eu/emc-directive/emc-vs-machinery-regulation.md): Compare EU EMC evidence with machinery safety compliance: disturbance, immunity, technical documentation, standards, EU declarations of conformity, and CE marking overlap. - [EMC Directive vs Market Surveillance Regulation](https://www.sorena.io/artifacts/eu/emc-directive/emc-vs-market-surveillance-regulation.md): Compare EMC Directive product conformity duties with Regulation (EU) 2019/1020 market-surveillance cooperation, authority requests, evidence, and corrective action. - [EMC Directive vs Radio Equipment Directive](https://www.sorena.io/artifacts/eu/emc-directive/emc-vs-radio-equipment-directive.md): Compare when EU radio products fall under RED for EMC, when standalone EMC Directive evidence is still needed, and how to handle CE, DoC, technical files, and standards overlap. - [EMC Directive Essential Requirements and Testing](https://www.sorena.io/artifacts/eu/emc-directive/essential-requirements-and-testing.md): Official source guide to EMC Directive essential requirements, disturbance and immunity assessment, intended-use evidence, harmonised standards, and technical-file records. - [Can cables or wiring affect EMC Directive compliance?](https://www.sorena.io/artifacts/eu/emc-directive/faq/cables.md): FAQ on how cables, wiring, shielding, routing, length assumptions, instructions, and fixed-installation conditions affect EMC Directive evidence. - [Custom installations under the EU EMC Directive](https://www.sorena.io/artifacts/eu/emc-directive/faq/custom-installations.md): When custom equipment, site-built assemblies, and fixed installations need EMC evidence under Directive 2014/30/EU, including Article 19 documentation responsibilities. - [What must EU importers check under the EMC Directive?](https://www.sorena.io/artifacts/eu/emc-directive/faq/eu-importer-duties.md): An official source FAQ on EMC Directive importer duties before placing apparatus on the EU market: manufacturer conformity assessment, DoC, CE marking, traceability, instructions, storage, corrective action, and authority cooperation. - [What should teams do after a failed EMC test?](https://www.sorena.io/artifacts/eu/emc-directive/faq/failed-emc-tests.md): What a failed EU EMC emission or immunity test means for essential requirements, design remediation, technical documentation, DoC release, CE marking, and retest evidence. - [EMC for products with integrated radio modules](https://www.sorena.io/artifacts/eu/emc-directive/faq/integrated-radio-modules.md): FAQ on when RED or the EMC Directive applies to products with radio modules, and what host-product evidence, technical documentation, DoC records, and test assumptions to keep. - [When do modified products need a new EMC assessment?](https://www.sorena.io/artifacts/eu/emc-directive/faq/modified-products.md): EU EMC Directive FAQ on product modifications, who becomes responsible, when to reassess EMC conformity, and what technical-file and DoC evidence to keep. - [Are passive components covered by the EMC Directive?](https://www.sorena.io/artifacts/eu/emc-directive/faq/passive-components.md): When passive components are outside EMC Directive apparatus scope, when end-user incorporation can bring them inside scope, and what documentation to keep. - [EU EMC Directive FAQ: apparatus, fixed installations, importers](https://www.sorena.io/artifacts/eu/emc-directive/faq.md): Answers to common EU EMC Directive questions on apparatus, fixed installations, cables, passive components, importers, failed tests, radio modules, modifications, standards, and documentation. - [EMC Directive Fixed Installation Documentation](https://www.sorena.io/artifacts/eu/emc-directive/fixed-installation-documentation.md): Documentation guide for EU EMC Directive fixed installations: good engineering practices, apparatus integration, EMC evidence, change records, and authority-ready files. - [EMC Directive harmonised-standard selection workflow](https://www.sorena.io/artifacts/eu/emc-directive/harmonized-standard-selection-workflow.md): An official source workflow for selecting EMC Directive harmonised standards, checking OJEU citation and withdrawal dates, mapping standards to essential requirements, and recording technical-file evidence. - [EMC Directive Harmonised Standards and Deviations](https://www.sorena.io/artifacts/eu/emc-directive/harmonized-standards-and-deviations.md): How EMC Directive harmonised standards create presumption of conformity, how OJEU references and withdrawals work, and how to document deviations in the technical file. - [EMC Directive inherently benign equipment scope guide](https://www.sorena.io/artifacts/eu/emc-directive/inherently-benign-and-borderline-equipment.md): Decide whether equipment is inherently benign, apparatus, a component, or part of a fixed installation under the EU EMC Directive using official scope criteria and examples. - [EMC Directive language and EU declaration packaging](https://www.sorena.io/artifacts/eu/emc-directive/language-and-declaration-packaging.md): Package EMC Directive instructions, contact details, CE marking records, and EU Declaration of Conformity translations before apparatus is placed on EU markets. - [EMC Directive penalties and enforcement](https://www.sorena.io/artifacts/eu/emc-directive/penalties-and-fines.md): How EMC Directive penalties work: Member State sanctions, market-surveillance corrective action, withdrawal or recall, and evidence to keep when apparatus is challenged. - [EMC Directive post-market evidence pack](https://www.sorena.io/artifacts/eu/emc-directive/post-market-evidence.md): What EU EMC Directive evidence to retain after placing apparatus on the EU market: technical documentation, EU DoC, traceability, corrective actions, and authority-response records. - [EMC Directive requirements for apparatus and fixed installations](https://www.sorena.io/artifacts/eu/emc-directive/requirements.md): EU EMC Directive requirements for essential EMC performance, apparatus conformity assessment, technical documentation, EU DoC, CE marking, instructions, economic operators, and fixed installations. - [EMC Directive scope: apparatus, fixed installations, and exclusions](https://www.sorena.io/artifacts/eu/emc-directive/scope-and-borderline-cases.md): Official source guide to EU EMC Directive scope decisions for apparatus, fixed installations, inherently benign equipment, passive parts, cables, custom R&D kits, and RED/LVD overlap. - [EMC Directive test failure remediation workflow](https://www.sorena.io/artifacts/eu/emc-directive/test-failure-remediation-workflow.md): A cited EU EMC Directive workflow for failed EMC tests: triage the failure, assess essential requirements, update design evidence, plan retesting, and control release. - [EU EMC Directive test plan selection](https://www.sorena.io/artifacts/eu/emc-directive/test-plan-selection.md): How to select EMC standards, phenomena, configurations, deviations, and evidence for a Directive 2014/30/EU test plan without inventing unsupported limits. - [EMC Directive Timeline: practical guide](https://www.sorena.io/artifacts/eu/emc-directive/timeline.md): EU EMC Directive guide to Timeline with scope decisions, owner actions, evidence records, cited citations, and practical next steps. - [EMC Directive boundary for vehicle equipment](https://www.sorena.io/artifacts/eu/emc-directive/vehicle-equipment-boundary.md): When vehicle equipment needs EU vehicle type approval, an EMC Directive declaration of conformity, both checks, or separate vehicle-specific sourcing. - [EU EED 85 TJ and 10 TJ enterprise thresholds under Article 11](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/85-tj-and-10-tj-enterprise-thresholds.md): Article 11 guidance for enterprises checking the EU Energy Efficiency Directive 85 TJ energy-management-system threshold and 10 TJ energy-audit threshold. - [EU Energy Efficiency Directive action plan evidence workflow](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/action-plan-evidence-workflow.md): Build an evidence workflow for EU Energy Efficiency Directive energy-audit and energy-management action plans, including records, owners, tracking fields, and review triggers. - [EED Article 11 action plans and national planning context](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/action-plans.md): How EU Energy Efficiency Directive action plans work: Article 11 audit-based enterprise plans, management approval, publication evidence, and the difference from national NEEAP and NECP planning. - [Annex VI energy audit criteria under the EU Energy Efficiency Directive](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/annex-vi-audits.md): An official source guide to the Annex VI minimum criteria for EU Energy Efficiency Directive energy audits: data quality, representative scope, LCCA, calculations, recommendations, and evidence. - [EU Energy Efficiency Directive Applicability Test: 85 TJ, 10 TJ, Data Centres](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/applicability-test.md): Check whether an enterprise, public body, or data centre falls under Energy Efficiency Directive duties for energy management systems, audits, public-sector energy use, public buildings, or Article 12 data-centre reporting. - [EU Energy Efficiency Directive checklist for enterprise energy audits, EMS, data centres and public-sector duties](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/checklist.md): Checklist for Directive (EU) 2023/1791 covering enterprise energy-consumption thresholds, energy management systems, energy audits, Annex VI evidence, data-centre reporting and public-sector checks. - [EU Energy Efficiency Directive compliance: audits, EMS, data centres](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/compliance.md): Official source EU Energy Efficiency Directive compliance guide covering Article 11 energy management and audit thresholds, data-centre reporting, public-body duties, owners, and evidence. - [EU EED Article 12 data centre reporting and performance](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/data-centre-reporting-and-performance.md): Article 12 of the EU Energy Efficiency Directive requires qualifying data centre owners and operators to publish annual energy performance information and feed the European database. - [EU EED Data Centre Reporting Workflow](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/data-centre-reporting-workflow.md): Workflow for identifying in-scope EU data centres, collecting Annex VII energy-performance data, checking evidence, and preparing annual EED reporting. - [EU Energy Efficiency Directive deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/deadlines-and-compliance-calendar.md): Calendar of cited EU Energy Efficiency Directive dates for transposition, Article 11 energy audits and EMS duties, data-centre reporting, and public-sector obligations. - [EED vs EPBD: Energy Efficiency and Building Performance](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/eed-vs-epbd.md): Compare the EU Energy Efficiency Directive with EPBD building-performance workstreams for enterprise energy audits, energy management, public-sector duties, data centres, and building certificates. - [EU Energy Efficiency Directive Article 11 EMS vs Energy Audit Route](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/ems-vs-audit-route-workflow.md): Compare Article 11 EMS and energy audit routes under Directive (EU) 2023/1791: 85 TJ and 10 TJ thresholds, three-year average consumption, Annex VI audit criteria, outputs, and evidence. - [EN 16247-1 audit structure under the EU Energy Efficiency Directive](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/en-16247-audit-structure.md): How to structure an EN 16247-1 energy audit for EED Article 11 and Annex VI: scope, data, site work, analysis, report outputs, recommendations, and evidence. - [EU Energy Efficiency Directive energy audit report template](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/energy-audit-report-template.md): An official source energy audit report template for EED Article 11 and Annex VI: scope, measured consumption data, analysis, life-cycle costing, recommendations, owners, action-plan links, and evidence. - [EU EED Article 11 Energy Audits: 10 TJ threshold, cadence, and evidence](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/energy-audits.md): Official source guide to Energy Efficiency Directive Article 11 energy audit obligations, including the 10 TJ trigger, four-year cadence, Annex VI criteria, EN 16247 relation, and action-plan evidence. - [Energy Efficiency Directive vs CSRD](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/energy-efficiency-directive-vs-csrd.md): Compare EED operational energy duties with CSRD sustainability reporting work, including where EED audit, energy-management and data-centre evidence may be reused. - [EU Energy Efficiency Directive Article 11 energy management systems](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/energy-management-systems.md): Article 11 EMS guide for enterprises above the 85 TJ threshold, covering certified energy management systems, audit links, action plans, energy data, and evidence. - [EU EED audit frequency: Article 11 cadence and EMS route](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/audit-frequency.md): FAQ on EU Energy Efficiency Directive Article 11 audit frequency: 10 TJ and 85 TJ energy-consumption thresholds, first audit timing, four-year cadence, EMS alternative, and evidence. - [EED energy audit report contents: what should be included?](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/audit-report-contents.md): FAQ on EU Energy Efficiency Directive audit report contents, covering Annex VI criteria, EN 16247 context, evidence, recommendations, and action-plan linkage. - [EED Article 11 corporate group and site aggregation FAQ](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/corporate-group-and-site-aggregation.md): How to calculate EU Energy Efficiency Directive Article 11 enterprise thresholds across sites, energy carriers, and national transposition rules. - [How can EED records support CSRD and ESRS E1 evidence?](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/csrd-and-esrs-e1-overlap.md): FAQ on using EU Energy Efficiency Directive audit, management-system, and data-centre records as evidence inputs for sustainability reporting without treating EED as CSRD or ESRS advice. - [EED Article 12 data centre reporting threshold and cadence](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/data-centre-thresholds-and-reporting.md): FAQ on the EU Energy Efficiency Directive Article 12 data centre threshold, reporting cadence, Annex VII data categories, Commission database, and evidence to retain. - [Does ISO 50001 satisfy Article 11 of the EU Energy Efficiency Directive?](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/iso-50001-equivalence.md): FAQ on when ISO 50001 can support the Energy Efficiency Directive Article 11 energy-management-system route, when an energy audit is still needed, and what evidence to keep. - [EED penalties: what does Directive (EU) 2023/1791 require?](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/penalties.md): FAQ on EU Energy Efficiency Directive penalties, Member State enforcement rules, and the audit, energy-management, action-plan, and reporting evidence that reduces enforcement risk. - [EED Public Bodies FAQ: 1.9% Reduction and 3% Renovation Duties](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/public-bodies.md): FAQ on EU Energy Efficiency Directive public-body duties: who is in scope, the 1.9% final energy consumption reduction, 3% public-building renovation rule, caveats, and records. - [EED Article 11 threshold calculation: 85 TJ and 10 TJ FAQ](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/threshold-calculation.md): How to calculate EU Energy Efficiency Directive Article 11 enterprise thresholds using the previous three-year average, all energy carriers, and auditable evidence records. - [EU Energy Efficiency Directive FAQ](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq.md): Answers to common EU Energy Efficiency Directive questions on Article 11 thresholds, energy audits, energy management systems, data centres, public bodies, penalties, audit reports, and reporting overlap. - [EU EED Implementation Rate Tracking: evidence fields and caveats](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/implementation-rate-tracking.md): Track Energy Efficiency Directive implementation without inventing a headline rate: NECP action status, Eurostat distance-to-target data, audit scheme records, owners, and transposition caveats. - [ISO 50001 vs EU Energy Efficiency Directive](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/iso-50001-vs-energy-efficiency-directive.md): Compare ISO 50001 evidence with EU Energy Efficiency Directive Article 11 obligations for the 85 TJ energy-management-system route and 10 TJ audit route. - [EU Energy Efficiency Directive metering and billing requirements](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/metering-and-billing.md): An official source guide to EED metering, sub-metering, remote reading, billing information, consumption data access, and customer-facing records. - [EED National Transposition Evidence](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/national-transposition-evidence.md): How to evidence national transposition of Directive (EU) 2023/1791 without inventing Member State obligations: EU proof points, national-law checks, retained records, and source limits. - [EU Energy Efficiency Directive penalties and enforcement risk](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/penalties-and-fines.md): Article 32 of the EU Energy Efficiency Directive leaves penalties to Member States. This page helps understand the EU-level rule, the limits of EU-wide fine claims, and the evidence that lowers enforcement risk. - [EED public body obligations: 1.9% energy reduction and 3% renovation](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/public-body-obligations.md): cited guide to EU Energy Efficiency Directive public-body duties: Article 5 final-energy reduction, Article 6 building renovation, inventories, caveats, and evidence. - [EED reporting and metrics: Article 11 action plans and Article 12 data centres](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/reporting-and-metrics.md): cited EU Energy Efficiency Directive reporting guide covering Article 11 audit action-plan records, Article 12 data-centre metrics, and Eurostat consumption indicators. - [EU Energy Efficiency Directive requirements: Article 11, audits, data centres](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/requirements.md): Official source guide to core EED requirements: Article 11 EMS and audit thresholds, Annex VI audit criteria, data-centre reporting, public-body duties, action plans, and evidence. - [EU Energy Efficiency Directive scope: who must comply](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/scope-and-who-must-comply.md): cited EED scope guide for undertakings, public bodies, data centres, energy-consumption thresholds, audits, energy management systems, and national transposition checks. - [EED threshold triage workflow for 10 TJ and 85 TJ routes](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/threshold-triage-workflow.md): An official source workflow for collecting all energy carriers, calculating the three-year average, and routing EED audit or energy-management-system actions. - [Timeline for Energy Efficiency Directive: practical implementation guide](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/timeline.md): Practical Energy Efficiency Directive guidance for Timeline, with cited decisions, owners, evidence records, and implementation steps. - [EU ePrivacy analytics cookies: consent, exemption, and evidence guide](https://www.sorena.io/artifacts/eu/eprivacy-directive/analytics-cookies.md): cited guide to analytics cookies under EU ePrivacy: Article 5(3) scope, when consent is usually needed, limited analytics exemptions, consent records, and evidence gaps. - [EU ePrivacy Applicability Test for Cookies, SDKs, Pixels, Communications, and Marketing](https://www.sorena.io/artifacts/eu/eprivacy-directive/applicability-test.md): A concrete EU ePrivacy Directive applicability test for electronic communications services, terminal-equipment storage or access, cookies, SDKs, pixels, local storage, direct marketing, GDPR overlap, and evidence. - [EU ePrivacy Article 5(3) terminal equipment test](https://www.sorena.io/artifacts/eu/eprivacy-directive/article-5-3-terminal-equipment-test.md): A cited Article 5(3) test for cookies, pixels, local identifiers, device APIs, strictly necessary exceptions, and consent evidence. - [EU ePrivacy cookie banner UX test cases](https://www.sorena.io/artifacts/eu/eprivacy-directive/banner-ux-test-cases.md): cited cookie banner UX tests for Article 5(3) ePrivacy consent: reject all, pre-ticked boxes, withdrawal, cookie walls, analytics toggles, and consent evidence. - [EU ePrivacy Directive Compliance Checklist](https://www.sorena.io/artifacts/eu/eprivacy-directive/checklist.md): A concrete ePrivacy checklist for terminal equipment access, cookie consent, exemptions, banner UX, direct marketing, confidentiality, GDPR interplay, and evidence records. - [EU ePrivacy Directive Compliance Guide for Cookies, Marketing, and Communications](https://www.sorena.io/artifacts/eu/eprivacy-directive/compliance.md): Practical ePrivacy Directive compliance checks for terminal equipment, communications confidentiality, cookie consent, exemptions, direct marketing, evidence, and national-law caveats. - [EU ePrivacy Confidentiality of Communications: Article 5 controls](https://www.sorena.io/artifacts/eu/eprivacy-directive/confidentiality-of-communications.md): Article 5 confidentiality guide for EU ePrivacy communications, traffic data, metadata, terminal-equipment access, consent limits, and GDPR interplay. - [EU ePrivacy consent-log evidence workflow for cookies and trackers](https://www.sorena.io/artifacts/eu/eprivacy-directive/consent-log-evidence-workflow.md): Build an ePrivacy consent-log workflow that records cookie and tracker decisions, banner versions, consent signals, withdrawals, vendor evidence, and audit-ready outputs. - [EU ePrivacy Cookie Scope Classifier Workflow](https://www.sorena.io/artifacts/eu/eprivacy-directive/cookie-scope-classifier-workflow.md): Classify cookies, pixels, SDKs, local storage, device identifiers, and analytics tracers under Article 5(3) ePrivacy rules, with consent and exemption evidence outputs. - [EU ePrivacy Directive Cookies and Consent: Article 5(3), exemptions, and banner evidence](https://www.sorena.io/artifacts/eu/eprivacy-directive/cookies-and-consent.md): Cookie consent guide for the EU ePrivacy Directive: Article 5(3) scope, strictly necessary and transmission exemptions, consent UX, withdrawal, logs, analytics caveats, and GDPR interplay. - [EU ePrivacy Directive compliance calendar for cookies, consent, and marketing](https://www.sorena.io/artifacts/eu/eprivacy-directive/deadlines-and-compliance-calendar.md): cited ePrivacy calendar covering Directive milestones, Article 5(3) cookie reviews, consent evidence, direct marketing checks, and national-law follow-up. - [EU ePrivacy direct-marketing consent checklist](https://www.sorena.io/artifacts/eu/eprivacy-directive/direct-marketing-consent-checklist.md): Checklist for ePrivacy Directive direct-marketing messages: consent, soft opt-in, sender identity, opt-out handling, proof records, suppression, and national-law caveats. - [EU ePrivacy Directive direct marketing rules for electronic mail](https://www.sorena.io/artifacts/eu/eprivacy-directive/direct-marketing-rules.md): cited guide to Article 13 ePrivacy Directive rules for electronic mail marketing, prior consent, customer soft opt-in, opt-out handling, sender identity, and Member State caveats. - [EU ePrivacy Directive Enforcement and Fines](https://www.sorena.io/artifacts/eu/eprivacy-directive/enforcement-and-fines.md): Official source guide to ePrivacy Directive enforcement, national penalties, competent authorities, GDPR interplay, cookie-banner risk, and evidence limits. - [ePrivacy Directive vs GDPR: cookies, communications, consent, and evidence](https://www.sorena.io/artifacts/eu/eprivacy-directive/eprivacy-directive-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR across subject matter, lex specialis overlap, terminal equipment, communications confidentiality, marketing, consent, enforcement, and evidence. - [ePrivacy cookie consent vs DSA ads obligations: scope-bounded comparison](https://www.sorena.io/artifacts/eu/eprivacy-directive/eprivacy-vs-dsa-ads.md): Compare ePrivacy cookie and tracking-consent duties with DSA ads workstreams without merging consent, transparency, and evidence obligations. - [EU ePrivacy Directive vs GDPR: cookies, communications, marketing, and evidence](https://www.sorena.io/artifacts/eu/eprivacy-directive/eprivacy-vs-gdpr.md): Compare the EU ePrivacy Directive and GDPR by trigger, consent standard, lex specialis overlap, enforcement caveats, and evidence outputs for cookies, device access, communications, and marketing. - [EU ePrivacy Directive vs UK PECR: scope-bounded cookie and marketing comparison](https://www.sorena.io/artifacts/eu/eprivacy-directive/eprivacy-vs-uk-pecr.md): Compare EU ePrivacy Directive rules with a UK PECR workstream requiring separate source review for cookies, terminal equipment, direct marketing, consent, soft opt-in, and evidence. - [EU cookie banner requirements under the ePrivacy Directive](https://www.sorena.io/artifacts/eu/eprivacy-directive/eu-cookie-banner-requirements.md): EU ePrivacy cookie banner requirements for non-exempt cookies and trackers: prior consent, reject choices, no pre-ticked boxes, withdrawal, analytics limits, cookie walls, and evidence logs. - [Do Analytics Cookies Require Consent under the EU ePrivacy Directive?](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/analytics-cookies.md): FAQ answer on analytics cookies under Article 5(3) ePrivacy, limited analytics exemptions, configuration evidence, consent logs, and national-law caveats. - [What should CMP consent logs retain under the EU ePrivacy Directive?](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/cmp-consent-logs.md): FAQ answer on CMP consent logs for EU ePrivacy cookie consent: retained fields, consent validity signals, banner versioning, refusal and withdrawal events, proof limits, and national-law caveats. - [Are cookie walls allowed under the EU ePrivacy Directive?](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/cookie-walls.md): FAQ answer on cookie walls under the EU ePrivacy Directive, covering freely given consent, refusal and withdrawal paths, banner evidence, and national-law caveats. - [Is a reject-all button required for EU ePrivacy cookie consent?](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/reject-all-button.md): Standalone FAQ answer on EU ePrivacy reject-all and refuse options for cookie banners, including equal prominence, deceptive UX, consent evidence, withdrawal, and national-law caveats. - [EU ePrivacy soft opt-in FAQ for email marketing](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/soft-opt-in.md): When Article 13(2) soft opt-in can support EU customer email marketing, including existing-customer, similar-offer, opt-out, sender-identity, suppression-list, and national-law checks. - [Strictly Necessary Cookies under the EU ePrivacy Directive](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/strictly-necessary-cookies.md): FAQ answer on when EU ePrivacy Article 5(3) allows cookies without consent, with cited examples, analytics caveats, evidence records, and national-law cautions. - [EU ePrivacy Directive FAQ: cookies, consent, marketing, GDPR interplay](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq.md): Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence. - [EU ePrivacy Directive Member State Cookie Rules](https://www.sorena.io/artifacts/eu/eprivacy-directive/member-state-cookie-rules.md): How to evidence EU ePrivacy cookie compliance when Article 5(3) is implemented through Member State law and national authority practice. - [EU ePrivacy Directive Metadata and Location Data Guide](https://www.sorena.io/artifacts/eu/eprivacy-directive/metadata-and-location-data.md): cited guide to EU ePrivacy Directive rules for traffic data, location data, anonymisation, consent, value-added services, Article 5(3) overlap, and national-law limits. - [EU ePrivacy Directive penalties and fines: national enforcement caveats](https://www.sorena.io/artifacts/eu/eprivacy-directive/penalties-and-fines.md): cited guide to ePrivacy Directive penalty exposure, national transposition caveats, cookie enforcement evidence, consent defects, and GDPR overlap limits. - [EU ePrivacy Directive Requirements: cookies, communications and marketing](https://www.sorena.io/artifacts/eu/eprivacy-directive/requirements.md): cited map of EU ePrivacy Directive requirements for communications confidentiality, terminal-equipment access, consent, traffic and location data, and direct marketing. - [EU ePrivacy soft opt-in marketing review workflow](https://www.sorena.io/artifacts/eu/eprivacy-directive/soft-opt-in-marketing-review-workflow.md): Review whether an EU electronic-mail marketing send can rely on the ePrivacy soft opt-in, with checks for customer relationship evidence, similar products, opt-out, sender identity, suppression records, and national-law caveats. - [EU ePrivacy soft opt-in marketing checklist](https://www.sorena.io/artifacts/eu/eprivacy-directive/soft-opt-in-marketing.md): cited checklist for using the EU ePrivacy Directive soft opt-in exception for customer email marketing, opt-outs, sender identity, suppression records, and national-law caveats. - [EU ePrivacy Strictly Necessary Cookie Exemptions](https://www.sorena.io/artifacts/eu/eprivacy-directive/strictly-necessary-exemptions.md): cited guide to the Article 5(3) ePrivacy exemptions for transmission cookies, requested-service cookies, analytics caveats, evidence, and national-law checks. - [ESPR Applicability Test for Products and DPP Readiness](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/applicability-test.md): A cited ESPR applicability test for physical product scope, exclusions, delegated-act dependency, economic operator triage, DPP readiness, unsold goods, and evidence. - [ESPR compliance checklist for delegated acts and DPP readiness](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/checklist.md): A cited ESPR checklist for monitoring delegated acts, mapping product requirements, preparing technical documentation, and building DPP and unsold-goods evidence. - [ESPR compliance program operating model](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/compliance-program-operating-model.md): Build an ESPR operating model for product-group intake, delegated-act monitoring, supplier evidence, DPP governance, release gates, and authority response. - [ESPR compliance: delegated acts, DPP and evidence](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/compliance.md): Practical ESPR compliance guidance for mapping product delegated acts, Digital Product Passport dependencies, unsold goods duties, technical documentation, standards, and market-surveillance evidence. - [ESPR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/deadlines-and-compliance-calendar.md): Cited ESPR calendar for framework dates, delegated-act dependency, working-plan monitoring, unsold-goods disclosure, and DPP readiness limits. - [ESPR delegated act intake by product group](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/delegated-act-intake-by-product-group.md): A based ontake checklist for tracking ESPR delegated acts by product group, covering product identification, DPP data, ecodesign requirements, conformity evidence, and source limits. - [ESPR delegated act intake workflow](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/delegated-act-intake-workflow.md): A source-based ontake workflow for ESPR delegated acts: trigger checks, product-group scope, requirement extraction, DPP impacts, release gates, owners, and evidence outputs. - [ESPR destruction of unsold goods: disclosure, ban scope, and records](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/destruction-of-unsold-goods.md): Cited ESPR guide to unsold consumer product disclosure, destruction-ban scope, records, derogations, and national enforcement limits. - [ESPR DPP information mapping workflow](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/dpp-information-mapping-workflow.md): Map ESPR delegated-act information requirements into DPP data elements, source systems, access levels, identifiers, carriers, validation evidence, and unresolved design decisions. - [ESPR durability, repairability, and recyclability evidence](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/durability-repairability-and-recyclability-evidence.md): Build ESPR evidence for durability, repairability, and recyclability without inventing product-group tests before the applicable delegated act is known. - [ESPR Ecodesign Evidence Checklist](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/ecodesign-evidence-checklist.md): Checklist for collecting ESPR ecodesign evidence from delegated acts, technical documentation, supplier substantiation, DPP mapping, standards, and market surveillance records. - [ESPR ecodesign requirement types: performance, information, and DPP links](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/ecodesign-requirement-types.md): Official source guide to ESPR ecodesign requirement types, product parameters, delegated-act dependency, DPP links, and evidence implications. - [ESPR and DPP connection: delegated acts, identifiers, and access](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-and-dpp-connection.md): How ESPR connects ecodesign information requirements to Digital Product Passports, including delegated acts, data carriers, identifiers, access rights, registry, and architecture choices. - [ESPR delegated acts watchlist for product and DPP teams](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-delegated-acts-watchlist.md): Track ESPR delegated-act priorities without inventing dates: product groups, source status, likely requirement types, DPP impact, evidence owners, and open source gaps. - [ESPR vs Batteries Regulation Comparison](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-vs-batteries-regulation.md): Compare ESPR delegated-act planning with the Batteries Regulation product-specific regime, including DPP overlap, battery passport evidence, timing limits, and source boundaries. - [ESPR vs Ecodesign Directive](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-vs-ecodesign-directive.md): Compare ESPR with the earlier Ecodesign Directive across scope, legal form, delegated acts, DPP requirements, unsold goods, transition rules, and evidence. - [ESPR vs GPSR: Sustainability vs Product Safety](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-vs-gpsr.md): A scope-bounded comparison of ESPR sustainability and product-information requirements against GPSR product-safety context, with evidence and DPP reuse limits. - [ESPR vs PPWR Comparison](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-vs-ppwr.md): Compare ESPR product ecodesign and Digital Product Passport work with the separate PPWR packaging regime, using only cited ESPR and packaging-boundary claims. - [ESPR vs REACH and RoHS Comparison](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/espr-vs-reach-and-rohs.md): Compare ESPR ecodesign, sustainability, information, and digital product passport requirements with separately sourced REACH and RoHS substance-control context. - [ESPR delegated acts FAQ: product rules, DPP impact, and monitoring](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/delegated-acts.md): Standalone FAQ on ESPR delegated acts, why product-group duties depend on them, what teams should monitor, and how they shape Digital Product Passport information. - [ESPR destruction ban and unsold goods FAQ](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/destruction-ban.md): What ESPR says about preventing destruction of unsold consumer products, annual disclosure, the Annex VII apparel and footwear ban, and cited derogation evidence. - [EU ESPR DPP obligations FAQ](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/dpp-obligations.md): Standalone FAQ on Digital Product Passport obligations under ESPR, covering delegated acts, identifiers, carriers, access rights, data governance, and supplier evidence limits. - [ESPR market surveillance FAQ: evidence, DPP data, and authority requests](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/market-surveillance.md): Standalone FAQ on ESPR market surveillance: technical documentation, conformity evidence, DPP data, authority response, delegated-act limits, and national penalties. - [ESPR product priorities FAQ: working plan and delegated acts](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/product-priorities.md): Standalone FAQ on ESPR product priorities, the Commission working plan, delegated-act dependency, monitoring points, and limits of preliminary source material. - [Which products are in scope of the EU ESPR?](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/products-in-scope.md): Standalone FAQ on ESPR product scope, excluded products, delegated-act dependency, working-plan monitoring, and the digital product passport link. - [ESPR unsold goods disclosure FAQ](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/unsold-goods-disclosure.md): Standalone FAQ on the ESPR Article 24 duty to disclose discarded unsold consumer products, its relationship to the destruction ban, records, and source limits. - [ESPR FAQ: scope, delegated acts, DPP, unsold goods](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq.md): Standalone ESPR FAQ answers on product scope, delegated acts, Digital Product Passports, unsold goods, product priorities, standards, surveillance, and source limits. - [ESPR Information Requirements, Labels, and Disclosure](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/information-requirements-labeling-and-disclosure.md): Official source ESPR guide to delegated-act information requirements, product labels, digital product passport access, data carriers, and unsold-goods disclosure. - [ESPR Information Requirements to DPP Mapping](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/information-requirements-to-dpp-mapping.md): Map ESPR information requirements into Digital Product Passport data classes, source systems, access rules, carrier choices, validation checks, and evidence records. - [ESPR market surveillance technical documentation checklist](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/market-surveillance-technical-documentation.md): Source-cited ESPR checklist for technical documentation, conformity evidence, DPP records, and responses to market surveillance authority requests. - [ESPR penalties and fines: Member State rules and evidence](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/penalties-and-fines.md): A conservative ESPR penalties guide explaining Article 74, why fine amounts depend on Member State law, and which conformity and market-surveillance evidence matters. - [ESPR Product Priorities and Delegated Acts Tracker](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/product-priorities-and-delegated-acts-tracker.md): Track ESPR priority product groups, source status, delegated-act progress, expected DPP impact, owners, evidence, and source gaps without treating preliminary studies as binding obligations. - [ESPR requirements: delegated acts, ecodesign, DPP, and evidence](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/requirements.md): ESPR requirements explained as a framework for delegated acts, ecodesign performance and information rules, Digital Product Passports, unsold goods, technical documentation, and market surveillance. - [ESPR harmonised standards and common specifications](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/standards-and-common-specifications.md): How ESPR uses harmonised standards, common specifications, delegated acts, and DPP standards evidence without inventing product-specific requirements. - [Timeline for ESPR: practical implementation guide](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/timeline.md): Practical ESPR guidance for Timeline, with cited decisions, owners, evidence records, and implementation steps. - [ESPR unsold goods disclosure tracker](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/unsold-goods-disclosure-tracker.md): Track ESPR unsold consumer product disclosure fields, website publication evidence, destruction-ban status, owners, and unresolved source gaps. - [What ESPR is and why it matters](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/what-is-espr-and-why-it-matters.md): An official source explainer of the EU Ecodesign for Sustainable Products Regulation, including scope, delegated acts, DPPs, unsold goods, and enforcement limits. - [EU GDPR Applicability Test for Products, Vendors, and Data Flows](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/applicability-test.md): A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence. - [EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/automated-decision-making-and-profiling.md): cited GDPR guide for automated decision-making and profiling: Article 22 scope, profiling definition, transparency, lawful basis, DPIA triggers, human review rights, and evidence. - [EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/breach-notification-72-hours.md): Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs. - [EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/breach-notification-workflow.md): A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records. - [EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/checklist.md): This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence. - [EU GDPR Children and Special-Category Data Guide](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/children-and-special-categories.md): cited GDPR guide for Article 8 children's consent, Article 9 special-category data, DPIA triggers, transparency, safeguards, and evidence records. - [EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/compliance.md): Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties. - [EU GDPR Controller, Processor, and Joint Controller Roles](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/controller-processor-and-joint-controller-roles.md): cited GDPR guide for classifying controllers, processors, and joint controllers, with Article 28 contract checks, Article 26 transparency, and vendor evidence. - [EU GDPR Data Subject Rights and DSAR Workflow](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/data-subject-rights-and-dsar-workflow.md): cited GDPR DSAR workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor escalation, and evidence. - [EU GDPR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/deadlines-and-compliance-calendar.md): cited GDPR calendar entries for applicability, DSAR response timing, breach notification, DPIA review, prior consultation, transfer reviews, and retention checks. - [EU GDPR DPIA and Prior Consultation Workflow](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/dpia-and-prior-consultation-workflow.md): Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required. - [EU GDPR DPIA and risk management under Articles 35 and 36](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/dpia-and-risk-management.md): EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits. - [EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/dsar-workflow.md): Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records. - [When does the GDPR 72-hour breach notification clock start?](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/breach-awareness-clock.md): GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep. - [When does the EU GDPR require a DPIA?](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/dpia-threshold.md): Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements. - [EU GDPR DSAR Exceptions: refusal, extensions, identity checks](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/dsar-exceptions.md): FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15. - [EU GDPR Article 6 Legal Bases FAQ](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/legal-bases.md): FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data. - [GDPR processor vs controller: role boundaries and evidence](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/processor-vs-controller.md): Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records. - [EU GDPR SCC Transfer Impact Assessment FAQ](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/scc-transfer-impact-assessment.md): cited FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required. - [Does the EU GDPR apply outside the EU under Article 3?](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/territorial-scope.md): An official source GDPR Article 3 territorial-scope FAQ covering EU establishment, offering goods or services, monitoring behavior in the EU, and Article 27 representatives. - [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers. - [GDPR vs EU AI Act: privacy controls for AI systems](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-ai-act.md): Compare GDPR privacy duties with the EU AI Act only where the GDPR source pack supports the point: lawful basis, notices, DPIA, ADM, RoPA, rights, and source limits. - [EU GDPR vs California CCPA: official source GDPR comparison limits](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa.md): Compare GDPR implementation duties with limited to the cited sources California CCPA/CPRA context, showing where the available cited sources support a claim and where it does not. - [GDPR vs EU Data Act: personal data safeguards and source limits](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-data-act.md): Compare GDPR obligations with the EU Data Act only where the available GDPR cited sources support the fact pattern, with clear safeguards for personal data, rights, transfers, and accountability. - [EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-eprivacy.md): Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance. - [EU GDPR vs Brazil LGPD: GDPR-led comparison and source gaps](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-lgpd.md): Compare EU GDPR duties with Brazil LGPD only where the available sources support the comparator, with GDPR rows for lawful basis, rights, breach, transfers, roles, and evidence. - [EU GDPR vs UK GDPR: limited to the cited sources compliance comparison](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr.md): Compare EU GDPR obligations with UK GDPR transfer notes based on EU GDPR sources, covering scope, lawful basis, rights, accountability, records, DPIAs, security, and transfers. - [EU GDPR International Transfers and SCCs: Chapter V evidence guide](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/international-transfers-and-sccs.md): cited guide to GDPR Chapter V transfers, adequacy decisions, SCCs, transfer impact assessments, supplementary measures, and EU-US DPF checks. - [EU GDPR Lawful Basis and Consent Guide](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent.md): Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records. - [EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lawful-basis-and-lia-workflow.md): Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f). - [EU GDPR Lead Supervisory Authority and One-Stop-Shop](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lead-authority-and-one-stop-shop.md): How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together. - [EU GDPR LIA Template for Article 6(1)(f)](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lia-template.md): This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence. - [EU GDPR penalties and fines: Article 83 tiers and evidence](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/penalties-and-fines.md): EU GDPR penalties and fines guide covering Article 83 fine tiers, assessment factors, Article 58 powers, and evidence records for controllers and processors. - [EU GDPR Processor Contracts and Vendor Management](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/processor-contracts-and-vendor-management.md): EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable. - [EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/record-of-processing-activities-template.md): Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures. - [EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/requirements.md): Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers. - [EU GDPR Retention and Erasure Schedule](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/retention-and-erasure-schedule.md): Build an EU GDPR retention and erasure schedule around storage limitation, Article 17 erasure grounds, Article 12 rights handling, Article 19 recipient notices, and Article 30 RoPA fields. - [EU GDPR Article 30 RoPA Intake Workflow](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/ropa-intake-workflow.md): This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live. - [EU GDPR Transfer TIA and SCC Workflow](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/transfer-tia-and-scc-workflow.md): A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers. - [EU GDPR Transparency Notices: Articles 12, 13 and 14](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/transparency-notices.md): Official source GDPR guide to privacy notices under Articles 12, 13 and 14: direct collection, third-party data sources, recipients, transfers, retention, rights, and lawful basis. - [EU GPSR Applicability Test for Consumer Products](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/applicability-test.md): Determine whether the EU General Product Safety Regulation applies to a product, sale channel, operator role, online listing, used product, or responsible-person setup. - [EU GPSR Compliance Checklist](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/checklist.md): Concrete EU GPSR checklist for consumer product safety assessment, technical documentation, traceability, labels, online listings, accidents, recalls, and corrective actions. - [EU GPSR compliance obligations](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/compliance.md): EU GPSR compliance guide covering safety assessment, technical documentation, responsible persons, traceability, marketplace listings, accident reporting, recalls, and evidence. - [EU GPSR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/deadlines-and-compliance-calendar.md): Calendar of cited EU GPSR timing duties: 13 December 2024 application, accident notices, marketplace takedowns, recall notices, remedies, and regular product-safety checks. - [EU GPSR Economic Operator Duties](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/economic-operator-duties.md): Role-by-role GPSR duties for manufacturers, importers, distributors, EU responsible persons, traceability records, corrective action, accidents, recalls, and Safety Business Gateway escalation. - [EU GPSR economic operator roles: manufacturer, importer, distributor](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/economic-operator-roles.md): Classify GPSR roles for consumer products and map manufacturer, importer, distributor, fulfilment provider, responsible person, and online marketplace duties to evidence. - [When must businesses report GPSR product accidents?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/accident-notification.md): EU GPSR FAQ explaining accident notification triggers, who reports, Safety Business Gateway use, required information, evidence to keep, and timing without fixed day-count claims. - [Which products does the EU GPSR cover?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/covered-products.md): Direct EU GPSR FAQ on covered consumer products, exclusions, online offers, used and refurbished products, and how GPSR interacts with specific EU product-safety law. - [How are dangerous product risk levels assessed under the EU GPSR?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/dangerous-product-risk-levels.md): FAQ on GPSR and Safety Gate dangerous-product risk levels: serious risk, evidence, corrective measures, recall, withdrawal, and notification records. - [What must online marketplaces do when a GPSR product safety issue is reported?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/marketplace-takedowns.md): EU GPSR FAQ on marketplace takedown orders, product-safety notices, Safety Gate Portal checks, Safety Business Gateway reporting, and evidence records. - [What GPSR information must appear in online Product Listings?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/product-listings.md): Direct EU GPSR FAQ answer on Article 19 online offer content: manufacturer details, EU responsible person, product identifiers, warnings, and listing evidence. - [What should a GPSR recall notice include?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/recall-notices.md): What EU GPSR recall notices must tell consumers, how the EU model notice structures the message, and how Safety Business Gateway and Safety Gate evidence fits the recall record. - [Who is the GPSR Article 16 responsible person?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/responsible-person.md): Direct FAQ answer on when the GPSR requires an EU-based responsible economic operator, which operator can fill the role, and what contact details must appear online. - [What should a GPSR safety evidence pack include?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/safety-evidence-packs.md): EU GPSR FAQ covering the records to keep for product risk assessment, technical documentation, traceability, tests, warnings, incidents, recalls, online listings, and marketplace operators. - [How does the GPSR apply to used or refurbished products?](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/used-and-refurbished-products.md): FAQ on when used, repaired, reconditioned, or refurbished consumer products fall under the EU GPSR, including exclusions, operator duties, evidence, and online listings. - [EU GPSR FAQ: scope, listings, recalls, reporting](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq.md): FAQ on GPSR consumer-product scope, economic operator duties, EU responsible person, online marketplace listings, Safety Business Gateway reporting, recalls, and evidence. - [GPSR vs DSA marketplace duties for dangerous products](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/gpsr-vs-dsa-marketplaces.md): Compare GPSR marketplace duties with the DSA touchpoints referenced by GPSR Article 22 for product listings, takedown, recalls, incidents, and evidence. - [GPSR vs LVD, EMC, and RED: overlap and fallback](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/gpsr-vs-lvd-emc-red-sector-rules.md): Compare GPSR fallback duties with LVD, EMC, and RED sector rules for consumer products, traceability, recalls, online marketplaces, and evidence records. - [GPSR vs Market Surveillance Regulation: Article 4, controls, recalls](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/gpsr-vs-market-surveillance-regulation.md): Compare GPSR with Regulation (EU) 2019/1020 for responsible-person coverage, market-surveillance controls, evidence requests, unsafe products, recalls, and authority workflows. - [GPSR vs Product Liability Directive](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/gpsr-vs-product-liability-directive.md): Compare GPSR preventive product-safety duties with EU product-liability exposure using cited rules on recalls, warnings, traceability, accidents, and evidence. - [EU GPSR Imported Products Guide](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/imported-products.md): GPSR importer guide covering EU responsible-person checks, traceability, technical documentation, online offers, dangerous-product action, recalls, and Safety Business Gateway reporting. - [EU GPSR incident and recall triage workflow](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/incident-and-recall-triage-workflow.md): A concrete EU GPSR workflow for product-safety incident intake, dangerous-product assessment, Safety Business Gateway notification, recall notices, marketplace coordination, and evidence records. - [EU GPSR Marketplace Notice Handling](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/marketplace-notice-handling.md): How online marketplaces should handle GPSR authority orders, product-safety notices, Safety Gate checks, seller communications, evidence, and escalation. - [EU GPSR Marketplace Notice Response Workflow](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/marketplace-notice-response-workflow.md): Concrete GPSR workflow for online marketplace product-safety notices, authority orders, takedowns, seller and consumer notification, Safety Gate Portal checks, and Safety Business Gateway evidence. - [EU GPSR Online Listing Obligations](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/online-listing-obligations.md): GPSR online listing obligations for EU consumer-product offers: required product, manufacturer, responsible-person, warning, safety, traceability, and marketplace evidence fields. - [EU GPSR online listing release workflow](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/online-listing-release-workflow.md): Release workflow for EU GPSR online product listings: product scope, responsible person details, warnings, traceability, safety evidence, marketplace checks, and monitoring. - [EU GPSR Online Marketplace Obligations](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/online-marketplace-obligations.md): GPSR obligations for online marketplaces: contact points, Safety Gate registration, authority orders, product-safety notices, listing data, recall cooperation, accident notifications, and records. - [EU GPSR penalties and enforcement exposure](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/penalties-and-fines.md): cited EU GPSR enforcement guide covering Member State penalties, market surveillance powers, corrective actions, marketplace orders, recalls, and evidence records. - [EU GPSR Product Recall Notice Template](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/product-recall-notice-template.md): A GPSR recall notice template for EU consumer products, covering product identifiers, affected batches, risk wording, consumer actions, remedies, contact routes, channels, accessibility, and evidence records. - [EU GPSR Product Safety Assessment Record](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/product-safety-assessment.md): Build a concrete GPSR product safety assessment covering product characteristics, foreseeable use, vulnerable consumers, warnings, standards, tests, incidents, risk level, corrective action, and documentation. - [EU GPSR recall effectiveness evidence](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/recall-effectiveness.md): GPSR recall effectiveness guide for direct consumer notice, recall notice content, remedies, channel monitoring, marketplace cooperation, and Safety Gate evidence. - [EU GPSR Recalls and Incident Management](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/recalls-and-incident-management.md): GPSR recall and incident management guide covering accident notification, Safety Business Gateway reporting, recall notices, consumer communication, marketplaces, and evidence records. - [EU GPSR requirements for consumer products](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/requirements.md): Core EU GPSR requirements for consumer product safety: scope, risk assessment, operator duties, EU responsible person, traceability, online listings, marketplaces, accidents, recalls, Safety Gate, and evidence. - [EU GPSR Risk Evaluation Criteria](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/risk-evaluation.md): GPSR risk evaluation criteria for consumer products: foreseeable use, vulnerable consumers, standards, warnings, serious risk signals, corrective action, and evidence. - [EU GPSR safety assessment workflow](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/safety-assessment-workflow.md): A GPSR workflow for consumer product safety assessment: scope intake, hazards, standards, warnings, vulnerable users, documentation, incident triggers, recalls, and evidence. - [EU GPSR Safety Gate and Safety Business Gateway](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/safety-gate-and-business-gateway.md): cited guide to GPSR Safety Gate public alerts, Safety Business Gateway submissions, accident reporting, marketplace duties, evidence fields, and notification timing. - [EU GPSR Scope and Covered Products](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/scope-and-covered-products.md): Scope guide for Regulation (EU) 2023/988 covering consumer products, distance sales, used and reconditioned goods, exclusions, Union harmonisation overlap, and evidence to keep. - [EU GPSR sector-law fallback and overlap](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/sector-law-fallback.md): How the EU GPSR applies when sector-specific Union product safety law also applies, including residual safety risks, online listings, recalls, evidence, and market surveillance. - [EU GPSR Traceability and Documentation Records](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/traceability-and-documentation.md): cited GPSR record checklist for product identifiers, manufacturer and importer details, technical documentation, online offers, responsible person evidence, incidents, and recalls. - [EU GPSR Traceability Records](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/traceability-records.md): Build GPSR traceability records for product identifiers, economic operators, online listings, safety evidence, incidents, recalls, and retention checks. - [EU Green Claims Applicability Test](https://www.sorena.io/artifacts/eu/green-claims-directive/applicability-test.md): Check whether the EU Green Claims Directive proposal could apply to an explicit environmental claim, environmental label, product claim, trader claim, or B2C communication. - [EU Green Claims Checklist](https://www.sorena.io/artifacts/eu/green-claims-directive/checklist.md): A concrete checklist for EU environmental claims covering claim inventory, substantiation, life-cycle impacts, comparisons, offsets, labels, verification, and UCPD overlap. - [EU Green Claims claim categories and evidence map](https://www.sorena.io/artifacts/eu/green-claims-directive/claim-categories.md): Classify EU environmental claims by category: explicit, comparative, product, trader, carbon, labels, generic wording, and evidence needs. - [Green Claims evidence workflow for substantiation](https://www.sorena.io/artifacts/eu/green-claims-directive/claim-substantiation-evidence-workflow.md): Build a Green Claims proposal evidence file for voluntary EU environmental claims: status check, scope, scientific evidence, life-cycle impacts, comparisons, carbon credits, verification, consumer communication, and review. - [Comparative Environmental Claims Under EU Green Claims Rules](https://www.sorena.io/artifacts/eu/green-claims-directive/comparative-claims.md): How to substantiate EU comparative environmental claims using equivalent products, methods, data, value-chain coverage, significant impacts, and consumer-law comparison disclosures. - [EU Green Claims compliance controls for proposal-stage planning](https://www.sorena.io/artifacts/eu/green-claims-directive/compliance.md): Proposal-stage Green Claims compliance controls for claim inventory, substantiation, communication, labels, comparative claims, offset claims, verification planning, and evidence records. - [EU Green Claims Directive Procedure Calendar](https://www.sorena.io/artifacts/eu/green-claims-directive/deadlines-and-compliance-calendar.md): Track cited EU Green Claims Directive proposal milestones: Commission proposal, Parliament first reading, Council general approach, and current procedure status. - [EU Green Claims claim categories FAQ](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/claim-categories.md): FAQ guidance on explicit, generic, comparative, product, company, label, and carbon claim categories under the EU Green Claims proposal. - [Claims Evidence under the EU Green Claims Directive](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/claims-evidence.md): FAQ on the evidence expected before EU Green Claims are communicated, including scientific substantiation, life-cycle coverage, comparisons, and publication records. - [FAQ: comparative environmental claims under EU Green Claims Directive](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/comparative-claims.md): FAQ guidance on EU comparative environmental claims: equivalent data, method boundaries, product comparisons, substantiation, presentation, and UCPD overlap. - [Environmental labels and certification schemes under EU Green Claims rules](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/labels-and-certification-schemes.md): FAQ on environmental labels, certification schemes, EU Ecolabel, third-party verification, and Directive (EU) 2024/825 overlap for green claims. - [Microenterprise and Scope Exclusions in the EU Green Claims Proposal](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/microenterprise-and-scope-exclusions.md): FAQ on proposal-stage Green Claims scope: microenterprise treatment, voluntary B2C explicit environmental claims, B2B limits, and EU-rule exclusions. - [FAQ: carbon offsets and carbon-neutral claims under EU Green Claims rules](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/offsets-and-carbon-neutral-claims.md): FAQ guidance on carbon neutral, climate neutral, offset, carbon credit, and future climate claims under the Green Claims proposal and Directive (EU) 2024/825. - [FAQ: PEF and OEF evidence requirements for EU Green Claims](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/pef-and-oef-evidence.md): FAQ on when Product and Organisation Environmental Footprint methods help substantiate EU environmental claims, including scope, data quality, and method limits. - [EU Green Claims penalties and enforcement FAQ](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/penalties.md): FAQ on EU Green Claims penalty risk, Council and proposal enforcement principles, UCPD overlap, and evidence that reduces greenwashing risk. - [Product vs company claims under the EU Green Claims Directive](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/product-vs-company-claims.md): FAQ guidance on separating product, service, and company environmental claims under the EU Green Claims proposal, with substantiation and communication boundaries. - [EU Green Claims Directive proposal status FAQ](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/proposal-status.md): Current cited status of the EU Green Claims Directive proposal: Commission proposal, Parliament first reading, Council general approach, and procedure records. - [How do the UCPD, Directive (EU) 2024/825, and Green Claims proposal overlap?](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/ucpd-and-empowering-consumers-overlap.md): FAQ on how Directive (EU) 2024/825 changes UCPD greenwashing rules and how the Green Claims proposal would add substantiation, communication, labels, and verification detail. - [Verifier workflow under the EU Green Claims Directive](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/verifier-workflow.md): FAQ on the proposed EU Green Claims verifier workflow: substantiation, ex-ante verification, verifier requirements, certificates, and proposal-stage caveats. - [EU Green Claims Directive FAQ: scope, evidence, labels, offsets, and status](https://www.sorena.io/artifacts/eu/green-claims-directive/faq.md): Direct answers on the EU Green Claims Directive proposal, explicit environmental claims, substantiation, labels, offsets, PEF/OEF evidence, UCPD overlap, and penalties. - [Green Claims Directive vs Empowering Consumers Directive](https://www.sorena.io/artifacts/eu/green-claims-directive/green-claims-directive-vs-empowering-consumers-directive.md): Compare the Green Claims proposal with Directive (EU) 2024/825: ex-ante substantiation and verification versus adopted UCPD amendments on generic claims, future performance, labels, and timing. - [EU Green Claims Directive vs FTC Green Guides](https://www.sorena.io/artifacts/eu/green-claims-directive/green-claims-directive-vs-ftc-green-guides.md): A scope-bounded comparison focused on the EU Green Claims proposal: scope, substantiation, verification, labels, offsets, and reusable evidence. - [Green Claims Directive vs ISO 14021](https://www.sorena.io/artifacts/eu/green-claims-directive/green-claims-directive-vs-iso-14021.md): Compare the proposed EU Green Claims Directive with ISO 14021 for voluntary environmental claims, substantiation, self-declared labels, evidence, and verification. - [Green Claims Directive vs UK Green Claims Code](https://www.sorena.io/artifacts/eu/green-claims-directive/green-claims-directive-vs-uk-green-claims-code.md): Compare the EU Green Claims Directive proposal with the UK Green Claims Code, covering substantiation, communication, labels, offsets, verification, enforcement, and evidence. - [EU Green Claims Directive Substantiation Template](https://www.sorena.io/artifacts/eu/green-claims-directive/green-claims-substantiation-template.md): A field-by-field template for substantiating EU explicit environmental claims with claim scope, evidence, method, PEF/OEF, comparison, carbon-credit, verification, and publication records. - [Greenwashing risk checklist for EU green claims](https://www.sorena.io/artifacts/eu/green-claims-directive/greenwashing-risk-checklist.md): A concrete EU greenwashing checklist for marketing, product, legal, and sustainability teams reviewing vague claims, evidence gaps, offsets, labels, comparisons, and future targets. - [Green Claims labels and certification schemes](https://www.sorena.io/artifacts/eu/green-claims-directive/labels-and-certification-schemes.md): How EU Green Claims rules and Directive (EU) 2024/825 treat environmental labels, certification schemes, EU Ecolabel use, new schemes, evidence records, and consumer-facing clarity. - [Carbon offsets and carbon-neutral claims: EU Green Claims Directive requirements](https://www.sorena.io/artifacts/eu/green-claims-directive/offsets-and-carbon-neutral-claims.md): How to handle carbon-neutral, climate-neutral, compensated, and offset-backed claims under Directive (EU) 2024/825 and the Green Claims proposal. - [PEF and OEF evidence for EU green claims](https://www.sorena.io/artifacts/eu/green-claims-directive/pef-and-oef-evidence.md): How Product and Organisation Environmental Footprint studies can support EU green-claim substantiation without treating PEF or OEF as mandatory for every claim. - [Green Claims penalties and enforcement: proposal and Council approach](https://www.sorena.io/artifacts/eu/green-claims-directive/penalties-and-enforcement.md): How the EU Green Claims proposal and Council general approach handle competent authorities, corrective measures, penalties, verifiers, and UCPD overlap. - [Green Claims penalties and fines under the EU proposal](https://www.sorena.io/artifacts/eu/green-claims-directive/penalties-and-fines.md): cited summary of proposed Green Claims enforcement, corrective measures, penalty criteria, and the Council approach to maximum-fine language. - [EU Green Claims: Product vs Company Claims](https://www.sorena.io/artifacts/eu/green-claims-directive/product-vs-company-claims.md): Compare product, service, and company environmental claims under the EU Green Claims proposal: scope, evidence, significant impacts, communication, and reuse limits. - [EU Green Claims Directive Proposal Status and Legislative Tracker](https://www.sorena.io/artifacts/eu/green-claims-directive/proposal-status-and-legislative-tracker.md): Track COM(2023) 166 and procedure 2023/0085(COD) through public EUR-Lex, OEIL, Parliament, and Council files without treating the proposal as adopted law. - [Green Claims Directive proposal status check workflow](https://www.sorena.io/artifacts/eu/green-claims-directive/proposal-status-check-workflow.md): A cited workflow for checking the Green Claims Directive proposal status across OEIL, EUR-Lex, Council documents, and Parliament records. - [EU Green Claims Directive proposal requirements](https://www.sorena.io/artifacts/eu/green-claims-directive/requirements.md): cited summary of proposed EU Green Claims requirements for explicit environmental claims, substantiation, communication, verification, labels, comparisons, and Directive (EU) 2024/825 overlap. - [Green Claims substantiation evidence pack](https://www.sorena.io/artifacts/eu/green-claims-directive/substantiation-and-evidence-pack.md): Build a cited evidence pack for EU Green Claims: claim inventory, scientific substantiation, life-cycle impacts, PEF or OEF records, comparisons, labels, offsets, verification, and traceability. - [EU Green Claims Templates for Claim Evidence and Verification](https://www.sorena.io/artifacts/eu/green-claims-directive/templates.md): Reusable templates for EU green-claim substantiation, verifier handoff, evidence inventory, sustainability labels, comparative claims, and Directive (EU) 2024/825 status checks. - [EU Green Claims Verification and Audit Readiness](https://www.sorena.io/artifacts/eu/green-claims-directive/verification-and-audit-readiness.md): Prepare explicit environmental claims for substantiation review, verifier handoff, source traceability, communication checks, and proposal-stage caveats. - [Green Claims verifier workflow for explicit environmental claims](https://www.sorena.io/artifacts/eu/green-claims-directive/verifier-workflow.md): A concrete verifier-preparation workflow for voluntary explicit environmental claims: claim boundaries, substantiation evidence, verifier package, certificate handling, and change reviews. - [What Counts as a Green Claim Under the EU Green Claims Proposal](https://www.sorena.io/artifacts/eu/green-claims-directive/what-counts-as-a-green-claim.md): cited scope guide to explicit environmental claims under the EU Green Claims proposal and related Directive (EU) 2024/825 concepts. - [LVD Annex II exclusions under Directive 2014/35/EU](https://www.sorena.io/artifacts/eu/low-voltage-directive/annex-ii-exclusions.md): Practical EU Low Voltage Directive guide to Annex II excluded equipment, boundary cases, and records to keep when a product is outside LVD scope. - [EU Low Voltage Directive applicability test](https://www.sorena.io/artifacts/eu/low-voltage-directive/applicability-test.md): Check whether electrical equipment falls under the EU Low Voltage Directive by voltage rating, Annex II exclusions, components, evaluation kits, batteries, CE marking, and adjacent EU product rules. - [LVD Compliance Checklist](https://www.sorena.io/artifacts/eu/low-voltage-directive/checklist.md): EU Low Voltage Directive checklist covering scope, safety objectives, standards, technical documentation, EU declaration, CE marking, labelling, traceability, and post-market duties. - [LVD combined CE files for multi-regime products](https://www.sorena.io/artifacts/eu/low-voltage-directive/combined-ce-files.md): How to keep EU declarations, standards, risk assessments, instructions, labels, and technical documentation aligned when LVD products also trigger EMC, RED, RoHS, machinery, or market-surveillance checks. - [EU Low Voltage Directive compliance guide](https://www.sorena.io/artifacts/eu/low-voltage-directive/compliance.md): Concrete LVD compliance guide covering scope, safety objectives, manufacturer duties, internal production control, EU declaration, CE marking, technical documentation, labels, importer and distributor checks, and post-market action. - [LVD conformity assessment and CE marking](https://www.sorena.io/artifacts/eu/low-voltage-directive/conformity-assessment-and-ce.md): EU Low Voltage Directive guide to internal production control, technical documentation, harmonised standards, EU declarations of conformity, and CE placement. - [EU Low Voltage Directive deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/low-voltage-directive/deadlines-and-compliance-calendar.md): Calendar checkpoints for LVD 2014/35/EU: current-law status, release evidence gates, OJEU standard withdrawals, 10-year records, and post-market triggers. - [LVD Essential Safety Hazards and Objectives](https://www.sorena.io/artifacts/eu/low-voltage-directive/essential-safety-hazards.md): EU Low Voltage Directive hazard map for Annex I safety objectives: electrical contact, heat, arcs, radiation, insulation, assembly, overload, mechanical, environmental, and foreseeable-use risks. - [LVD Essential Safety Requirements](https://www.sorena.io/artifacts/eu/low-voltage-directive/essential-safety-requirements.md): Annex I safety objectives under the EU Low Voltage Directive: safe construction, markings, instructions, electrical hazards, external influences, insulation, temperature, and technical-file evidence. - [EU Low Voltage Directive exclusion triage workflow](https://www.sorena.io/artifacts/eu/low-voltage-directive/exclusion-triage-workflow.md): A concrete LVD exclusion triage workflow for voltage scope, Annex II exclusions, components, evaluation kits, radio equipment, EMC, Machinery, and evidence records. - [Which AC and DC voltage thresholds bring equipment into the Low Voltage Directive?](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/ac-and-dc-thresholds.md): LVD FAQ explaining the 50-1000 V AC and 75-1500 V DC scope thresholds, input and output ratings, exclusions, and common product edge cases. - [When are battery-powered products covered by the Low Voltage Directive?](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/battery-powered-products.md): LVD FAQ explaining when battery-only products, bundled chargers, adapters, external power supplies, and integrated supplies fall inside or outside Directive 2014/35/EU. - [Are chargers and power adapters covered by the EU Low Voltage Directive?](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/chargers-and-adapters.md): LVD FAQ for chargers, external power supplies, travel adapters, CE marking, technical documentation, instructions, harmonised standards, and EMC, RED, and RoHS overlap. - [Are components covered by the Low Voltage Directive?](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/components.md): How the LVD treats basic components, electrical components intended for incorporation, CE marking, and evidence for finished electrical equipment. - [Household Appliances under the Low Voltage Directive](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/household-appliances.md): FAQ on how household and similar electrical appliances are treated under the EU Low Voltage Directive, including scope, safety objectives, CE marking, documentation, standards, and operator roles. - [LVD importer obligations FAQ](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/importers.md): What importers must check before placing LVD electrical equipment on the EU market: conformity assessment, CE marking, EU declaration, traceability, storage, corrective action, and authority cooperation. - [LVD instructions and labelling requirements](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/instructions-and-labelling.md): What the Low Voltage Directive requires for instructions, safety information, traceability, manufacturer/importer labels, CE marking, and retained evidence. - [LVD spare parts FAQ](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/spare-parts.md): How to handle spare parts under the EU Low Voltage Directive when a part is electrical equipment, built into finished equipment, imported, modified, or documented for repair. - [What happens when an LVD harmonised standard is withdrawn or replaced?](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/standards-withdrawal.md): How LVD manufacturers should handle OJEU standard withdrawals, replacement references, presumption of conformity, technical documentation updates, and transition dates. - [EU Low Voltage Directive FAQ: scope, duties, CE marking](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq.md): Answers to practical LVD questions on voltage limits, Annex II exclusions, batteries, chargers, components, economic operators, instructions, standards, CE marking, and post-market controls. - [LVD harmonised standard update workflow](https://www.sorena.io/artifacts/eu/low-voltage-directive/harmonized-standard-update-impact-workflow.md): Workflow for checking Low Voltage Directive harmonised standard updates, affected products, withdrawal dates, presumption of conformity, retesting, technical files, and declarations. - [LVD Harmonised Standards and OJEU Citations](https://www.sorena.io/artifacts/eu/low-voltage-directive/harmonized-standards.md): Track Low Voltage Directive harmonised standards by OJEU reference, presumption of conformity, restrictions, withdrawals, replacements, and technical-file evidence. - [LVD Internal Production Control: Module A Evidence](https://www.sorena.io/artifacts/eu/low-voltage-directive/internal-production-control.md): How manufacturers document Low Voltage Directive Module A: technical documentation, safety objectives, harmonised standards, EU declaration, CE marking, and production controls. - [Low Voltage Directive vs EMC Directive: safety and EMC comparison](https://www.sorena.io/artifacts/eu/low-voltage-directive/low-voltage-directive-vs-emc-directive.md): Compare the EU Low Voltage Directive and EMC Directive by scope, safety objectives, electromagnetic disturbance, immunity, CE marking, declarations, documentation, and standards. - [Low Voltage Directive vs Machinery Regulation boundary](https://www.sorena.io/artifacts/eu/low-voltage-directive/low-voltage-directive-vs-machinery-regulation.md): Official source comparison of the LVD and EU machinery law boundary for electrical equipment, machine electrical hazards, control gear, documentation, and CE marking. - [LVD Conformity Assessment Template](https://www.sorena.io/artifacts/eu/low-voltage-directive/lvd-conformity-assessment-template.md): Template fields for documenting Low Voltage Directive scope, Annex I safety objectives, standards, technical documentation, EU declaration, CE marking, and production control evidence. - [LVD vs MSR: Low Voltage Directive and Market Surveillance Regulation](https://www.sorena.io/artifacts/eu/low-voltage-directive/lvd-vs-msr.md): Compare LVD electrical-equipment conformity duties with Regulation (EU) 2019/1020 market surveillance, economic-operator cooperation, corrective action, online sales, and border controls. - [LVD vs RED: electrical safety and radio equipment scope](https://www.sorena.io/artifacts/eu/low-voltage-directive/lvd-vs-red.md): Compare the Low Voltage Directive and Radio Equipment Directive for electrical safety, radio scope, CE files, chargers, adapters, and harmonised standards. - [LVD vs RoHS: electrical safety vs substance restriction](https://www.sorena.io/artifacts/eu/low-voltage-directive/lvd-vs-rohs.md): Compare LVD and RoHS at the CE file boundary: electrical safety evidence, hazardous-substance restriction, declarations, standards, and documentation overlap. - [LVD penalties and enforcement](https://www.sorena.io/artifacts/eu/low-voltage-directive/penalties-and-fines.md): How penalties and enforcement work under the EU Low Voltage Directive: Member State penalty rules, market surveillance action, recalls, restrictions, and cooperation. - [EU Low Voltage Directive post-market controls](https://www.sorena.io/artifacts/eu/low-voltage-directive/post-market-controls.md): LVD post-market controls for corrective action, recalls, complaints, technical documentation, EU declarations, authority cooperation, and 2019/1020 market surveillance. - [LVD release evidence gates workflow](https://www.sorena.io/artifacts/eu/low-voltage-directive/release-evidence-gates-workflow.md): Product-release gates for EU Low Voltage Directive evidence: voltage scope, safety objectives, standards, technical documentation, EU declaration, CE marking, labelling, production control, operator checks, and post-market triggers. - [EU Low Voltage Directive requirements](https://www.sorena.io/artifacts/eu/low-voltage-directive/requirements.md): LVD requirements for voltage scope, Annex I safety objectives, economic operator duties, internal production control, technical files, EU declarations, CE marking, standards, and market surveillance. - [EU Low Voltage Directive scope and covered products](https://www.sorena.io/artifacts/eu/low-voltage-directive/scope-and-products.md): Scope notes for the EU Low Voltage Directive: voltage limits, Annex II exclusions, components, chargers, adapters, and boundaries with RED, Machinery, and EMC rules. - [EU LVD standard selection and OJEU checks](https://www.sorena.io/artifacts/eu/low-voltage-directive/standard-selection.md): How to select Low Voltage Directive harmonised standards, check OJEU status, map Annex I safety objectives, and document alternatives in the technical file. - [LVD Technical Documentation Checklist](https://www.sorena.io/artifacts/eu/low-voltage-directive/technical-documentation.md): What to keep in EU Low Voltage Directive technical documentation: product identity, design and manufacturing records, risk assessment, standards, tests, declaration, CE marking, instructions, and authority access. - [LVD voltage scope triage workflow](https://www.sorena.io/artifacts/eu/low-voltage-directive/voltage-scope-triage-workflow.md): A concrete Low Voltage Directive scope workflow for AC/DC thresholds, intended-use claims, Annex II exclusions, components, chargers, adapters, and RED, EMC, or Machinery routing. - [LVD voltage thresholds: 50-1000 V AC and 75-1500 V DC](https://www.sorena.io/artifacts/eu/low-voltage-directive/voltage-thresholds.md): How the EU Low Voltage Directive voltage limits work for rated input and output voltage, battery-powered equipment, chargers, Annex II exclusions, and RED, EMC, or Machinery routing. - [Machinery Regulation Annex I high-risk categories](https://www.sorena.io/artifacts/eu/machinery-regulation/annex-i-and-high-risk-machinery.md): Explain what Annex I does under Regulation (EU) 2023/1230, which listed machinery categories trigger special conformity routes, and what evidence to keep. - [Machinery Regulation Annex I conformity route workflow](https://www.sorena.io/artifacts/eu/machinery-regulation/annex-i-route-workflow.md): Classify machinery against Annex I Part A and Part B, choose the Article 25 conformity assessment route, and assemble the technical evidence file. - [EU Machinery Regulation Applicability Test](https://www.sorena.io/artifacts/eu/machinery-regulation/applicability-test.md): Test whether a product is machinery, a related product, partly completed machinery, a safety component, substantially modified, excluded, or covered by overlapping EU product laws. - [EU Machinery Regulation: autonomous mobile and collaborative machinery](https://www.sorena.io/artifacts/eu/machinery-regulation/autonomous-mobile-and-collaborative-machinery.md): Official source guide to Regulation (EU) 2023/1230 requirements for autonomous mobile machinery, human-machine interaction, controls, software, cybersecurity, risk assessment, technical documentation, and conformity routes. - [Machinery Regulation category and scope checks](https://www.sorena.io/artifacts/eu/machinery-regulation/category-and-scope-workflow.md): Check whether a product is machinery, a related product, partly completed machinery, a safety component, excluded from scope, or listed in Annex I under Regulation (EU) 2023/1230. - [EU Machinery Regulation compliance checklist](https://www.sorena.io/artifacts/eu/machinery-regulation/checklist.md): Checklist for Regulation (EU) 2023/1230 covering scope, EHSR risk assessment, technical documentation, instructions, conformity assessment, EU declarations, CE marking, digital duties, transition, and market surveillance. - [EU Machinery Regulation compliance](https://www.sorena.io/artifacts/eu/machinery-regulation/compliance.md): Machinery Regulation compliance checklist covering scope, EHSR risk assessment, technical documentation, instructions, conformity assessment, EU declarations, CE marking, software, transition, and market surveillance. - [Machinery Regulation conformity assessment and CE marking](https://www.sorena.io/artifacts/eu/machinery-regulation/conformity-assessment-and-ce.md): EU Machinery Regulation guide to Article 25 conformity assessment routes, Annex I machinery categories, technical documentation, EU declarations, CE marking, and instructions. - [EU Machinery Regulation deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/machinery-regulation/deadlines-and-compliance-calendar.md): Calendar for Regulation (EU) 2023/1230 dates, Directive 2006/42/EC transition, release documentation gates, standards monitoring, and substantial-modification reviews. - [Machinery Regulation digital instructions](https://www.sorena.io/artifacts/eu/machinery-regulation/digital-instructions.md): EU Machinery Regulation guide to digital instructions for use: access marking, print and download access, paper copies, non-professional safety information, languages, and records. - [Machinery Regulation and EU AI Act overlap for AI-enabled safety functions](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/ai-act-overlap.md): FAQ on Machinery Regulation overlap with the EU AI Act for self-evolving or machine-learning safety functions, Annex I categories, standards work, and technical documentation boundaries. - [How to map Annex III EHSRs under the EU Machinery Regulation](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/annex-iii-ehsr.md): FAQ on mapping Annex III essential health and safety requirements to hazards, risk reduction, software controls, technical documentation, and Annex I classification under Regulation (EU) 2023/1230. - [Which Article 25 conformity assessment module applies?](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/article-25-modules.md): FAQ on Article 25 of Regulation (EU) 2023/1230: Module A, Module B plus C, Module H, Module G, Annex I triggers, notified body involvement, and technical file evidence. - [Machinery Regulation cybersecurity evidence FAQ](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/cybersecurity.md): What cybersecurity evidence connected or software-enabled machinery should keep for protection against corruption, safety-related control systems, and machinery risk assessment. - [Declaration of Conformity vs Declaration of Incorporation](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/doc-and-doi.md): FAQ on when machinery needs an EU Declaration of Conformity and when partly completed machinery needs an EU Declaration of Incorporation under Regulation (EU) 2023/1230. - [What counts as machinery under Regulation (EU) 2023/1230?](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/machinery-definition.md): FAQ on the Machinery Regulation definition of machinery, including assemblies, drive systems, missing components, software, related products, partly completed machinery, safety components, and exclusions. - [When is a notified body needed under the EU Machinery Regulation?](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/notified-bodies.md): FAQ on when Machinery Regulation Annex I products need a notified body, how to find designated bodies, and what manufacturers still own. - [When can a software update affect Machinery Regulation compliance?](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/software-updates.md): FAQ on when machinery software updates can trigger Machinery Regulation review, including safety functions, substantial modification, corruption protection, instructions, and CE technical-file evidence. - [When does used or modified machinery need a new conformity assessment?](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/used-and-modified-machinery.md): FAQ on used and modified machinery under Regulation (EU) 2023/1230, including substantial modification, first EU use, technical documentation, and market surveillance evidence. - [EU Machinery Regulation FAQ](https://www.sorena.io/artifacts/eu/machinery-regulation/faq.md): Answers to Machinery Regulation questions on scope, partly completed machinery, Annex I categories, Article 25 conformity assessment, digital instructions, software, cybersecurity, transition, CE files, and overlap with other EU product laws. - [Machinery CE documentation template for Regulation (EU) 2023/1230](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-ce-documentation-template.md): Template fields for Machinery Regulation CE documentation: product identity, scope, EHSR risk assessment, standards, tests, instructions, EU declaration, CE marking, notified body route, software, cyber, and substantial modification checks. - [Machinery Regulation vs EU AI Act: machinery safety overlap](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-regulation-vs-eu-ai-act.md): A cited-source comparison of the EU Machinery Regulation and EU AI Act for machinery with AI-enabled safety functions, software, cyber-safety and technical documentation overlap. - [Machinery Regulation vs Machinery Directive](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-regulation-vs-machinery-directive.md): Official source comparison of Regulation (EU) 2023/1230 and Directive 2006/42/EC across legal form, timing, scope, digital instructions, cybersecurity, conformity assessment, documentation, and CE marking. - [Machinery Regulation vs EMC Directive](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-vs-emc.md): Compare EU machinery safety duties with EMC duties for equipment, CE documentation, harmonised standards, declarations, and combined technical files. - [EU Machinery Regulation vs LVD](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-vs-lvd.md): Compare the EU Machinery Regulation and Low Voltage Directive boundary for machinery EHSRs, electrical risks, excluded electrical products, CE documentation, and evidence reuse. - [EU Machinery Regulation vs Market Surveillance Regulation: compliance comparison](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-vs-msr.md): Compare Machinery Regulation product compliance duties with EU MSR market surveillance duties, authority requests, online sales, corrective action and evidence records. - [Machinery vs RED comparison](https://www.sorena.io/artifacts/eu/machinery-regulation/machinery-vs-red.md): Compare EU Machinery Regulation and Radio Equipment Directive boundaries for machinery safety, radio equipment scope, CE documentation, and shared evidence. - [EU Machinery Regulation Partly Completed Machinery](https://www.sorena.io/artifacts/eu/machinery-regulation/partly-completed-machinery.md): What counts as partly completed machinery under Regulation (EU) 2023/1230, what documents travel with it, and where the final assembler takes over. - [Machinery Regulation penalties and enforcement](https://www.sorena.io/artifacts/eu/machinery-regulation/penalties-and-fines.md): EU Machinery Regulation enforcement guide covering Member State penalty rules, corrective action, market surveillance powers, and cross-border authority cooperation. - [Machinery Regulation related products scope guide](https://www.sorena.io/artifacts/eu/machinery-regulation/related-products.md): Classify EU Machinery Regulation related products, including interchangeable equipment, safety components, lifting accessories, lifting chains, ropes, webbing, and removable transmission devices. - [EU Machinery Regulation requirements](https://www.sorena.io/artifacts/eu/machinery-regulation/requirements.md): Requirements under Regulation (EU) 2023/1230: machinery scope, EHSR risk assessment, technical documentation, instructions, conformity assessment, EU declaration, CE marking, software evidence, transition, and surveillance. - [EU Machinery Risk Assessment Method](https://www.sorena.io/artifacts/eu/machinery-regulation/risk-assessment-method.md): How to document an EU Machinery Regulation risk assessment: ISO 12100 hazard identification, EHSR mapping, risk reduction, residual risk, software, cybersecurity, and technical-file evidence. - [EU Machinery Regulation Safety Components](https://www.sorena.io/artifacts/eu/machinery-regulation/safety-components.md): Definition, scope, conformity assessment, technical documentation, declaration, CE marking, and cited examples for safety components under Regulation (EU) 2023/1230. - [EU Machinery Regulation scope and machine categories](https://www.sorena.io/artifacts/eu/machinery-regulation/scope-and-machine-categories.md): Scope guide for Regulation (EU) 2023/1230 covering machinery, related products, partly completed machinery, Annex I categories, exclusions, substantial modification, and category evidence. - [Machinery Regulation software and cybersecurity considerations](https://www.sorena.io/artifacts/eu/machinery-regulation/software-and-cybersecurity-considerations.md): How Regulation (EU) 2023/1230 treats safety-related software, control systems, corruption protection, technical documentation, and cyber-safety risk evidence. - [EU Machinery Regulation substantial modification decision workflow](https://www.sorena.io/artifacts/eu/machinery-regulation/substantial-modification-workflow.md): Workflow for assessing substantial modification under Regulation (EU) 2023/1230: change facts, hazard and risk impact, manufacturer obligations, conformity assessment, CE marking, and evidence. - [EU Machinery Regulation: when does a modification constitute substantial modification?](https://www.sorena.io/artifacts/eu/machinery-regulation/substantial-modification.md): Guide to substantial modification under Regulation (EU) 2023/1230: change triggers, risk assessment, EHSRs, technical documentation, conformity assessment, CE marking, and records. - [Machinery Regulation Technical Documentation and Technical File](https://www.sorena.io/artifacts/eu/machinery-regulation/technical-documentation-and-technical-file.md): What to keep in the EU Machinery Regulation technical file: product identification, risk assessment, EHSR mapping, standards, tests, instructions, declarations, software evidence, retention, and notified-body records. - [Machinery Regulation technical file acceptance workflow](https://www.sorena.io/artifacts/eu/machinery-regulation/technical-file-acceptance-workflow.md): Release-gate workflow for accepting an EU Machinery Regulation technical file: scope, EHSR risk evidence, standards, tests, declarations, notified-body records, software, cyber, and signoff. - [Machinery Regulation Timeline and Transition: practical guide](https://www.sorena.io/artifacts/eu/machinery-regulation/timeline-and-transition.md): EU Machinery Regulation guide to Timeline and Transition with scope decisions, owner actions, evidence records, cited citations, and practical next steps. - [Directive 2006/42/EC to Machinery Regulation transition](https://www.sorena.io/artifacts/eu/machinery-regulation/transition-from-directive-2006-42-ec.md): Transition guide for moving EU machinery files from Directive 2006/42/EC to Regulation (EU) 2023/1230, focused on the 20 January 2027 changeover, pipeline products, declarations, standards, technical documentation, software, cybersecurity, and digital instructions. - [EU MSR Applicability Test](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/applicability-test.md): Test whether Regulation (EU) 2019/1020 applies to a product, including Union harmonisation scope, EU distance sales, Article 4 operator duties, and evidence checks. - [EU MSR Article 4: who is the responsible economic operator?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/article-4-responsible-economic-operator.md): Article 4 guide for products needing an EU responsible economic operator under Regulation (EU) 2019/1020, including roles, contact display, documentation, cooperation, and evidence. - [EU MSR Article 4 setup workflow](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/article-4-setup-workflow.md): Set up Article 4 compliance for covered EU harmonised products: confirm scope, assign the EU economic operator, verify contact details, collect DoC and technical-documentation evidence, and prepare authority and import-release records. - [EU MSR Article 6 distance sales and online offers](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/article-6-distance-sales.md): How Regulation (EU) 2019/1020 Article 6 treats online and distance-sales offers as made available on the EU market, including targeting indicators, marketplaces, Article 4 operator checks, and evidence to retain. - [EU MSR Authority Evidence Requests](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/authority-evidence-requests.md): How to prepare responses to EU market surveillance authority requests for declarations, technical documentation, product data, test evidence, samples, and corrective-action records. - [EU MSR authority request response playbook](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/authority-request-response-playbook.md): Practical EU Market Surveillance Regulation playbook for triaging authority requests, compiling documentation, handling samples, checking Article 4 contacts, and preserving evidence. - [EU MSR border hold response workflow](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/border-hold-response-workflow.md): Workflow for responding to an EU customs suspension under Regulation (EU) 2019/1020, with Article 4 contact checks, evidence pack contents, release paths, and refusal outcomes. - [EU Market Surveillance Regulation Checklist](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/checklist.md): Practical EU MSR checklist for Union harmonisation scope, Article 4 responsible operators, distance sales, labels, technical documentation, authority requests, border controls, corrective actions, ICSMS, and Safety Gate awareness. - [EU MSR Compliance Obligations](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/compliance.md): EU Market Surveillance Regulation compliance guide covering Article 4 responsible operators, distance sales, authority requests, technical documentation, customs holds, and corrective action records. - [EU MSR corrective-action escalation workflow](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/corrective-action-escalation-workflow.md): Concrete EU Market Surveillance Regulation workflow for non-compliance findings, voluntary corrective action, authority measures, serious-risk escalation, ICSMS, Safety Gate, and records. - [EU MSR Corrective Actions](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/corrective-actions.md): How Regulation (EU) 2019/1020 handles corrective action: operator remedies, withdrawal, recall, authority measures, serious-risk escalation, ICSMS, Safety Gate, and evidence records. - [EU MSR customs and border controls](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/customs-and-border-controls.md): Customs control guide for Regulation (EU) 2019/1020: suspension triggers, release and refusal outcomes, Article 4 checks, and importer evidence records. - [EU Market Surveillance Regulation deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/deadlines-and-compliance-calendar.md): Official source Regulation (EU) 2019/1020 calendar covering application dates, Article 4 checks, online sales, authority requests, border holds, documentation readiness, and corrective action triggers. - [EU MSR Enforcement Powers and Penalties](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/enforcement-powers-and-penalties.md): cited guide to Regulation (EU) 2019/1020 enforcement powers: investigations, testing, corrective measures, serious-risk action, border refusals, coordination, and Member State penalties. - [EU MSR: EUPCN, ICSMS, and Safety Gate](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/eupcn-icsms-and-safety-gate.md): How the EU Product Compliance Network, ICSMS, and Safety Gate fit together under EU market surveillance, with practical evidence and response steps for operators. - [What corrective actions can market surveillance authorities require under Regulation (EU) 2019/1020?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/corrective-action.md): Concise EU MSR FAQ on corrective action triggers, voluntary measures, authority restrictions, serious-risk escalation, and records. - [What should importers do when customs holds a product under EU MSR?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/customs-holds.md): EU MSR FAQ on customs holds, release or refusal context, Article 4 contact checks, documentation evidence, and operator response. - [How does Regulation (EU) 2019/1020 apply to Distance Sales into the EU?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/distance-sales.md): How EU MSR Article 6 treats online and distance-sale offers targeted at EU end users, with Article 4 and evidence implications. - [When can a fulfilment service provider be the EU Article 4 operator?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/fulfilment-service-providers.md): EU MSR FAQ on when a fulfilment service provider can be the Article 4 economic operator, what fulfilment services mean, and what sellers should verify. - [EU MSR online listings FAQ: Article 6 and Article 4 evidence](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/online-listings.md): FAQ on when online offers are treated as EU market availability under the EU Market Surveillance Regulation and what Article 4 responsible-operator evidence should be ready. - [What penalties can apply under EU market surveillance rules?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/penalties.md): How Regulation (EU) 2019/1020 treats market-surveillance enforcement, corrective measures, serious-risk action, and Member State penalties. - [How should companies respond to an EU market surveillance documentation request?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/product-documentation-requests.md): EU MSR FAQ on responding to product documentation requests, including Article 4 operator tasks, DoC and technical-file access, cooperation, language, and evidence to keep. - [FAQ: EU MSR Article 4 responsible person and economic operator duties](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/responsible-person.md): When Article 4 of Regulation (EU) 2019/1020 requires an EU-established responsible economic operator, who can serve, what must be shown, and what sellers should verify. - [What counts as a Serious Risk under EU market surveillance rules?](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/serious-risk.md): EU MSR FAQ explaining serious risk, authority measures, Safety Gate/ICSMS awareness, and operator evidence under Regulation (EU) 2019/1020. - [EU Market Surveillance Regulation FAQ](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq.md): Concise FAQ on Regulation (EU) 2019/1020: Article 4 economic operators, distance sales, authority requests, customs controls, corrective action, serious risk, ICSMS, Safety Gate, and EUPCN. - [EU MSR Investigations and Evidence Requests](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/investigations-and-evidence-requests.md): How to handle EU Market Surveillance Regulation investigation requests, technical-documentation demands, samples, Article 4 contacts, cooperation, escalation, and evidence records. - [EU MSR market surveillance for online marketplaces](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/market-surveillance-for-online-marketplaces.md): How online marketplaces and sellers should evidence EU targeting, Article 4 responsible economic operator checks, product listing data, authority requests, and corrective action under Regulation (EU) 2019/1020. - [Market Surveillance Regulation vs GPSR](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/market-surveillance-regulation-vs-gpsr.md): Official source comparison of Regulation (EU) 2019/1020 and the General Product Safety Regulation for harmonised products, consumer safety, online marketplaces, Safety Gate, customs controls, and corrective actions. - [EU MSR Authority Request Triage Workflow](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/msa-request-triage-workflow.md): A concrete EU Market Surveillance Regulation workflow for handling market surveillance authority requests, evidence packs, Article 4 contacts, samples, risk escalation, corrective action, and records. - [Regulation (EU) 2019/1020 vs Blue Guide: binding rules and guidance](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/msr-vs-blue-guide.md): Compare binding MSR market-surveillance, customs, and Article 4 duties with Blue Guide guidance on EU product rules, economic operators, CE marking, declarations, and technical files. - [EU Market Surveillance Regulation vs Decision No 768/2008/EC: side-by-side comparison](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/msr-vs-decision-768-2008.md): Compare Regulation (EU) 2019/1020 market-surveillance controls with Decision No 768/2008/EC product-marketing, CE marking, EU declaration, and conformity-assessment concepts. - [EU MSR vs DSA: cautious marketplace boundary comparison](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/msr-vs-dsa.md): MSR-cited-source comparison of EU product compliance, Article 4, distance sales, marketplace workflows, customs controls, and when DSA questions need separate sourcing. - [MSR vs EMC, LVD, RED, and RoHS](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/msr-vs-emc-lvd-red-rohs.md): Compare the EU Market Surveillance Regulation with EMC, LVD, RED, and RoHS: surveillance, customs, Article 4 operators, technical files, DoC, CE marking, and evidence requests. - [EU MSR online marketplace surveillance](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/online-marketplace-surveillance.md): How EU market surveillance applies to online listings, targeted distance sales, Article 4 responsible-operator evidence, authority requests, and serious-risk escalation. - [EU MSR online sales and marketplaces](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/online-sales-and-marketplaces.md): How Regulation (EU) 2019/1020 treats online offers, EU targeting, Article 4 responsible economic operators, listing evidence, authority requests, and corrective action. - [EU MSR penalties and fines: Article 41 enforcement risk](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/penalties-and-fines.md): EU Market Surveillance Regulation penalties guide covering Article 41 Member State penalty-setting, authority measures, restrictions, withdrawal, recall, customs holds, and documentation failures. - [EU Market Surveillance Regulation requirements](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/requirements.md): MSR requirements for Article 4 responsible economic operators, distance sales, authority requests, technical documentation, customs holds, corrective action, ICSMS, and Safety Gate. - [EU MSR Article 4 responsible person: practical duties and compliance obligations](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/responsible-person-and-economic-operator-duties.md): Article 4 EU Market Surveillance Regulation guide covering eligible EU responsible economic operators, contact display, documentation access, and authority cooperation. - [EU MSR sector regulation interfaces](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/sector-regulation-interfaces.md): How the EU Market Surveillance Regulation connects with sector product laws: Union harmonisation coverage, Article 4 operators, technical files, DoC, CE marking, customs controls, serious risk, and corrective action. - [EU MSR Union testing facilities](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/union-testing-facilities.md): What Union testing facilities do under Regulation (EU) 2019/1020, who they serve, how market surveillance authorities use testing, and how they differ from notified bodies. - [What Regulation (EU) 2019/1020 changes](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/what-market-surveillance-changes.md): Concrete changes introduced by the EU Market Surveillance Regulation: Article 4 responsible economic operators, distance sales, authority powers, border controls, corrective action, ICSMS, Safety Gate, and EUPCN coordination. - [EU MDR Annex II and III Technical Documentation](https://www.sorena.io/artifacts/eu/medical-device-regulation/annex-ii-and-iii-technical-documents.md): Build an MDR technical documentation index for Annex II device files and Annex III post-market surveillance evidence, including GSPR, risk, clinical, PMS, UDI, and EUDAMED records. - [EU MDR Annex VIII Classification Guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/annex-viii-classification.md): Classify EU MDR medical devices under Annex VIII using intended purpose, duration, invasiveness, active device and software rules, and conformity assessment impact. - [EU MDR Annex XVI products without a medical purpose](https://www.sorena.io/artifacts/eu/medical-device-regulation/annex-xvi-products.md): cited EU MDR guide for Annex XVI products: listed product groups, common specifications, clinical evidence, notified-body route, UDI, EUDAMED, PMS, and vigilance evidence before launch. - [EU MDR Applicability Test](https://www.sorena.io/artifacts/eu/medical-device-regulation/applicability-test.md): Test whether a product, accessory, software function, or Annex XVI product falls under the EU Medical Device Regulation, and record the evidence for the next classification step. - [EU MDR change assessment workflow](https://www.sorena.io/artifacts/eu/medical-device-regulation/change-assessment-workflow.md): Assess EU MDR device, design, software, intended purpose, QMS, clinical, PMS, UDI, classification, and notified-body impacts before releasing a medical device change. - [EU MDR Checklist for Medical Device Compliance](https://www.sorena.io/artifacts/eu/medical-device-regulation/checklist.md): Practical EU MDR checklist covering qualification, classification, conformity assessment, technical documentation, GSPR, clinical evidence, UDI, EUDAMED, PMS, vigilance, QMS, and legacy transition evidence. - [EU MDR classification workflow](https://www.sorena.io/artifacts/eu/medical-device-regulation/classification-workflow.md): A concrete EU MDR classification workflow for intended purpose, device or accessory qualification, Annex VIII rule selection, Rule 11 software review, class outcome, and notified body impact. - [EU MDR Clinical Evaluation Overview](https://www.sorena.io/artifacts/eu/medical-device-regulation/clinical-evaluation-overview.md): EU MDR clinical evaluation overview covering Article 61, Annex XIV, clinical data sources, equivalence, PMCF, CER evidence, notified body review, GSPR, and benefit-risk support. - [EU MDR Clinical Evaluation Report Template](https://www.sorena.io/artifacts/eu/medical-device-regulation/clinical-evaluation-report-template.md): A cited EU MDR clinical evaluation report template covering intended purpose, GSPR linkage, clinical data appraisal, equivalence limits, PMCF, conclusions, and reviewer signoff. - [EU MDR clinical evidence guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/clinical-evidence.md): cited EU MDR guide to clinical evaluation, clinical investigations, equivalence, PMCF, GSPR support, technical documentation, and notified-body review. - [EU MDR compliance obligations](https://www.sorena.io/artifacts/eu/medical-device-regulation/compliance.md): EU MDR compliance guide for device qualification, classification, conformity assessment, QMS, technical documentation, UDI, EUDAMED, PMS, vigilance, and legacy transition controls. - [EU MDR conformity route workflow](https://www.sorena.io/artifacts/eu/medical-device-regulation/conformity-route-workflow.md): cited EU MDR workflow for classifying a device, choosing the conformity assessment route, preparing technical and QMS evidence, and reaching certificate, DoC, UDI, EUDAMED, and CE outputs. - [EU MDR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/medical-device-regulation/deadlines-and-compliance-calendar.md): Official source EU MDR calendar for application, legacy-device transition, UDI, EUDAMED, and recurring QMS, technical documentation, clinical, PMS, vigilance, certificate, and change reviews. - [EU MDR Device Classification Guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/device-classification-guide.md): Classify an EU MDR medical device by intended purpose, Annex VIII duration, invasiveness, active-device and software rules, then document the conformity route impact. - [EU MDR EUDAMED and UDI registration](https://www.sorena.io/artifacts/eu/medical-device-regulation/eudamed-and-udi.md): cited MDR guide to Basic UDI-DI, UDI-DI, EUDAMED device registration, actor roles, labels, technical documentation, and UDI data governance. - [When is an accessory regulated under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/accessories.md): EU MDR FAQ on when an article is a medical device accessory, how intended purpose affects classification, and what evidence to keep. - [What should manufacturers do when an EU MDR classification changes?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/class-changes.md): Concise EU MDR FAQ on classification changes, intended purpose, software, notified-body route impact, certificates, technical documentation, and retained evidence. - [Custom-made medical devices under the EU MDR](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/custom-made-devices.md): Concise EU MDR FAQ on custom-made device definition, mass-produced exclusions, Annex XIII statements, documentation, conformity assessment, PMS, vigilance, and records to retain. - [When can clinical equivalence be used under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/equivalence.md): EU MDR FAQ on clinical equivalence, including technical, biological, and clinical characteristics, access to equivalent-device data, class III and implantable-device limits, clinical evaluation, PMCF, and retained evidence. - [Which EUDAMED modules matter under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/eudamed-modules.md): EU MDR FAQ mapping EUDAMED modules to actor registration, UDI/device data, certificates, clinical investigations, vigilance/PMS, market surveillance, and practical records. - [When do software or products make medical purpose claims under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/medical-purpose-claims.md): EU MDR FAQ on medical purpose claims, intended purpose evidence, software qualification, Annex XVI contrasts, and records to keep. - [What should an EU MDR PMCF plan and report cover?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/pmcf.md): Under the EU MDR, PMCF is part of PMS and clinical evaluation. See what the plan, activities, report, updates, and retained evidence should cover. - [When is a PSUR required under the EU MDR and what should it contain?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/psur.md): EU MDR FAQ on PSUR scope, content, update cadence, PMS and PMCF links, notified-body handling, EUDAMED submission, and evidence to retain. - [EU MDR significant changes FAQ: legacy-device transition and notified-body review](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/significant-changes.md): FAQ on MDR significant changes for legacy devices, including intended-purpose, design, software, material, sterilisation, clinical, QMS, notified-body, and evidence impacts. - [When is software regulated as SaMD under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/software-and-samd.md): Concise EU MDR FAQ on software qualification, intended medical purpose, Rule 11 classification, modules, clinical evidence, change assessment, UDI, and EUDAMED. - [Which devices need an SSCP under the EU MDR and what should it include?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/sscp.md): EU MDR FAQ on when an SSCP is required, who prepares, validates, uploads, and updates it, and what evidence should support the summary. - [How should Basic UDI-DI and UDI-DI be assigned under the EU MDR?](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/udi-di-and-basic-udi-di.md): EU MDR FAQ explaining what Basic UDI-DI and UDI-DI identify, how they connect to UDI carriers, EUDAMED records, change triggers, and retained evidence. - [EU MDR FAQ: qualification, evidence, UDI, and transition](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq.md): Concise EU MDR FAQ covering device qualification, software classification, accessories, custom-made devices, clinical evidence, UDI, EUDAMED, notified bodies, significant changes, and legacy transition. - [EU MDR Legacy Device Transition](https://www.sorena.io/artifacts/eu/medical-device-regulation/legacy-device-transition.md): cited EU MDR legacy device transition guide covering Regulation (EU) 2023/607 conditions, certificate validity, significant-change limits, surveillance, PMS, vigilance, QMS, and evidence records. - [MDR vs AI Act for medical-device software](https://www.sorena.io/artifacts/eu/medical-device-regulation/mdr-vs-ai-act.md): Compare MDR software qualification, classification, clinical evidence, QMS, PMS, UDI, EUDAMED, and notified-body evidence boundaries against cautiously scoped AI Act overlap. - [MDR vs GPSR: medical-device boundary checks](https://www.sorena.io/artifacts/eu/medical-device-regulation/mdr-vs-gpsr.md): Compare MDR medical-device scope with general product-safety fallback questions for borderline, non-medical, and Annex XVI products. - [MDR vs IVDR: medical devices and IVDs compared](https://www.sorena.io/artifacts/eu/medical-device-regulation/mdr-vs-ivdr.md): Compare EU MDR and IVDR scope, classification, conformity routes, technical documentation, clinical or performance evidence, UDI, EUDAMED, PMS, and vigilance. - [MDR vs Product Liability Directive evidence comparison](https://www.sorena.io/artifacts/eu/medical-device-regulation/mdr-vs-product-liability-directive.md): Compare EU MDR market-access evidence with Product Liability Directive exposure without treating compliance records as a liability outcome. - [EU MDR notified body route selection](https://www.sorena.io/artifacts/eu/medical-device-regulation/notified-body-route-selection.md): Choose an EU MDR conformity assessment route by device class, Article 52 option, notified body designation scope, QMS readiness, technical documentation, clinical evidence, and certificate evidence. - [EU MDR penalties and enforcement risk](https://www.sorena.io/artifacts/eu/medical-device-regulation/penalties-and-fines.md): cited EU MDR penalties and enforcement-risk guide covering Article 113, Member State penalty rules, market restrictions, recalls, certificate consequences, and evidence. - [EU MDR PMS and Vigilance Guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/pms-and-vigilance.md): EU MDR guide to post-market surveillance, PMCF updates, PMS reports, PSURs, serious incident reporting, FSCA/FSN handling, trend reporting, and evidence records. - [EU MDR PMS and vigilance records](https://www.sorena.io/artifacts/eu/medical-device-regulation/post-market-surveillance-and-vigilance.md): cited EU MDR guide to PMS plans, PMS reports, PSURs, PMCF updates, serious incident and FSCA reporting, trend reporting, and EUDAMED evidence handling. - [EU MDR PMS Plan Template for Medical Devices](https://www.sorena.io/artifacts/eu/medical-device-regulation/post-market-surveillance-plan-template.md): A cited EU MDR post-market surveillance plan template covering device scope, PMS data sources, PMCF linkage, vigilance, trend reporting, PMSR or PSUR outputs, roles, cadence, and evidence records. - [EU MDR QMS and technical file evidence map](https://www.sorena.io/artifacts/eu/medical-device-regulation/qms-and-technical-file.md): Map EU MDR Article 10 QMS duties to Annex II and Annex III technical documentation, PMS, vigilance, UDI records, and notified-body review evidence. - [EU MDR QMS requirements under Article 10](https://www.sorena.io/artifacts/eu/medical-device-regulation/qms.md): EU MDR QMS guide for Article 10 manufacturer controls covering regulatory strategy, design, risk, clinical evaluation, PMS, vigilance, UDI, suppliers, CAPA, and conformity records. - [EU MDR qualification and borderline products](https://www.sorena.io/artifacts/eu/medical-device-regulation/qualification-and-borderline-products.md): EU MDR qualification guide for medical purpose claims, accessories, software, Annex XVI products, and borderline routes to classification and conformity assessment. - [EU MDR qualification workflow](https://www.sorena.io/artifacts/eu/medical-device-regulation/qualification-workflow.md): A concrete EU MDR workflow for deciding whether a product is a medical device, accessory, Annex XVI product, IVD interface, medicinal-product interface, or non-MDR product before classification and conformity assessment. - [EU MDR requirements checklist](https://www.sorena.io/artifacts/eu/medical-device-regulation/requirements.md): Concrete EU MDR requirements for medical-device scope, classification, GSPR, conformity assessment, technical documentation, QMS, clinical evidence, UDI, EUDAMED, PMS, vigilance, and economic-operator records. - [EU MDR Rule 11 software classification](https://www.sorena.io/artifacts/eu/medical-device-regulation/rule-11-software.md): Classify MDR medical device software under Rule 11 using intended purpose, diagnosis or therapy decision impact, physiological monitoring, conformity route, clinical evidence, and software-change records. - [EU MDR Transition Timelines: practical guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/transition-timelines.md): EU Medical Device Regulation guide to Transition Timelines with scope decisions, owner actions, evidence records, cited citations, and practical next steps. - [EU MDR UDI and EUDAMED registration guide](https://www.sorena.io/artifacts/eu/medical-device-regulation/udi-and-eudamed.md): EU MDR guide to Basic UDI-DI, UDI-DI, UDI carriers, EUDAMED actor and device registration, change impacts, and evidence governance. - [EU MDR vigilance reporting workflow](https://www.sorena.io/artifacts/eu/medical-device-regulation/vigilance-reporting-workflow.md): Concrete EU MDR vigilance workflow for incident intake, serious incident assessment, FSCA and FSN handling, trend reporting, EUDAMED caveats, CAPA, PMS, clinical evaluation updates, and records. - [NIS2 Annex I and Annex II Sector Scoping Guide](https://www.sorena.io/artifacts/eu/nis2-directive/annex-i-and-ii-sector-scoping.md): Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources. - [EU NIS2 Directive applicability test for entity scope](https://www.sorena.io/artifacts/eu/nis2-directive/applicability-test.md): Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence. - [NIS2 Article 21 control baseline and evidence checklist](https://www.sorena.io/artifacts/eu/nis2-directive/article-21-control-baseline.md): Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations. - [NIS2 Article 21 control-by-control evidence checklist](https://www.sorena.io/artifacts/eu/nis2-directive/article-21-control-by-control-evidence.md): Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication. - [NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners](https://www.sorena.io/artifacts/eu/nis2-directive/article-21-gap-assessment-workflow.md): Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review. - [NIS2 Article 23 incident notification workflow](https://www.sorena.io/artifacts/eu/nis2-directive/article-23-notification.md): Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence. - [NIS2 Compliance Checklist: scope, controls, reporting](https://www.sorena.io/artifacts/eu/nis2-directive/checklist.md): This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence. - [NIS2 Compliance Guide: scope, controls, reporting, and evidence](https://www.sorena.io/artifacts/eu/nis2-directive/compliance.md): A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records. - [NIS2 Country Transposition Tracker: EU Status Workflow](https://www.sorena.io/artifacts/eu/nis2-directive/country-transposition-tracker.md): Track NIS2 Directive transposition by EU country with Commission status pages, Article 41 deadlines, reasoned-opinion flags, source URLs, and review controls. - [EU NIS2 Directive deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/nis2-directive/deadlines-and-compliance-calendar.md): cited NIS2 compliance calendar covering 17 October 2024 transposition, 18 October 2024 application, Article 27 registry data, Article 3 entity lists, Article 23 incident-reporting clocks, and Member State transposition watch items. - [NIS2 Entity Classifier Workflow: essential vs important entity scoping](https://www.sorena.io/artifacts/eu/nis2-directive/entity-classifier-workflow.md): Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive. - [NIS2 essential vs important entities: supervision regime and audit evidence requirements](https://www.sorena.io/artifacts/eu/nis2-directive/essential-vs-important-supervision.md): Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties. - [NIS2 24-hour early warning: what to send and when](https://www.sorena.io/artifacts/eu/nis2-directive/faq/24-hour-early-warning.md): Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident. - [NIS2 72-hour incident notification FAQ](https://www.sorena.io/artifacts/eu/nis2-directive/faq/72-hour-incident-notification.md): Direct answer on the NIS2 72-hour incident notification: when it is due, what it updates, what it must include, and how to preserve evidence. - [FAQ: NIS2 essential vs important entity classification and registration obligations](https://www.sorena.io/artifacts/eu/nis2-directive/faq/essential-vs-important-entities.md): Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep. - [Are managed service providers in scope of NIS2?](https://www.sorena.io/artifacts/eu/nis2-directive/faq/managed-service-provider-scope.md): NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence. - [NIS2 Member State Transposition: What Teams Must Check](https://www.sorena.io/artifacts/eu/nis2-directive/faq/member-state-transposition.md): How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details. - [NIS2 size-cap rule: when medium and large entities are in scope](https://www.sorena.io/artifacts/eu/nis2-directive/faq/size-cap-rule.md): Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep. - [NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties](https://www.sorena.io/artifacts/eu/nis2-directive/faq.md): cited NIS2 FAQ for teams deciding whether they are in scope, whether they are essential or important entities, which Article 21 cybersecurity measures apply, how Article 23 incident reporting works, and what penalties and evidence records to plan for. - [NIS2 incident clock triage workflow](https://www.sorena.io/artifacts/eu/nis2-directive/incident-clock-triage-workflow.md): Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks. - [NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps](https://www.sorena.io/artifacts/eu/nis2-directive/incident-reporting-workflow.md): Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records. - [NIS2 Management Body Accountability: board duties, training, and evidence](https://www.sorena.io/artifacts/eu/nis2-directive/management-body-accountability.md): cited guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, liability, training, reporting lines, and evidence. - [NIS2 National Transposition Tracker: EU Member State Evidence Register](https://www.sorena.io/artifacts/eu/nis2-directive/national-transposition-tracker.md): Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers. - [NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-cerc.md): Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work. - [NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-dora.md): Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs. - [NIS2 vs GDPR breach reporting: EU deadlines and overlap](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-gdpr-breach-reporting.md): Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap. - [NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-iso-27001.md): Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse. - [NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-iso-27017.md): Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits. - [NIS2 vs NIS1: what changed in EU cybersecurity compliance](https://www.sorena.io/artifacts/eu/nis2-directive/nis2-vs-nis1.md): Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision. - [NIS2 penalties and fines: Article 34 caps for essential and important entities](https://www.sorena.io/artifacts/eu/nis2-directive/penalties-and-fines.md): NIS2 penalties and fines explained for EU essential and important entities, including Article 34 fine ceilings, Article 21 and 23 triggers, national transposition, and evidence to keep. - [NIS2 Registration and Authority Notification Guide](https://www.sorena.io/artifacts/eu/nis2-directive/registration-and-authority-notification.md): Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines. - [NIS2 Requirements: scope, Article 21 controls, reporting, and evidence](https://www.sorena.io/artifacts/eu/nis2-directive/requirements.md): Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records. - [NIS2 essential vs important entities: Article 3 scope and supervision guide](https://www.sorena.io/artifacts/eu/nis2-directive/scope-essential-vs-important.md): Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split. - [NIS2 Size Cap Rule and Special Scope Cases](https://www.sorena.io/artifacts/eu/nis2-directive/size-cap-and-special-cases.md): Determine whether NIS2 applies under the medium-size rule, regardless-of-size special cases, critical entity rule, and Member State registration lists. - [NIS2 supply chain security program: Article 21 controls, contracts, and evidence](https://www.sorena.io/artifacts/eu/nis2-directive/supply-chain-security-program.md): Build a NIS2 Article 21 supply chain security program for direct suppliers and service providers: policy, supplier criteria, contract clauses, monitoring, registry evidence, and cited checks. - [PPWR applicability test: packaging scope, roles, and evidence](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/applicability-test.md): Determine whether the EU Packaging and Packaging Waste Regulation applies to a packaging item, market activity, operator role, and evidence workflow. - [PPWR compliance checklist for packaging teams](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/checklist.md): cited PPWR checklist for packaging scope, recyclability, recycled content, PFAS, minimisation, labelling, conformity files, and EPR registration under Regulation (EU) 2025/40. - [PPWR compliance guide: packaging conformity, EPR and evidence](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/compliance.md): Build a PPWR compliance workflow for packaging placed on the EU market, covering Articles 5-12 controls, conformity assessment, technical files, declarations, labelling, EPR and evidence. - [EU PPWR Conformity Documentation Guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/conformity-documentation.md): Build PPWR technical documentation and EU declarations of conformity for packaging, with evidence fields, owner checks, retention rules, and official EU sources. - [PPWR deadlines and compliance calendar](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/deadlines-and-compliance-calendar.md): Calendar-style PPWR deadline guide for application, PFAS, labelling, recyclability, recycled content, reuse, refill, deposit return, reporting, and transition dates. - [PPWR delegated and implementing act tracker](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/delegated-act-tracking.md): Track PPWR delegated and implementing acts for recyclability, recycled content, reuse, labelling, EPR, reporting, and evidence owners. - [PPWR Economic Operator Roles: manufacturers, importers, distributors and producers](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/economic-operator-roles.md): Map PPWR roles for packaging teams: manufacturer conformity files, importer and distributor checks, supplier data, fulfilment handling, traceability, and EPR producer registration. - [PPWR EPR and Producer Responsibility Guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/epr-and-producer-responsibility.md): Map PPWR EPR duties for producers, authorised representatives, producer responsibility organisations, online platforms, registrations, reporting and evidence under Regulation (EU) 2025/40. - [PPWR compostable packaging rules: what must be compostable?](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/compostable-packaging.md): A PPWR FAQ on compostable packaging: mandatory compostable formats, Member State options, recycling default rules, labels, and evidence to retain. - [PPWR e-commerce packaging rules: empty space, labels, and reuse](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/e-commerce-packaging.md): cited FAQ for online sellers and fulfilment teams applying PPWR rules to e-commerce packaging, including empty-space, labelling, reuse, and evidence records. - [PPWR grouped and transport packaging empty-space FAQ](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/grouped-and-transport-packaging.md): Answer whether grouped, transport, and e-commerce packaging need PPWR empty-space controls, what the 50% ratio covers, and what evidence to keep. - [PPWR labelling dates: when do packaging labels apply?](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/labelling-dates.md): A PPWR FAQ on Article 12 and Article 13 labelling dates for packaging, reusable packaging, recycled-content labels, QR codes, waste receptacles, and implementation acts. - [PPWR micro-enterprise and small business FAQ](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/micro-and-small-business-edge-cases.md): cited FAQ on PPWR micro-enterprise and small business edge cases, including manufacturer responsibility, reuse exemptions, packaging restrictions, refill, and evidence records. - [PPWR PFAS Thresholds for Food-Contact Packaging](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/pfas-thresholds.md): Direct FAQ on the PPWR Article 5 PFAS limits for food-contact packaging, including the 25 ppb, 250 ppb, and 50 ppm thresholds. - [PPWR recycled content calculations: Article 7 FAQ](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/recycled-content-calculations.md): A PPWR FAQ on recycled content calculations for plastic packaging: Article 7 scope, manufacturing-plant averages, Commission methodology timing, exceptions, and evidence. - [PPWR reusable packaging and re-use systems FAQ](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/reusable-systems.md): Answer when packaging can be treated as reusable under PPWR, what re-use systems must include, and what evidence teams should keep. - [PPWR service packaging FAQ: point-of-sale and takeaway rules](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/service-packaging.md): Service packaging under the EU PPWR means items designed to be filled at the point of sale. See scope, takeaway, HORECA refill and reuse, and evidence checks. - [PPWR FAQ: Scope, Recyclability, Reuse, Labelling, and EPR](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq.md): FAQ index for Regulation (EU) 2025/40 on packaging and packaging waste, covering PPWR scope, recyclability, recycled content, minimisation, reuse, labelling, EPR, and evidence. - [PPWR labelling and consumer information requirements](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/labeling-and-consumer-info.md): Article 12 and Article 55 PPWR guidance for packaging labels, QR codes, online sales information, waste receptacle labels, and consumer information records. - [PPWR Article 12 labelling, QR codes, and digital carriers](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/labelling-qr-and-digital-carriers.md): cited guide to PPWR Article 12 packaging labels, reusable packaging QR codes, digital carriers, online-sale information, and evidence records. - [PPWR labelling rollout workflow for Article 12 and 13](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/labelling-rollout-workflow.md): cited workflow for rolling out PPWR Article 12 packaging labels, QR codes, reusable packaging labels, recycled-content labels, and Article 13 waste-receptacle labels. - [PPWR Packaging Minimisation Guide: Article 10 Evidence](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/minimization.md): cited PPWR packaging minimisation guide covering Article 10, Annex IV evidence, perceived-volume bans, empty-space rules, and technical documentation. - [PPWR packaging classification guide: sales, grouped, transport and e-commerce packaging](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/packaging-classification.md): Classify PPWR packaging by function, material category, format, reuse status and operator role before assessing recyclability, restrictions, EPR and documentation. - [PPWR packaging scope workflow: classify packaging, roles, and evidence](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/packaging-scope-workflow.md): A PPWR packaging scope workflow for classifying packaging, assigning economic-operator roles, routing EPR questions, and keeping technical evidence. - [EU PPWR penalties and fines: Article 68 enforcement guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/penalties-and-fines.md): Official source guide to PPWR penalties and fines: Article 68 Member State rules, administrative fines for Articles 24 to 29, market-surveillance action, formal non-compliance, and enforcement evidence. - [PPWR PFAS Rules for Food-Contact Packaging](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/pfas-and-food-contact-packaging.md): cited guide to PPWR Article 5 PFAS limits for food-contact packaging, including the 12 August 2026 date, thresholds, and evidence records. - [PPWR Article 5 PFAS and Restricted Substances Guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/pfas-and-restricted-substances.md): Official source guide to PPWR Article 5 substance controls: substances of concern, the 100 mg/kg heavy-metal cap, PFAS limits for food-contact packaging, and technical-documentation evidence. - [PPWR Article 5 PFAS Evidence Workflow for Food-Contact Packaging](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/pfas-evidence-workflow.md): Build a PPWR Article 5 evidence workflow for food-contact packaging PFAS checks, limit-value evidence, supplier proof, and Annex VII technical documentation. - [PPWR labelling checklist for Articles 12 and 13](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-labeling-checklist.md): Checklist for PPWR Article 12 packaging labels and Article 13 waste-receptacle labels, including material composition, reuse, DRS, digital carriers, online sales, and transition stock. - [PPWR Recyclability Assessment Template](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-recyclability-assessment-template.md): This PPWR recyclability assessment template helps record packaging category, DfR parameters, performance grade evidence, recycled-at-scale evidence, and approval owners. - [PPWR vs ESPR: Packaging Rules vs Product Ecodesign](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-vs-espr.md): Compare PPWR and ESPR without mixing duties: PPWR controls packaging and packaging waste, while ESPR is a separate sustainable-product ecodesign framework that PPWR complements. - [PPWR vs REACH: Packaging Waste vs Chemicals Rules](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-vs-reach.md): Compare PPWR packaging duties with the narrow REACH boundary confirmed in PPWR sources: substances in packaging, PFAS, recyclability, labelling, EPR, evidence, and dates. - [PPWR vs RoHS: Packaging vs EEE Compliance](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-vs-rohs.md): Compare PPWR packaging duties with a separate RoHS workstream, including scope, owners, evidence, dates, overlap limits, and cited PPWR decision points. - [PPWR vs Single-Use Plastics Directive: Packaging Scope and Overlap](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-vs-sup-directive.md): Compare PPWR and the Single-Use Plastics Directive without merging duties: all-packaging PPWR rules, listed single-use plastic product rules, overlap, evidence, and 2030 changes. - [PPWR vs Waste Framework Directive: Packaging Duties and WFD Links](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/ppwr-vs-waste-framework-directive.md): Compare PPWR with the Waste Framework Directive where the PPWR text expressly relies on WFD concepts: waste hierarchy, definitions, EPR, collection, traceability, and waste plans. - [PPWR Recyclability and Design-for-Recycling Requirements](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/recyclability-and-design-requirements.md): Article 6 PPWR guide to packaging recyclability grades, Annex II packaging categories, design-for-recycling parameters, recycled-at-scale assessment, and evidence files. - [PPWR Recyclability Assessment Workflow](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/recyclability-assessment-workflow.md): Assess PPWR recyclability by packaging unit: map the Annex II category, screen design-for-recycling parameters, grade the result, and retain Annex VII evidence. - [PPWR recyclability grades A, B and C explained](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/recyclability-grades.md): Understand PPWR recyclability grades under Article 6 and Annex II, including design-for-recycling thresholds, 2030, 2035 and 2038 timing, and evidence records. - [PPWR Recycled Content Targets for Plastic Packaging](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/recycled-content-targets.md): Article 7 PPWR targets for recycled content in plastic packaging, including 2030 and 2040 percentages, calculation basis, exclusions, and evidence records. - [PPWR requirements overview for EU packaging teams](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/requirements.md): An official source overview of Regulation (EU) 2025/40 requirements for packaging scope, recyclability, recycled content, minimisation, labelling, reuse, EPR, and conformity evidence. - [PPWR reuse and refill targets: Article 29 and take-away duties](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/reuse-and-refill-targets.md): cited guide to PPWR reuse targets for transport, grouped, beverage, and take-away packaging, including Article 29, 32, 33, reporting, and exemptions. - [PPWR Article 33 refill targets and take-away container reuse obligations](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/reuse-refill-targets.md): cited guide to PPWR reuse and refill targets for transport, grouped, beverage, and take-away packaging under Articles 29 to 33. - [PPWR reuse target applicability workflow: Article 29 and 33](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/reuse-target-applicability-workflow.md): cited workflow to decide whether PPWR Article 29 reuse targets, Article 32 refill duties, and Article 33 take-away reusable offers apply. - [PPWR scope and packaging definitions: Article 2 and Article 3 guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/scope-and-packaging-definitions.md): Use PPWR Article 2 and Article 3 to decide whether an item is packaging, classify sales, grouped, transport, e-commerce and service packaging, and record cited evidence. - [Timeline and Deadlines for PPWR: practical implementation guide](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/timeline-and-deadlines.md): Practical PPWR guidance for Timeline and Deadlines, with cited decisions, owners, evidence records, and implementation steps. - [EU RED Applicability Test for Radio Equipment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/applicability-test.md): Decide whether Directive 2014/53/EU applies to a connected product, which RED requirements are triggered, and what evidence belongs in the technical file. - [RED Article 10 labelling, instructions, and restrictions](https://www.sorena.io/artifacts/eu/radio-equipment-directive/article-10-labelling-and-restrictions.md): cited RED Article 10 guide for radio equipment labels, manufacturer contact details, instructions, DoC statements, frequency information, and use restrictions. - [RED Article 3 Requirements: Safety, EMC, Spectrum and Cyber](https://www.sorena.io/artifacts/eu/radio-equipment-directive/article-3-1-3-2-and-3-3-requirements.md): Map Radio Equipment Directive Article 3(1), 3(2), and 3(3) requirements to safety, EMC, spectrum, interoperability, emergency, software, and cyber evidence. - [RED Article 3 requirement selection workflow](https://www.sorena.io/artifacts/eu/radio-equipment-directive/article-3-requirement-selection-workflow.md): Select the right RED Article 3 branches for radio equipment: safety, EMC, spectrum, delegated Article 3(3) duties, cybersecurity, common charging, evidence, and conformity assessment. - [RED Compliance Checklist for Radio Equipment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/checklist.md): cited RED checklist for radio equipment scope, Article 3 requirements, technical documentation, DoC, CE marking, cybersecurity, common charger, and notified-body decisions. - [EU RED Common Charger Obligations: USB-C scope, dates, labels](https://www.sorena.io/artifacts/eu/radio-equipment-directive/common-charger-obligations.md): cited RED common charger guide covering in-scope device categories, 28 December 2024 and 28 April 2026 dates, USB-C, USB PD, charger unbundling, labels, pictograms, and evidence. - [EU RED compliance evidence guide](https://www.sorena.io/artifacts/eu/radio-equipment-directive/compliance.md): Build a Radio Equipment Directive compliance file with Article 3 requirement mapping, harmonised-standard checks, conformity assessment evidence, EU declarations, CE marking, and RED source links. - [RED conformity assessment and CE marking](https://www.sorena.io/artifacts/eu/radio-equipment-directive/conformity-assessment-and-ce.md): EU Radio Equipment Directive guide to Article 17 conformity modules, notified-body triggers, technical documentation, EU declarations, and CE marking. - [RED Cyber Compliance Workflow for Article 3(3)(d/e/f)](https://www.sorena.io/artifacts/eu/radio-equipment-directive/cyber-compliance-workflow.md): A cited RED cybersecurity workflow for internet-connected radio equipment, privacy and data safeguards, payment-fraud features, evidence packs, and CE release gates. - [EU RED Cybersecurity Product Categories: 2022/30 scope](https://www.sorena.io/artifacts/eu/radio-equipment-directive/cybersecurity-delegated-act-product-categories.md): cited guide to RED Delegated Regulation (EU) 2022/30 product categories for Article 3(3)(d), (e), and (f), carve-outs, 1 August 2025 application, and release evidence. - [RED Cybersecurity Requirements for Radio Equipment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/cybersecurity-requirements.md): EU RED cybersecurity requirements under Article 3(3)(d), (e), and (f): scope, affected radio equipment, application date, standards, notified bodies, and evidence. - [RED compliance deadlines calendar: 2016, 2024, 2025 and 2026 dates](https://www.sorena.io/artifacts/eu/radio-equipment-directive/deadlines-and-compliance-calendar.md): Calendar the EU Radio Equipment Directive deadlines that affect launches: RED applicability, transition end, common charger dates, cybersecurity requirements, OJEU standards, CE marking, declarations and technical files. - [RED EMC and LVD Safety Interplay for Radio Equipment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/emc-and-lvd-safety-interplay.md): Explain how EU RED Article 3 applies LVD safety objectives and EMC requirements to radio equipment, with evidence, test-plan, and technical-file guidance. - [EU RED Common Charger FAQ: Which devices need USB-C?](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/common-charger.md): FAQ on EU RED common charger scope, 28 December 2024 and 28 April 2026 dates, USB-C, USB Power Delivery, charger unbundling, labels, pictograms, and evidence. - [When do RED cybersecurity requirements apply to connected radio equipment?](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/cybersecurity-applicability.md): RED FAQ explaining when Article 3(3)(d), (e), and (f) cybersecurity requirements apply to internet-connected, childcare, toy, wearable, and payment-capable radio equipment. - [RED DoC and CE marking file: what to include](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/doc-and-ce.md): FAQ answer for Radio Equipment Directive declarations of conformity, CE marking evidence, technical documentation, notified-body records, and related labels. - [RED importer obligations FAQ](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/importers.md): What importers must check before placing radio equipment on the EU market: conformity assessment, spectrum use, technical documentation, EU declaration, CE marking, traceability, instructions, restrictions, storage, corrective action, and authority cooperation. - [Are radio kits and evaluation boards covered by the RED?](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/kits.md): RED FAQ for radio kits, construction kits, amateur-radio kits, and custom-built professional R&D evaluation boards under Directive 2014/53/EU. - [RED radio modules FAQ: host product assessment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/radio-modules.md): FAQ on how Directive 2014/53/EU treats RF modules and host products, including module evidence, final-product responsibility, Article 3 assessment, technical documentation, instructions, antennas, software, and DoC records. - [Which receivers and transmitters are covered by RED?](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/receivers-and-transmitters.md): RED scope FAQ for products that intentionally emit or receive radio waves for radio communication or radiodetermination, including receiver-only products, transmitters, accessory-dependent products, and common exclusions. - [RED SAR and RF Exposure Evidence FAQ](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/sar-and-wireless-exposure.md): What SAR and RF exposure evidence to keep under the EU Radio Equipment Directive, including Article 3(1)(a), foreseeable use, frequency, power, antenna, and standards evidence. - [RED standards not cited in the OJEU: can you use them?](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/standards-not-cited-in-ojeu.md): FAQ answer for Radio Equipment Directive products when a standard is useful but not OJEU-cited, including presumption of conformity, Article 17 route selection, and technical-file evidence. - [Wi-Fi and Bluetooth Products Under the EU RED](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/wi-fi-and-bluetooth-products.md): FAQ for assessing Wi-Fi, Bluetooth, BLE and other short-range wireless products under the EU Radio Equipment Directive, including Article 3, CE, technical file, cybersecurity and notified-body triggers. - [EU RED FAQ: Scope, CE and USB-C](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq.md): Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence. - [RED Harmonised Standards and Test Plans: OJEU evidence guide](https://www.sorena.io/artifacts/eu/radio-equipment-directive/harmonized-standards-and-test-plans.md): Build a Radio Equipment Directive standards matrix and test plan around OJEU-cited harmonised standards, Article 3 requirements, Article 17 route triggers, and Annex V technical-file evidence. - [RED notified body route selection under Article 17](https://www.sorena.io/artifacts/eu/radio-equipment-directive/notified-body-route-selection.md): Decide when RED radio equipment can use internal production control and when Article 17 requires Annex III EU-type examination or Annex IV full quality assurance. - [RED Notified Body Trigger Workflow: Article 17 evidence guide](https://www.sorena.io/artifacts/eu/radio-equipment-directive/notified-body-trigger-workflow.md): Decide when the EU Radio Equipment Directive needs a notified body by mapping Article 3 requirements, OJEU-cited harmonised standards, Annex III EU-type examination, and Annex IV full quality assurance evidence. - [RED penalties, fines, and enforcement actions](https://www.sorena.io/artifacts/eu/radio-equipment-directive/penalties-and-fines.md): EU Radio Equipment Directive penalties guide covering Article 46, Member State penalty rules, recalls, withdrawals, formal non-compliance, and enforcement evidence. - [EU RED Radio Equipment Scope: products and exclusions](https://www.sorena.io/artifacts/eu/radio-equipment-directive/radio-equipment-scope.md): Decide whether a product is radio equipment under Directive 2014/53/EU, with RED scope tests, exclusions, examples, and evidence records. - [RED Conformity Assessment Template](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-conformity-assessment-template.md): Template fields for documenting RED Article 3 requirements, Article 17 route selection, harmonised standards, notified-body evidence, technical documentation, EU declaration, CE marking, cybersecurity, and common-charger checks. - [RED Cybersecurity Delegated Act Guide](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-cybersecurity-delegated-act-guide.md): Practical guide to Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive, covering Article 3(3)(d), (e), and (f) cybersecurity scope, 1 August 2025 application, evidence, standards, and notified-body checkpoints. - [EU RED Scope Classification Workflow](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-scope-classification-workflow.md): Classify products under the EU Radio Equipment Directive with a cited workflow for RED scope, exclusions, Article 3 requirements, standards, CE evidence, cybersecurity, and common-charger triggers. - [RED vs Cyber Resilience Act: radio equipment cyber scope](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-cyber-resilience-act.md): Compare RED cybersecurity duties with Cyber Resilience Act planning for connected radio equipment, using official source RED scope, evidence, dates, and caveats. - [RED vs EMC Directive: when radio equipment uses RED instead of EMCD](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-emc.md): Compare the EU Radio Equipment Directive and EMC Directive for radio products, EMC evidence, CE marking, declarations, technical files, and scope boundaries. - [RED vs ETSI EN 303 645: IoT cyber evidence comparison](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-etsi-en-303-645.md): Compare EU RED cybersecurity duties with ETSI EN 303 645 evidence reuse for connected radio products, OJEU standards, CE files, and 1 August 2025 planning. - [RED vs LVD: when radio equipment uses RED for electrical safety](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-lvd.md): Compare the EU Radio Equipment Directive and Low Voltage Directive for radio-product safety, voltage limits, CE marking, technical files, and declarations. - [RED vs Market Surveillance Regulation: radio equipment compliance roles](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-msr.md): Compare RED product conformity duties with EU Market Surveillance Regulation controls for radio equipment, online sales, responsible operators, customs holds, and evidence. - [RED vs UK PSTI for connected radio products](https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-uk-psti.md): Compare EU RED duties with UK PSTI planning for connected radio products: scope, actors, evidence, cybersecurity overlap, CE marking, and separate UK product-security workstreams. - [EU RED Requirements Map: CE and Article 3](https://www.sorena.io/artifacts/eu/radio-equipment-directive/requirements.md): Map Radio Equipment Directive requirements for radio products: Article 3 safety, EMC, spectrum, selected Article 3(3) duties, common charger rules, conformity assessment, CE marking, EU declaration, and technical documentation. - [EU RED Scope and Classification](https://www.sorena.io/artifacts/eu/radio-equipment-directive/scope-and-classification.md): Classify products under the EU Radio Equipment Directive with cited tests for radio equipment scope, exclusions, Article 3 requirement buckets, cybersecurity, common charging, and evidence records. - [RED software update impact for radio equipment](https://www.sorena.io/artifacts/eu/radio-equipment-directive/software-update-impact.md): Assess when firmware, app, and software updates can affect EU Radio Equipment Directive conformity, technical documentation, DoC, standards, and notified-body evidence. - [EU Radio Equipment Directive Timeline: practical guide](https://www.sorena.io/artifacts/eu/radio-equipment-directive/timeline.md): EU Radio Equipment Directive guide to Timeline with scope decisions, owner actions, evidence records, cited citations, and practical next steps. - [EU RoHS Annex III and IV exemptions guide](https://www.sorena.io/artifacts/eu/rohs-directive/annex-iii-and-iv-exemptions.md): How to use, renew, or challenge EU RoHS Annex III and Annex IV exemptions, with Article 5 criteria, timing rules, and evidence requirements. - [EU RoHS Applicability Test for EEE Scope](https://www.sorena.io/artifacts/eu/rohs-directive/applicability-test.md): Decide whether EU RoHS applies to electrical and electronic equipment, cables, spare parts, exclusions, exemptions, CE marking, and evidence records. - [RoHS BOM evidence intake workflow](https://www.sorena.io/artifacts/eu/rohs-directive/bom-evidence-intake-workflow.md): Build a RoHS BOM evidence intake process for EEE: map parts to homogeneous materials, collect supplier declarations, handle exemptions, and feed EN IEC 63000 technical documentation. - [EU RoHS CE Marking and Declaration of Conformity](https://www.sorena.io/artifacts/eu/rohs-directive/ce-and-doc.md): cited guide to RoHS CE marking, EU Declaration of Conformity, technical documentation, EN IEC 63000, and importer or distributor checks. - [EU RoHS compliance checklist for EEE](https://www.sorena.io/artifacts/eu/rohs-directive/checklist.md): Checklist for EU RoHS scope, restricted substances, homogeneous materials, exemptions, CE marking, technical documentation, and supplier evidence. - [EU RoHS Compliance Guide for EEE](https://www.sorena.io/artifacts/eu/rohs-directive/compliance.md): Practical EU RoHS compliance guide for electrical and electronic equipment: scope, restricted substances, exemptions, CE marking, technical documentation, and supplier evidence. - [EU RoHS Deadlines and Compliance Calendar](https://www.sorena.io/artifacts/eu/rohs-directive/deadlines-and-compliance-calendar.md): cited RoHS calendar for scope phase-ins, phthalate dates, exemption renewals, spare-parts cutoffs, EN IEC 63000, CE files, and review triggers. - [EU RoHS EEE Categories and Open Scope](https://www.sorena.io/artifacts/eu/rohs-directive/eee-categories-and-open-scope.md): Map products to EU RoHS EEE categories, category 11 open scope, Article 2 exclusions, cables, spare parts, and evidence needed for RoHS scope decisions. - [EN IEC 63000 RoHS Technical Documentation](https://www.sorena.io/artifacts/eu/rohs-directive/en-iec-63000-technical-documentation.md): cited guide to EN IEC 63000:2018 technical documentation for EU RoHS, including manufacturer duties, evidence records, harmonised-standard status, and file maintenance. - [RoHS exemption register workflow: expiry, renewal, evidence](https://www.sorena.io/artifacts/eu/rohs-directive/exemption-register-workflow.md): Build a RoHS exemption register that tracks Annex III and IV entries, product scope, expiry dates, renewal status, evidence owners, and Commission source links. - [RoHS Exemptions Tracking Register](https://www.sorena.io/artifacts/eu/rohs-directive/exemptions-tracking.md): Track EU RoHS Annex III and IV exemptions by material, component, category, expiry date, renewal status, Article 5 rationale, and evidence record. - [What do the 0.1% and 0.01% substance limits mean under EU RoHS?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/0-1-and-0-01-limits.md): RoHS FAQ explaining why most Annex II substances use a 0.1% homogeneous-material limit while cadmium uses 0.01%. - [Are cables in scope of EU RoHS? Cable evidence, CE marking, and DoC FAQ](https://www.sorena.io/artifacts/eu/rohs-directive/faq/cables.md): EU RoHS cable FAQ covering when cables are EEE, how internal and external cables are treated, when separate CE marking and a DoC are needed, and what evidence to keep. - [Do Components Need EU RoHS Compliance?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/components.md): RoHS FAQ for components in electrical and electronic equipment: substance restrictions, homogeneous materials, CE marking, technical files, exemptions, and supplier evidence. - [EU RoHS Declarations vs Lab Tests FAQ](https://www.sorena.io/artifacts/eu/rohs-directive/faq/declarations-vs-lab-tests.md): When supplier declarations can support EU RoHS technical documentation, when IEC 62321 lab testing is stronger evidence, and how to document the decision. - [Which EEE is in scope under EU RoHS?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/eee-scope.md): EU RoHS scope FAQ explaining when a product is electrical and electronic equipment, which Article 2 exclusions to check, and what evidence to keep. - [What should teams do before a RoHS exemption expires?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/exemption-expiry.md): How to handle EU RoHS exemption expiry: confirm the Annex entry, renewal deadline, pending-decision status, fallback plan, and technical-file evidence. - [RoHS Homogeneous Material Definition and Limits](https://www.sorena.io/artifacts/eu/rohs-directive/faq/homogeneous-material.md): Plain-English EU RoHS FAQ on homogeneous materials, Annex II thresholds, coatings, cables, assemblies, and evidence needed for material-level RoHS decisions. - [RoHS importer checks for imported EEE before EU market placement](https://www.sorena.io/artifacts/eu/rohs-directive/faq/imported-eee.md): Importer-focused RoHS FAQ covering CE marking, EU declaration of conformity, technical documentation availability, importer identity, nonconformity handling, and 10-year DoC retention. - [How should RoHS lead, mercury, and cadmium exemptions be documented?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/lead-mercury-and-cadmium-exemptions.md): RoHS FAQ on documenting lead, mercury, and cadmium exemptions with Annex III or IV entries, material-level limits, expiry status, supplier evidence, and technical documentation. - [When can RoHS spare parts use transition rules?](https://www.sorena.io/artifacts/eu/rohs-directive/faq/spare-parts.md): EU RoHS FAQ on spare parts, repair parts, reused parts, closed-loop B2B reuse, legacy EEE cutoffs, Annex III and IV exemptions, and evidence to keep. - [EU RoHS Directive FAQ: scope, substances, CE marking](https://www.sorena.io/artifacts/eu/rohs-directive/faq.md): Practical EU RoHS Directive FAQ covering EEE scope, Annex II substance limits, cables, spare parts, technical documentation, CE marking, and exemptions. - [RoHS Homogeneous Material Thresholds](https://www.sorena.io/artifacts/eu/rohs-directive/homogeneous-material-thresholds.md): EU RoHS guide to homogeneous material thresholds: 0.1% limits, the 0.01% cadmium limit, material splitting, coatings, samples, exemptions, and technical evidence. - [EU RoHS for medical devices and monitoring equipment](https://www.sorena.io/artifacts/eu/rohs-directive/medical-devices-and-monitoring-equipment.md): RoHS category 8 and 9 guide covering application dates, Annex IV exemptions, phthalates, spare parts, CE marking, declarations, and technical documentation. - [EU RoHS penalties and fines: Member State sanctions](https://www.sorena.io/artifacts/eu/rohs-directive/penalties-and-fines.md): cited guide to EU RoHS penalty exposure: national sanctions, no EU-wide fine table, CE marking misuse, corrective actions, recalls, and evidence records. - [EU RoHS Phthalates: DEHP, BBP, DBP, DIBP](https://www.sorena.io/artifacts/eu/rohs-directive/phthalates.md): cited RoHS guide to DEHP, BBP, DBP, and DIBP: 0.1% homogeneous-material limits, 2019 and 2021 application dates, exemptions, evidence, and testing standards. - [RoHS, REACH, POPs, and batteries overlap](https://www.sorena.io/artifacts/eu/rohs-directive/reach-pop-and-batteries-overlap.md): cited RoHS comparison guide for separating EEE hazardous-substance restrictions from REACH, POPs, battery, waste, and technical-file workstreams. - [EU RoHS requirements for EEE, substances, and CE evidence](https://www.sorena.io/artifacts/eu/rohs-directive/requirements.md): Practical EU RoHS requirements guide covering EEE scope, Annex II substance limits, exemptions, technical documentation, EU declaration of conformity, CE marking, and operator evidence. - [EU RoHS Restricted Substances and Thresholds](https://www.sorena.io/artifacts/eu/rohs-directive/restricted-substances-and-thresholds.md): EU RoHS Annex II restricted substances and maximum concentration values by weight in homogeneous materials, including cadmium's 0.01% limit and the 0.1% limits for lead, mercury, hexavalent chromium, PBB, PBDE, DEHP, BBP, DBP, and DIBP. - [RoHS Risk-Based Testing Guide](https://www.sorena.io/artifacts/eu/rohs-directive/risk-based-testing.md): cited EU RoHS guide to risk-based testing, EN IEC 63000 documentation, IEC 62321 methods, supplier evidence, and technical-file decisions. - [RoHS exemptions tracker guide: fields, evidence, gates](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-exemptions-tracker-guide.md): Build a RoHS exemptions tracker for Annex III and IV claims, renewal timing, supplier evidence, EN IEC 63000 documentation, and release decisions. - [RoHS Supplier Declaration Template](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-supplier-declaration-template.md): cited EU RoHS supplier declaration template guidance for collecting material evidence, exemption claims, test records, and EN IEC 63000 technical-file inputs. - [RoHS vs Batteries Regulation scope comparison](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-vs-batteries-regulation.md): RoHS-focused comparison explaining when RoHS applies to EEE, why batteries sit outside RoHS, and what evidence should not be reused without separate battery-law support. - [RoHS vs LVD/EMC CE evidence: what belongs in the RoHS file](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-vs-lvd-emc-ce-evidence.md): Compare RoHS substance evidence with separate LVD and EMC CE evidence streams, using RoHS-official source scope, technical file, DoC, CE marking, exemption, and supplier records. - [RoHS vs POPs for EEE substance compliance](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-vs-pops.md): Compare EU RoHS and POPs obligations for electrical and electronic equipment: scope, substances, evidence, CE files, exemptions, waste overlap, and cited decision rules. - [RoHS vs REACH for electronics: scope, evidence, overlap](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-vs-reach.md): Compare EU RoHS and REACH for electrical and electronic equipment: scope, restricted substances, evidence, CE marking, exemptions, and overlap decisions. - [RoHS vs WEEE: EU electronics compliance comparison](https://www.sorena.io/artifacts/eu/rohs-directive/rohs-vs-weee.md): Compare EU RoHS restricted-substance duties with WEEE end-of-life recycling obligations, with RoHS scope, evidence, CE marking, exemptions, and cited decision points. - [EU RoHS Spare Parts: Repair and Reuse](https://www.sorena.io/artifacts/eu/rohs-directive/spare-parts.md): cited RoHS spare-parts guide covering Article 4 repair parts, reused recovered parts, closed-loop conditions, phthalate carve-outs, CE evidence, and cutoff dates. - [RoHS Supplier Change Control Workflow](https://www.sorena.io/artifacts/eu/rohs-directive/supplier-change-control-workflow.md): cited EU RoHS supplier change control workflow for part substitutions, material changes, supplier declarations, testing decisions, and technical-file updates. - [RoHS Supplier Declarations and Verification Guide](https://www.sorena.io/artifacts/eu/rohs-directive/supplier-declarations-and-verification.md): Build a RoHS supplier evidence file without confusing supplier declarations with manufacturer EU DoC, CE marking, technical documentation, or importer checks. - [RoHS Supplier Declarations Guide](https://www.sorena.io/artifacts/eu/rohs-directive/supplier-declarations.md): Use RoHS supplier declarations as supporting evidence for BOM, material, exemption, and technical-file reviews without replacing manufacturer EU DoC or CE duties. - [RoHS technical documentation, EU DoC and CE marking](https://www.sorena.io/artifacts/eu/rohs-directive/technical-documentation-and-ce.md): cited guide to RoHS technical documentation, EN IEC 63000 evidence, EU declarations of conformity, CE marking, and manufacturer, importer and distributor duties. - [EU RoHS test plan selection workflow](https://www.sorena.io/artifacts/eu/rohs-directive/test-plan-selection-workflow.md): Choose RoHS supplier evidence, EN IEC 63000 technical documentation, and IEC 62321 testing without over-testing or under-documenting restricted substances. - [RoHS Timeline: practical guide](https://www.sorena.io/artifacts/eu/rohs-directive/timeline.md): EU RoHS Directive guide to Timeline with scope decisions, owner actions, evidence records, cited citations, and practical next steps. - [EU Taxonomy Activity Eligibility Workflow](https://www.sorena.io/artifacts/eu/taxonomy-regulation/activity-eligibility-workflow.md): Build an EU Taxonomy activity eligibility workflow that maps economic activities to delegated-act descriptions before alignment, DNSH, and Article 8 KPI reporting. - [EU Taxonomy Applicability Test for Eligibility and Alignment](https://www.sorena.io/artifacts/eu/taxonomy-regulation/applicability-test.md): Test EU Taxonomy applicability by separating Article 8 reporting scope, Taxonomy eligibility, Taxonomy alignment, DNSH, minimum safeguards, and KPI evidence. - [EU Taxonomy CapEx Plan Evidence Workflow](https://www.sorena.io/artifacts/eu/taxonomy-regulation/capex-plan-evidence-workflow.md): Build an EU Taxonomy CapEx plan evidence workflow for Article 8 CapEx KPI reporting, management-body approval, milestones, amendments, allocation, and restatement controls. - [EU Taxonomy CapEx Plan Evidence: Article 8 checklist](https://www.sorena.io/artifacts/eu/taxonomy-regulation/capex-plan-evidence.md): Build evidence for EU Taxonomy CapEx plans under Article 8, Annex I Section 1.1.2.2 and the Disclosures Delegated Act. - [EU Taxonomy Regulation Checklist for Eligibility and Alignment](https://www.sorena.io/artifacts/eu/taxonomy-regulation/checklist.md): A cited EU Taxonomy checklist for mapping eligible activities, testing alignment, documenting DNSH and minimum safeguards, and preparing Article 8 KPI disclosures. - [EU Taxonomy compliance guide: eligibility, alignment and Article 8 KPIs](https://www.sorena.io/artifacts/eu/taxonomy-regulation/compliance.md): Practical EU Taxonomy compliance guide for mapping eligible activities, testing alignment, collecting DNSH and minimum-safeguards evidence, and preparing Article 8 disclosures. - [EU Taxonomy deadlines and Article 8 compliance calendar](https://www.sorena.io/artifacts/eu/taxonomy-regulation/deadlines-and-compliance-calendar.md): cited EU Taxonomy calendar for Article 8 reporting phases, environmental objective application dates, delegated-act updates, and evidence review gates. - [EU Taxonomy Delegated Act Change Tracker](https://www.sorena.io/artifacts/eu/taxonomy-regulation/delegated-act-change-tracker.md): Track adopted and proposed EU Taxonomy delegated-act changes by source, status, affected criteria, Article 8 disclosure impact, owner, and evidence update. - [EU Taxonomy Delegated Acts Tracker](https://www.sorena.io/artifacts/eu/taxonomy-regulation/delegated-acts-tracker.md): Track EU Taxonomy delegated acts by legal status, objective, reporting impact, activity scope, DNSH criteria, Article 8 disclosures, and owner follow-up. - [EU Taxonomy DNSH and Minimum Safeguards evidence guide](https://www.sorena.io/artifacts/eu/taxonomy-regulation/dnsh-and-minimum-safeguards.md): cited guide to EU Taxonomy DNSH and minimum safeguards: Article 3 alignment gates, Article 17 significant harm, Article 18 safeguards, evidence records, and KPI controls. - [EU Taxonomy DNSH Appendix C: chemicals evidence guide](https://www.sorena.io/artifacts/eu/taxonomy-regulation/dnsh-appendix-c.md): cited guide to EU Taxonomy DNSH Appendix C chemicals checks, including SVHC thresholds, alternatives, controlled conditions, and evidence records. - [EU Taxonomy 2026 simplification: what should teams do?](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/2026-simplification.md): cited FAQ on EU Taxonomy 2026 simplification, Regulation (EU) 2026/73, Article 8 reporting, DNSH evidence, and limits on unsupported claims. - [EU Taxonomy activity evidence packs: what to retain](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/activity-evidence-packs.md): A practical FAQ on EU Taxonomy activity evidence packs: eligibility, alignment, DNSH, minimum safeguards, KPI traceability, and cited-source review records. - [EU Taxonomy Article 8 Scope FAQ](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/article-8-scope.md): cited FAQ on EU Taxonomy Article 8 scope, including who reports, which KPI framework applies, and what evidence teams should retain. - [EU Taxonomy auditor evidence: what to keep for alignment review](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/auditor-evidence.md): Practical FAQ on EU Taxonomy auditor evidence: what evidence supports eligibility, alignment, DNSH, minimum safeguards, and Article 8 KPI disclosures. - [EU Taxonomy CapEx Plans FAQ: Article 8 CapEx KPI](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/capex-plans.md): Practical FAQ on EU Taxonomy CapEx plans under Article 8, Annex I Section 1.1.2.2, management-body approval, timing, activity-level evidence, and KPI restatement. - [EU Taxonomy delegated act changes: what teams should check](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/delegated-act-changes.md): FAQ on handling EU Taxonomy delegated act changes: official source checks, application dates, affected criteria, disclosures, DNSH evidence, and review records. - [DNSH Appendix C under the EU Taxonomy: chemicals evidence FAQ](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/dnsh-appendix-c.md): Practical FAQ on EU Taxonomy DNSH Appendix C chemicals criteria, including SVHCs, CLP hazard classes, the 0.1% w/w threshold, suitable alternatives, and controlled conditions evidence. - [EU Taxonomy eligibility vs alignment: what is the difference?](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/eligibility-vs-alignment.md): Eligibility means an activity is covered by Taxonomy delegated acts; alignment means it also meets Article 3 conditions, technical screening criteria, DNSH, and minimum safeguards. - [EU Taxonomy Financial KPIs and Green Asset Ratio (GAR) FAQ](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/financial-kpis-and-gar.md): FAQ on EU Taxonomy Article 8 financial undertaking KPIs, credit institution Green Asset Ratio (GAR), reporting dates, exclusions, and qualitative disclosures. - [EU Taxonomy minimum safeguards FAQ: Article 18 evidence](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/minimum-safeguards.md): FAQ on EU Taxonomy minimum safeguards under Article 18: who must comply, which OECD, UNGP, ILO and human-rights evidence to keep, and common reporting mistakes. - [EU Taxonomy non-financial KPIs: turnover, CapEx and OpEx](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/non-financial-kpis.md): Article 8 FAQ for non-financial undertakings reporting EU Taxonomy turnover, CapEx and OpEx KPIs, with evidence and source checks. - [EU Taxonomy Six Environmental Objectives](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/six-environmental-objectives.md): Plain-English FAQ on the six EU Taxonomy environmental objectives in Article 9 and how teams should map activities, DNSH checks, safeguards, and evidence. - [EU Taxonomy FAQ: eligibility, alignment, DNSH, safeguards, and Article 8](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq.md): EU Taxonomy FAQ hub for eligibility, alignment, technical screening criteria, DNSH, minimum safeguards, Article 8 KPIs, delegated acts, and evidence records. - [EU Taxonomy GAR and financial undertaking KPIs](https://www.sorena.io/artifacts/eu/taxonomy-regulation/gar-and-financial-undertaking-kpis.md): cited guide to EU Taxonomy Article 8 financial undertaking KPIs, including GAR, asset manager KPIs, investment firm KPIs, insurance KPIs, exclusions, and reporting evidence. - [EU Taxonomy GAR KPI workflow for credit institutions](https://www.sorena.io/artifacts/eu/taxonomy-regulation/gar-kpi-workflow.md): cited workflow for preparing EU Taxonomy Green Asset Ratio (GAR) KPI disclosures under Article 8 and the Disclosures Delegated Act. - [EU Taxonomy Article 8 KPI disclosure workflow](https://www.sorena.io/artifacts/eu/taxonomy-regulation/kpis-and-disclosure-workflow.md): cited workflow for EU Taxonomy Article 8 KPI disclosures, covering turnover, CapEx, OpEx, GAR dependencies, templates, contextual information, and publication checks. - [EU Taxonomy Minimum Safeguards: Article 18 and evidence](https://www.sorena.io/artifacts/eu/taxonomy-regulation/minimum-safeguards.md): Understand how Article 18 minimum safeguards fit into EU Taxonomy alignment, which international standards they reference, and what evidence supports the assessment. - [EU Taxonomy Penalties and Fines: Article 22 Disclosure Risk](https://www.sorena.io/artifacts/eu/taxonomy-regulation/penalties-and-fines.md): Understand where EU Taxonomy penalty exposure starts: Article 22 measures and penalties for Articles 5, 6, and 7 financial product disclosures, with practical evidence controls. - [EU Taxonomy Regulation requirements: eligibility, alignment, KPIs](https://www.sorena.io/artifacts/eu/taxonomy-regulation/requirements.md): Understand the core EU Taxonomy requirements: Article 3 alignment tests, eligible activities, DNSH, minimum safeguards, Article 8 KPIs, and evidence to keep. - [EU Taxonomy Article 8 Scope and Reporting Entities](https://www.sorena.io/artifacts/eu/taxonomy-regulation/scope-and-reporting-entities.md): Determine which financial and non-financial undertakings report under EU Taxonomy Article 8, which annexes apply, and what evidence supports the reporting boundary. - [EU Taxonomy screening criteria and documentation guide](https://www.sorena.io/artifacts/eu/taxonomy-regulation/screening-criteria-and-documentation.md): How to document EU Taxonomy eligibility, alignment, technical screening criteria, DNSH, minimum safeguards, and Article 8 KPI disclosures without overstating the evidence. - [EU Taxonomy Eligibility vs Alignment Explained](https://www.sorena.io/artifacts/eu/taxonomy-regulation/taxonomy-eligibility-vs-alignment-explained.md): Explain EU Taxonomy eligibility and alignment under Article 8, the Disclosures Delegated Act, Article 3, technical screening criteria, DNSH, and safeguards. - [EU Taxonomy Eligibility vs Alignment](https://www.sorena.io/artifacts/eu/taxonomy-regulation/taxonomy-eligibility-vs-alignment.md): Compare EU Taxonomy eligibility and alignment under Article 8: what each term means, what evidence is needed, which KPIs are affected, and why eligibility is not proof of sustainability. - [EU Taxonomy vs CSRD: Article 8 Reporting Comparison](https://www.sorena.io/artifacts/eu/taxonomy-regulation/taxonomy-vs-csrd.md): Compare EU Taxonomy Article 8 disclosures with CSRD sustainability reporting scope, evidence, KPIs, assurance, and reuse limits using official EU Taxonomy sources. - [EU Taxonomy vs SFDR: Scope, KPIs, and Evidence](https://www.sorena.io/artifacts/eu/taxonomy-regulation/taxonomy-vs-sfdr.md): Compare the EU Taxonomy and the SFDR link points that appear in Taxonomy materials: activity classification, Article 8 KPIs, product disclosures, data reuse, and evidence limits. - [EU Taxonomy Article 8 disclosure templates](https://www.sorena.io/artifacts/eu/taxonomy-regulation/templates.md): cited EU Taxonomy templates for Article 8 reporting, covering non-financial KPIs, financial undertaking annexes, eligibility and alignment evidence, GAR inputs, and publication checks. - [ETSI EN 303 645 Applicability and Scope](https://www.sorena.io/artifacts/global/etsi-en-303-645/applicability-and-scope.md): Decide whether a connected product is in scope of ETSI EN 303 645, define the consumer IoT evidence boundary, and document N/A justifications for assessment. - [ETSI EN 303 645 compliance: ICS, IXIT, evidence](https://www.sorena.io/artifacts/global/etsi-en-303-645/compliance.md): Plan ETSI EN 303 645 compliance evidence for consumer IoT products with scope, ICS, IXIT, TS 103 701 assessment steps, verdict risks, and cited controls. - [ETSI EN 303 645 Current Version Tracker](https://www.sorena.io/artifacts/global/etsi-en-303-645/current-version-tracker.md): Track ETSI EN 303 645 version evidence, ETSI deliverable status checks, TS 103 701 assessment alignment, and change triggers for consumer IoT security work. - [ETSI EN 303 645 Data Protection Provisions](https://www.sorena.io/artifacts/global/etsi-en-303-645/data-protection-provisions.md): cited guide to ETSI EN 303 645 data protection provisions for consumer IoT: personal data security, telemetry transparency, consent, and deletion evidence. - [ETSI EN 303 645 vs EU CRA for Consumer IoT](https://www.sorena.io/artifacts/global/etsi-en-303-645/etsi-en-303-645-vs-eu-cra.md): Use ETSI EN 303 645 and ETSI TS 103 701 evidence when preparing consumer IoT cybersecurity work that may also need a separate EU CRA legal mapping. - [ETSI EN 303 645 vs RED Cybersecurity Delegated Act](https://www.sorena.io/artifacts/global/etsi-en-303-645/etsi-en-303-645-vs-red-cybersecurity-delegated-act.md): Compare ETSI EN 303 645 consumer IoT security evidence with RED cybersecurity planning without treating the ETSI baseline as a substitute for RED legal scope. - [ETSI EN 303 645 vs UK PSTI: Evidence Crosswalk](https://www.sorena.io/artifacts/global/etsi-en-303-645/etsi-en-303-645-vs-uk-psti.md): Compare ETSI EN 303 645 evidence with UK PSTI review needs without assuming the same scope, legal trigger, or assurance route. - [How should teams handle constrained devices under ETSI EN 303 645 for consumer IoT products?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/constrained-devices.md): ETSI EN 303 645 constrained-device guidance: what counts as constrained, when non-applicability can be justified, and what evidence should support update and authentication decisions. - [ETSI EN 303 645 default passwords: what must consumer IoT teams do?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/default-passwords.md): ETSI EN 303 645 default password guidance for consumer IoT: unique or user-defined passwords, pre-installed password generation, change mechanisms, brute-force controls, and TS 103 701 evidence. - [ETSI EN 303 645 consumer IoT products: what is in scope?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/iot-consumer-products.md): ETSI EN 303 645 FAQ on consumer IoT product scope: devices, associated services, constrained devices, out-of-scope industrial uses, ICS, IXIT, and TS 103 701 evidence. - [ETSI EN 303 645 personal data deletion FAQ for consumer IoT](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/personal-data-deletion.md): What ETSI EN 303 645 says about deleting user data and personal data from consumer IoT devices, associated services, apps, and evidence records. - [ETSI EN 303 645 support period: what must consumer IoT teams publish?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/support-period.md): ETSI EN 303 645 support-period guidance for consumer IoT: defined security-update support periods, user-accessible publication, constrained-device replacement support, model designation, and TS 103 701 evidence. - [ETSI EN 303 645 telemetry: what should consumer IoT teams evidence?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/telemetry.md): ETSI EN 303 645 telemetry guidance for consumer IoT teams: security anomaly examination, IXIT 24-TelData evidence, personal-data minimization, and consumer telemetry disclosures. - [ETSI EN 303 645 test evidence: what should consumer IoT teams keep?](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/test-evidence.md): ETSI EN 303 645 test evidence guidance for consumer IoT teams: ICS support claims, IXIT detail, TS 103 701 test plans, verdicts, and external evidence checks. - [ETSI EN 303 645 vulnerability disclosure requirements for consumer IoT](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/vulnerability-disclosure.md): What ETSI EN 303 645 requires for consumer IoT vulnerability disclosure policies, report handling, status updates, timely action, and TS 103 701 evidence. - [ETSI EN 303 645 FAQ: Consumer IoT Security Questions](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq.md): cited answers to common ETSI EN 303 645 questions on consumer IoT scope, associated services, default passwords, updates, vulnerability disclosure, telemetry, deletion, and TS 103 701 evidence. - [ETSI EN 303 645 ICS and IXIT Evidence Template](https://www.sorena.io/artifacts/global/etsi-en-303-645/ics-and-ixit-evidence-template.md): Build a cited ICS and IXIT evidence template for ETSI EN 303 645 consumer IoT assessments, with clear separation between EN provisions and TS 103 701 test information. - [ETSI EN 303 645 implementation checklist](https://www.sorena.io/artifacts/global/etsi-en-303-645/implementation-checklist.md): This ETSI EN 303 645 implementation checklist helps scope a consumer IoT product, record Annex B support statuses, map IXIT evidence, and avoid weak conformance claims. - [ETSI EN 303 645 Implementation Evidence Guide](https://www.sorena.io/artifacts/global/etsi-en-303-645/implementation-evidence.md): Build ETSI EN 303 645 implementation evidence from Annex B support/detail records, TS 103 701 ICS and IXIT inputs, test verdicts, and scoped external evidence. - [ETSI EN 303 645 IoT Applicability Workflow](https://www.sorena.io/artifacts/global/etsi-en-303-645/iot-applicability-workflow.md): Decide whether ETSI EN 303 645 applies to a consumer IoT product, what associated services belong in scope, and how to record justified non-applicability. - [ETSI EN 303 645 requirements: consumer IoT provision map](https://www.sorena.io/artifacts/global/etsi-en-303-645/requirements.md): Map ETSI EN 303 645 consumer IoT requirements to product scope, Annex B ICS entries, TS 103 701 evidence, and implementation owners. - [ETSI EN 303 645 Secure Updates and Vulnerability Disclosure](https://www.sorena.io/artifacts/global/etsi-en-303-645/secure-update-and-vulnerability-disclosure.md): cited guide to ETSI EN 303 645 clauses 5.2 and 5.3 for consumer IoT vulnerability disclosure, security updates, support periods, and TS 103 701 evidence. - [ETSI EN 303 645 Secure Update Evidence Workflow](https://www.sorena.io/artifacts/global/etsi-en-303-645/secure-update-evidence-workflow.md): Build secure-update evidence for ETSI EN 303 645 using provision 5.3, Annex B support/detail records, and TS 103 701 ICS, IXIT, and test-plan inputs. - [ETSI EN 303 645 Secure Update Workflow](https://www.sorena.io/artifacts/global/etsi-en-303-645/secure-update-workflow.md): Map ETSI EN 303 645 secure-update provisions into a practical workflow for consumer IoT update mechanisms, support-period disclosures, and TS 103 701 evidence. - [ETSI TS 103 701 Test Evidence Workflow for EN 303 645](https://www.sorena.io/artifacts/global/etsi-en-303-645/ts-103-701-test-evidence-workflow.md): Build an ETSI TS 103 701 test evidence workflow for EN 303 645 consumer IoT assessments: DUT identification, ICS, IXIT, test plans, verdicts, and external evidence. - [ETSI EN 303 645 CVD Workflow for IoT Vulnerability Reports](https://www.sorena.io/artifacts/global/etsi-en-303-645/vulnerability-disclosure-cvd-workflow.md): Cited workflow for ETSI EN 303 645 vulnerability disclosure: public policy contents, reporting contact, acknowledgement and status timelines, timely action, and TS 103 701 evidence. - [ETSI EN 319 401 Audit and Conformity Assessment Evidence](https://www.sorena.io/artifacts/global/etsi-en-319-401/audit-and-conformity-assessment.md): How to prepare ETSI EN 319 401 evidence for audit and conformity assessment without overstating what the standard itself assesses. - [ETSI EN 319 401 Audit Evidence Pack Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-401/audit-evidence-pack-workflow.md): Build an ETSI EN 319 401 audit evidence pack for trust service providers: risk assessment, practice statement, policies, records, logs, continuity, and supplier evidence. - [ETSI EN 319 401 Audit Evidence Pack](https://www.sorena.io/artifacts/global/etsi-en-319-401/audit-evidence-pack.md): Build an ETSI EN 319 401 audit evidence pack around records, logs, policies, risk assessment, incident handling, continuity, and supplier evidence. - [ETSI EN 319 401 compliance duties for TSPs](https://www.sorena.io/artifacts/global/etsi-en-319-401/compliance.md): cited ETSI EN 319 401 compliance guidance for trust service providers: legal operation, evidence, accessibility, privacy, records, incidents, continuity, and suppliers. - [ETSI EN 319 401 vs eIDAS Article 19 and 24](https://www.sorena.io/artifacts/global/etsi-en-319-401/etsi-en-319-401-vs-eidas.md): Compare ETSI EN 319 401 V3.1.1 with the eIDAS provisions mapped in Annex B: trust service risk management, incident handling, records, staff, terms, and termination planning. - [ETSI EN 319 401 vs EN 319 403-1: TSP Policy vs CAB Assessment](https://www.sorena.io/artifacts/global/etsi-en-319-401/etsi-en-319-401-vs-en-319-403-1.md): Compare ETSI EN 319 401 and ETSI EN 319 403-1 for trust service providers: TSP operating controls, conformity assessment context, evidence boundaries, and reuse limits. - [CA and RA responsibilities under ETSI EN 319 401](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/ca-and-ra-responsibilities.md): How ETSI EN 319 401 frames CA and RA responsibility: TSP practice statements, management approval, role segregation, subcontractor control, and evidence boundaries. - [ETSI EN 319 401 conformity assessment bodies: what is covered?](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/conformity-assessment-bodies.md): Understand what ETSI EN 319 401 says, and does not say, about conformity assessment bodies, independent assessment, and TSP evidence preparation. - [eIDAS Articles 19 and 24 in ETSI EN 319 401](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/eidas-articles-19-and-24.md): See how ETSI EN 319 401 V3.1.1 Annex B maps eIDAS Article 19 security duties and selected Article 24 qualified trust service duties to concrete policy evidence. - [ETSI EN 319 401 policy documentation: what is required?](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/policy-documentation.md): How ETSI EN 319 401 treats policy documentation: practice statements, terms and conditions, information security policy, evidence records, and change review. - [Security Incidents in ETSI EN 319 401](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/security-incidents.md): How ETSI EN 319 401 V3.1.1 expects trust service providers to detect, respond to, report, classify, document, and review security incidents. - [ETSI EN 319 401 Subcontractor Requirements FAQ](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/subcontractors.md): How ETSI EN 319 401 treats subcontractors, outsourcing, supplier agreements, SLAs, monitoring, evidence, and retained TSP responsibility. - [Trust service provider scope under ETSI EN 319 401](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/trust-service-provider-scope.md): How to scope ETSI EN 319 401 for a trust service provider: service boundaries, trust service policy, practice statement, terms, risks, and third-party components. - [ETSI EN 319 401 FAQ for trust service providers](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq.md): cited ETSI EN 319 401 FAQ for TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence. - [ETSI EN 319 401 Incident Reporting and Continuity Duties](https://www.sorena.io/artifacts/global/etsi-en-319-401/incident-and-continuity-duties.md): Practical ETSI EN 319 401 V3.1.1 guidance for trust service incident response, reporting, evidence retention, business continuity, and termination planning. - [ETSI EN 319 401 Incident Evidence Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-401/incident-and-continuity-evidence-workflow.md): Build an EN 319 401 incident and continuity evidence workflow for TSP monitoring, response, reporting, records, backup recovery, and crisis review. - [ETSI EN 319 401 Personnel, Asset, and Access Controls](https://www.sorena.io/artifacts/global/etsi-en-319-401/personnel-asset-and-access-controls.md): Clause-focused EN 319 401 V3.1.1 guide to TSP personnel duties, trusted roles, asset inventories, classification, and access-control evidence. - [ETSI EN 319 401 policy and security requirements](https://www.sorena.io/artifacts/global/etsi-en-319-401/policy-and-security-requirements.md): cited ETSI EN 319 401 guidance for TSP policy and security requirements: risk assessment, practice statements, terms, security policy, controls, incidents, and evidence. - [ETSI EN 319 401 requirements map](https://www.sorena.io/artifacts/global/etsi-en-319-401/requirements.md): Map ETSI EN 319 401 V3.1.1 requirements for trust service providers across risk assessment, policies, TSP operations, incidents, evidence, continuity, termination, and supply chain controls. - [ETSI EN 319 401 Risk Assessment and Treatment](https://www.sorena.io/artifacts/global/etsi-en-319-401/risk-management.md): Clause-cited ETSI EN 319 401 V3.1.1 guidance for trust service risk assessment, risk treatment, residual-risk approval, and evidence planning. - [ETSI EN 319 401 Subcontractor Controls](https://www.sorena.io/artifacts/global/etsi-en-319-401/subcontractor-controls.md): Practical EN 319 401 guidance for TSP subcontractor controls: retained responsibility, agreements, SLAs, supplier registers, monitoring, and audit evidence. - [ETSI EN 319 401 Subcontractor Evidence Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-401/subcontractor-evidence-workflow.md): Build an EN 319 401 subcontractor evidence workflow for TSP supplier agreements, SLAs, audit mechanisms, risk reviews, supplier registers, and archived records. - [ETSI EN 319 401 Trust Service Applicability Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-401/trust-service-applicability-workflow.md): A scoped workflow for deciding when ETSI EN 319 401 applies to a trust service and what TSP policy, risk, terms, operations, and supplier evidence to collect. - [ETSI EN 319 401 Trust Service Provider Applicability](https://www.sorena.io/artifacts/global/etsi-en-319-401/trust-service-provider-applicability.md): Use ETSI EN 319 401 to decide whether a trust service provider activity falls in the standard's type-independent baseline and what service, policy, risk, supplier, and evidence boundaries to document. - [ETSI EN 319 411-1 Audit File Evidence](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/audit-file-evidence.md): Build an ETSI EN 319 411-1 audit evidence file for CA logging, registration records, revocation records, CA key lifecycle evidence, and records archival. - [ETSI EN 319 411-1 CA Key Management](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/ca-key-management.md): CA key management guidance for ETSI EN 319 411-1: CPS commitments, key ceremonies, secure cryptographic devices, backup, recovery, and lifecycle evidence. - [ETSI EN 319 411-1 certificate lifecycle workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/certificate-lifecycle-workflow.md): Workflow for EN 319 411-1 certificate application, issuance, acceptance, renewal, re-key, modification, revocation, suspension, status services, and evidence records. - [ETSI EN 319 411-1 Compliance Guide](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/compliance.md): Build an ETSI EN 319 411-1 compliance file for certificate policies, CPS commitments, certificate lifecycle controls, revocation services, CA keys, and audit evidence. - [ETSI EN 319 411-1 CP and CPS template](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/cp-and-cps-template.md): Build a certificate policy and Certification Practice Statement template for ETSI EN 319 411-1 certificate services, with fields for policy identifiers, subscribers, relying parties, revocation, publication, and evidence. - [ETSI EN 319 411-1 vs CA/B Forum Baseline Requirements](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/en-319-411-1-vs-ca-browser-forum-baseline-requirements.md): Compare how EN 319 411-1 incorporates CA/B Forum BRG concepts for DVCP, OVCP, IVCP, [WEB] requirements, CPS disclosure, domain validation, and conflict handling. - [EN 319 411-1 vs EN 319 411-2 Certificate Policy](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/en-319-411-1-vs-en-319-411-2.md): Compare ETSI EN 319 411-1 general certificate-service requirements with EN 319 411-2 EU qualified certificate requirements, including policy scope, CP/CPS evidence, and audit boundaries. - [ETSI EN 319 411-1 Certification Audit Evidence FAQ](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/certification-audit-evidence.md): How CAs should prepare ETSI EN 319 411-1 audit evidence for CP/CPS scope, registration records, revocation records, CA key logs, and retained assessment files. - [CP vs CPS under ETSI EN 319 411-1](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/cp-vs-cps.md): Understand how ETSI EN 319 411-1 separates Certificate Policy from Certification Practice Statement work for certification authorities and trust service providers. - [RA delegation under ETSI EN 319 411-1](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/ra-delegation.md): How certificate authorities can delegate registration authority work under ETSI EN 319 411-1 while keeping identity validation, secure data exchange, role controls, and audit evidence traceable. - [ETSI EN 319 411-1 certificate re-key FAQ](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/re-key.md): What ETSI EN 319 411-1 requires when a TSP re-keys an existing certificate with a new subject public key. - [How should certificate authorities handle revocation evidence under ETSI EN 319 411-1?](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/revocation-evidence.md): What ETSI EN 319 411-1 expects CAs to evidence for certificate revocation requests, status publication, CRL or OCSP updates, and archived revocation records. - [Subscriber agreements under ETSI EN 319 411-1](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/subscriber-agreements.md): How ETSI EN 319 411-1 expects CAs and TSPs to inform subscribers, record acceptance, handle subject consent, and retain subscriber-agreement evidence. - [Subscriber identity validation under ETSI EN 319 411-1](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/subscriber-identity-validation.md): How certificate authorities should validate subscriber and subject identity under ETSI EN 319 411-1, including evidence, authorization, subject categories, and registration records. - [ETSI EN 319 411-1 Certificate Suspension FAQ](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/suspension.md): How CAs should handle certificate suspension under ETSI EN 319 411-1: CPS disclosure, validated requests, status publication, subscriber notice, and audit evidence. - [ETSI EN 319 411-1 FAQ for Certificate Services](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq.md): Answers to common ETSI EN 319 411-1 questions on certificate policies, CPS content, CA and RA boundaries, subscriber evidence, revocation, status services, and record retention. - [ETSI EN 319 411-1 Identity Validation Evidence Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/identity-validation-evidence-workflow.md): A workflow for building ETSI EN 319 411-1 identity validation evidence packs across subscriber, subject, certificate request, RA, logging, and retention controls. - [ETSI EN 319 411-1 Identity Validation](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/identity-validation.md): Identity validation requirements in ETSI EN 319 411-1 for subscribers, subjects, RAs, certificate requests, registration evidence, and issuance records. - [ETSI EN 319 411-1 RA Delegation Review Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/ra-delegation-review-workflow.md): Review delegated registration authority work under ETSI EN 319 411-1: retained CA responsibility, recognized registration service providers, secure data exchange, CPS coverage, and audit evidence. - [ETSI EN 319 411-1 RA Delegation Guide](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/ra-delegation.md): How to scope registration authority delegation under ETSI EN 319 411-1, including delegated RA tasks, external provider controls, registration records, and audit evidence. - [ETSI EN 319 411-1 requirements map for certificate services](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/requirements.md): Map ETSI EN 319 411-1 requirements for certificate policies, CP/CPS content, registration, revocation, certificate status, and CA key-management evidence. - [ETSI EN 319 411-1 Revocation Evidence Workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/revocation-evidence-workflow.md): Build a revocation evidence workflow for ETSI EN 319 411-1 covering CPS procedures, request authentication, 24-hour status updates, CRL/OCSP publication, logs, and retention. - [ETSI EN 319 411-1 Revocation, OCSP, and CRL Operations](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/revocation-ocsp-and-crl-operations.md): Operate ETSI EN 319 411-1 revocation status services with CPS procedures, authenticated requests, 24-hour CRL or OCSP publication controls, and audit evidence. - [ETSI EN 319 411-2 compliance checklist](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/compliance.md): Compliance checklist for ETSI EN 319 411-2 qualified certificate services, covering policy selection, CP/CPS evidence, identity validation, QSCD status, trusted-list reliance, and certificate status services. - [eIDAS QTSP supervision workflow for ETSI EN 319 411-2](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/eidas-qtsp-supervision-workflow.md): Operational workflow for qualified trust service providers using ETSI EN 319 411-2 to manage supervisory-body changes, incidents, termination evidence, trusted-list checks, and assessment records. - [ETSI EN 319 411-2 vs eIDAS Qualified Trust Services](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/en-319-411-2-vs-eidas-qualified-trust-services.md): Compare ETSI EN 319 411-2 certificate policy requirements with the eIDAS qualified-status, supervision, audit, and trusted-list framework. - [EN 319 411-2 vs EN 319 411-1 Qualified Certs](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/en-319-411-2-vs-en-319-411-1.md): Compare ETSI EN 319 411-2 qualified certificate requirements with EN 319 411-1 general certificate-service requirements, including QCP profiles, QSCD evidence, CP/CPS reuse, and audit boundaries. - [ETSI EN 319 411-2: Legal vs Natural Person Certs](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/legal-and-natural-persons.md): ETSI EN 319 411-2 separates qualified certificate policies for natural persons, legal persons, QSCD use, and website authentication subscribers. - [QSCD Requirements in ETSI EN 319 411-2](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/qscd.md): How ETSI EN 319 411-2 treats QSCD-backed qualified certificates, including QCP-n-qscd and QCP-l-qscd policies, key-use controls, QSCD verification, and certificate profile evidence. - [QTSP Supervision and ETSI EN 319 411-2](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/qtsp-supervision.md): How ETSI EN 319 411-2 supports QTSP supervision evidence for qualified certificate services, trusted-list reliance, liability responsibility, incident records, and audit preparation. - [What are the qualified certificate policies in ETSI EN 319 411-2?](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/qualified-certificate-policies.md): FAQ on ETSI EN 319 411-2 qualified certificate policies, including QCP-n, QCP-l, QSCD variants, QEVCP-w, QNCP-w, and policy identifiers. - [Qualified certificates under ETSI EN 319 411-2](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/qualified-certificates.md): FAQ answer for QTSPs on how ETSI EN 319 411-2 treats EU qualified certificates, policy identifiers, QSCD variants, website certificates, and lifecycle evidence. - [How should QTSPs select an ETSI EN 319 411-2 qualified certificate profile?](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/qualified-profile-selection.md): A focused FAQ on choosing QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, or QNCP-w-gen under ETSI EN 319 411-2. - [ETSI EN 319 411-2: Certificate Revocation FAQ](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/revocation.md): Answer the ETSI EN 319 411-2 revocation question for qualified certificate services: CPS procedures, 24-hour publication, CRL or OCSP status, and evidence to retain. - [How should relying parties use trusted lists under ETSI EN 319 411-2?](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/trusted-lists.md): FAQ on EN 319 411-2 trusted-list reliance for EU qualified certificates: relying-party notices, QTSP service identifiers, validation evidence, and source references. - [Which QWAC Profile Fits ETSI EN 319 411-2?](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/website-authentication-certificates.md): Choose between QEVCP-w, QNCP-w, and QNCP-w-gen for qualified website authentication certificates under ETSI EN 319 411-2. - [ETSI EN 319 411-2 FAQ for EU Qualified Certificates](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq.md): Answers to common ETSI EN 319 411-2 questions about EU qualified certificate policies, QSCD use, identity validation, trusted lists, and revocation status services. - [ETSI EN 319 411-2 Identity Proofing](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/identity-proofing.md): How EN 319 411-2 applies identity validation for EU qualified certificates, including QCP natural-person, legal-person, website, and evidence-record checks. - [ETSI EN 319 411-2: QCP, QNCP, and QEVCP Profile Selection](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qcp-qncp-and-qevcp-profile-selection.md): Choose the right ETSI EN 319 411-2 qualified certificate policy profile: QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, or QNCP-w-gen. - [ETSI EN 319 411-2 QSCD Route](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qscd-route.md): When QCP-n-qscd or QCP-l-qscd is the right EN 319 411-2 route, what QSCD evidence is needed, and which certificate-profile claims must stay aligned. - [ETSI EN 319 411-2 QTSP supervision evidence workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qtsp-supervision-evidence-workflow.md): Build an assessment-ready QTSP supervision evidence pack for ETSI EN 319 411-2 qualified certificate services, covering policy identifiers, trusted-list checks, incident records, QSCD evidence, and termination controls. - [ETSI EN 319 411-2: end-to-end qualified certificate lifecycle management workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qualified-certificate-lifecycle-workflow.md): Lifecycle workflow for ETSI EN 319 411-2 qualified certificate services, from policy selection and identity validation through issuance, renewal, re-key, modification, revocation, status services, and records. - [ETSI EN 319 411-2 qualified certificate operations: issuance, suspension, and revocation](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qualified-certificate-operations.md): Operational guide for ETSI EN 319 411-2 qualified certificate services: policy identifiers, identity validation, issuance, QSCD handling, revocation status, and relying-party notices. - [ETSI EN 319 411-2 Qualified Certificate Scope](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qualified-certificate-scope.md): Use ETSI EN 319 411-2 to scope EU qualified certificate services by certificate policy, subject type, QSCD use, website authentication profile, and eIDAS context. - [ETSI EN 319 411-2: workflow for selecting QCP-n, QCP-l, or QCP-w certificate profile](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/qualified-profile-selector-workflow.md): Select the right ETSI EN 319 411-2 qualified certificate policy profile for signatures, seals, QSCD use, and website authentication. - [ETSI EN 319 411-2 requirements map](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/requirements.md): Map ETSI EN 319 411-2 requirements for EU qualified certificate services across QCP profiles, CP/CPS documentation, QSCD use, certificate profiles, revocation, and eIDAS Annex A references. - [ETSI EN 319 411-2 trusted-list evidence](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/trusted-list-evidence.md): Build EN 319 411-2 trusted-list evidence for EU qualified certificate reliance: relying-party notice text, QTSP service identifiers, validation records, and change triggers. - [ETSI EN 319 411-2 trusted-list validation workflow](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/trusted-list-validation-workflow.md): Validate an EN 319 411-2 EU qualified-certificate claim by mapping the certificate service to the QTSP trusted-list entry, policy profile, relying-party notice, and status evidence. - [FIPS 140-3: step-by-step workflow for mapping algorithm certificates to CMVP modules](https://www.sorena.io/artifacts/global/fips-140-3/algorithm-certificate-mapping-workflow.md): Map CAVP algorithm certificates to a FIPS 140-3 module by matching implementation identity, operational environment, module services, and security policy evidence. - [FIPS 140-3 algorithm certificate mapping: ACVTS certificates to module boundary](https://www.sorena.io/artifacts/global/fips-140-3/algorithm-certificate-mapping.md): Map CAVP algorithm certificates to FIPS 140-3 module services, approved security functions, security policy tables, and validation evidence. - [FIPS 140-3 Applicability Test](https://www.sorena.io/artifacts/global/fips-140-3/applicability-test.md): Check whether FIPS 140-3 applies to a cryptographic module claim by testing agency use, module boundary, security level, approved functions, CMVP status, and procurement evidence. - [FIPS 140-3 Approved and Non-Approved Mode Workflow](https://www.sorena.io/artifacts/global/fips-140-3/approved-and-non-approved-mode-workflow.md): Classify FIPS 140-3 module services by approved security service, allowed no-security-claimed use, and non-approved service evidence. - [FIPS 140-3 approved-mode evidence workflow](https://www.sorena.io/artifacts/global/fips-140-3/approved-mode-evidence-workflow.md): An official source workflow for collecting FIPS 140-3 approved-mode evidence: module boundary, approved services, service indicators, CAVP certificates, Security Policy entries, and change review. - [FIPS 140-3 Change Impact Review](https://www.sorena.io/artifacts/global/fips-140-3/change-impact.md): Review FIPS 140-3 module changes against boundary, version, operational environment, embedded module, software loading, CVE, and certificate evidence. - [FIPS 140-3: CMVP Lifecycle Timeline](https://www.sorena.io/artifacts/global/fips-140-3/cmvp-lifecycle-timeline.md): Practical FIPS 140-3 guidance for CMVP Lifecycle Timeline: scope, controls, evidence, cited decisions, and implementation checkpoints. - [FIPS 140-3 compliance guide](https://www.sorena.io/artifacts/global/fips-140-3/compliance.md): An official source FIPS 140-3 compliance guide for cryptographic module scope, security-level claims, CMVP validation evidence, and procurement review. - [FIPS 140-3 Entropy and DRBG Evidence](https://www.sorena.io/artifacts/global/fips-140-3/entropy-and-drbg.md): FIPS 140-3 entropy and DRBG guidance for module boundary decisions, entropy caveats, Security Policy evidence, ESV references, and DRBG CSP handling. - [FIPS 140-3 Algorithm Certificates FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/algorithm-certificates.md): How CAVP algorithm certificates support, but do not replace, FIPS 140-3 cryptographic module validation evidence. - [How should teams handle approved mode under FIPS 140-3?](https://www.sorena.io/artifacts/global/fips-140-3/faq/approved-mode.md): Answer the FIPS 140-3 approved-mode question with service-level indicators, Security Policy evidence, and limits on non-approved functions. - [FIPS 140-3 Certificate Maintenance FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/certificate-maintenance.md): How to maintain FIPS 140-3 certificate evidence after validation by checking module status, version, caveats, Security Policy, and revalidation records. - [FIPS 140-3 Entropy Evidence FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/entropy-evidence.md): How FIPS 140-3 entropy evidence should document entropy source location, GetEntropy access, SP 800-90B testing, Security Policy text, and certificate caveats. - [FIPS 140-3 Module Boundaries FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/module-boundaries.md): Understand how FIPS 140-3 module boundaries affect cryptographic module scope, interfaces, software and firmware components, and bound or embedded validated modules. - [FIPS 140-3 operational environments FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/operational-environments.md): Learn what a FIPS 140-3 operational environment means for software, firmware, and hybrid cryptographic modules, and what evidence to check before relying on a validation claim. - [FIPS 140-3 security levels: how to choose and evidence them](https://www.sorena.io/artifacts/global/fips-140-3/faq/security-levels.md): A practical FAQ on FIPS 140-3 security levels, module scope, CMVP evidence, bound or embedded modules, and common claim mistakes. - [FIPS 140-3 Vendor Affirmation FAQ](https://www.sorena.io/artifacts/global/fips-140-3/faq/vendor-affirmation.md): When vendor affirmation can support a FIPS 140-3 module claim, what it does not supersede, and which Security Policy, CAVP, CSTL, and test-report evidence to keep. - [FIPS 140-3 FAQ for Cryptographic Modules](https://www.sorena.io/artifacts/global/fips-140-3/faq.md): Answers to common FIPS 140-3 questions about scope, CMVP validation, algorithm certificates, module boundaries, approved mode, and validation evidence. - [FIPS 140-3: FIPS 140-2 vs FIPS 140-3](https://www.sorena.io/artifacts/global/fips-140-3/fips-140-2-vs-fips-140-3.md): Compare FIPS 140-2 legacy references with FIPS 140-3 requirements, ISO/IEC 19790 alignment, CMVP testing evidence, and guidance mappings. - [FIPS 140-3 Validation Checklist](https://www.sorena.io/artifacts/global/fips-140-3/fips-140-3-validation-checklist.md): Checklist for preparing a cryptographic module for FIPS 140-3 validation: boundary, levels, services, approved algorithms, entropy, tests, security policy, and change evidence. - [FIPS 140-3 vs ISO/IEC 19790 and ISO/IEC 24759](https://www.sorena.io/artifacts/global/fips-140-3/fips-140-3-vs-iso-19790.md): Compare FIPS 140-3 with ISO/IEC 19790 and ISO/IEC 24759 for cryptographic module validation scope, evidence, testing, and procurement claims. - [FIPS 140-3: Module Boundary and Service Mapping](https://www.sorena.io/artifacts/global/fips-140-3/module-boundary-and-service-mapping.md): Map a FIPS 140-3 cryptographic module boundary to services, approved algorithms, operational environments, and CMVP validation evidence. - [FIPS 140-3 Module Boundary Selector Workflow](https://www.sorena.io/artifacts/global/fips-140-3/module-boundary-selector-workflow.md): A FIPS 140-3 workflow for selecting a cryptographic module boundary, separating embedded and bound modules, and collecting CMVP validation evidence. - [FIPS 140-3: Module Boundary Selector](https://www.sorena.io/artifacts/global/fips-140-3/module-boundary-selector.md): Select and document a FIPS 140-3 cryptographic module boundary across hardware, software, firmware, operational environment, services, and validation evidence. - [FIPS 140-3: Operational Environment](https://www.sorena.io/artifacts/global/fips-140-3/operational-environment.md): FIPS 140-3 operational environment guidance for software, firmware, hybrid, CAVP certificate, EVM, and PAA/PAI validation claims. - [FIPS 140-3: Security Levels Explained](https://www.sorena.io/artifacts/global/fips-140-3/security-levels-explained.md): Explain FIPS 140-3 Security Levels 1 through 4, what they cover, and how to document level claims for cryptographic module validation. - [FIPS 140-3 Security Policy Template](https://www.sorena.io/artifacts/global/fips-140-3/security-policy-template.md): Build a FIPS 140-3 module Security Policy with sections for boundary, roles, services, approved algorithms, SSP handling, self-tests, and CMVP evidence. - [FIPS 140-3 Validation Maintenance Change Workflow](https://www.sorena.io/artifacts/global/fips-140-3/validation-maintenance-change-impact-workflow.md): A FIPS 140-3 workflow for triaging module changes against CMVP validation scope, Security Policy evidence, CAVP certificates, software loading, and CVE records. - [FIPS 140-3 Validation Maintenance](https://www.sorena.io/artifacts/global/fips-140-3/validation-maintenance.md): Maintain FIPS 140-3 validation claims by checking module identity, certificate status, boundary changes, operational environments, and CAVP evidence. - [AES FIPS 197 requirements and evidence](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/aes-fips-197.md): AES FIPS 197 guidance for identifying supported key sizes, separating the block cipher from modes of operation, and avoiding unsupported FIPS validation claims. - [FIPS cryptographic algorithm selector](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/algorithm-selector.md): Choose between FIPS algorithm standards for AES, SHA-2, SHA-3, digital signatures, ML-KEM, ML-DSA, and SLH-DSA without overstating validation scope. - [FIPS approved algorithm selector workflow](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/approved-algorithm-selector-workflow.md): A cited workflow for selecting FIPS and NIST-approved cryptographic algorithms without overstating module validation, CAVP evidence, or approved-mode claims. - [FIPS approved mode procurement: certificates, boundaries, and evidence](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/approved-mode-procurement.md): Procurement guidance for FIPS approved mode claims: how to check CMVP certificates, CAVP evidence, module boundaries, tested environments, and supplier evidence before purchase. - [CAVP and ACVP validation evidence for FIPS algorithms](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/cavp-and-acvp-validation.md): How to read CAVP algorithm certificates, ACVTS/ACVP test coverage, CMVP module validation, and FIPS 140-3 procurement evidence without overstating the claim. - [CAVP Validation Evidence Workflow for FIPS Algorithms](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/cavp-validation-evidence-workflow.md): Workflow for collecting CAVP and ACVP evidence: algorithm certificates, implementation names, tested parameters, operating environments, and CMVP handoff records. - [FIPS 186-5 and FIPS 204 digital signatures](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/digital-signatures-fips-186-5-and-fips-204.md): Compare FIPS 186-5 classical digital signatures with FIPS 204 ML-DSA, including scope, algorithm choices, key-use limits, and validation evidence boundaries. - [How FIPS 180-4 and FIPS 202 Hash Functions Fit FIPS Algorithm Approval](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/fips-180-4-and-fips-202-hash-functions.md): Use FIPS 180-4 for SHA-1 and SHA-2 hash algorithms, FIPS 202 for SHA-3 and SHAKE functions, and CAVP/CMVP evidence without treating a hash certificate as module validation. - [How FIPS 186-5 Signature Algorithms Fit FIPS Approval](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/fips-186-5-signatures.md): Use FIPS 186-5 for RSA, ECDSA, deterministic ECDSA, EdDSA, HashEdDSA, DSA verification limits, approved hashes, and CAVP/CMVP evidence boundaries. - [What does FIPS 197 AES mean for FIPS-approved algorithms?](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/fips-197-aes.md): FIPS 197 defines AES as a FIPS-approved block cipher, but AES use alone is not the same as CAVP algorithm testing or FIPS 140-3 module validation. - [FIPS 203, 204, and 205 Post-Quantum Algorithms](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/fips-203-204-and-205-post-quantum-algorithms.md): FAQ on how FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA fit FIPS-approved cryptographic algorithm planning, implementation evidence, and validation checks. - [FIPS Algorithm Procurement Evidence FAQ](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/procurement-evidence.md): What procurement teams should collect before accepting FIPS algorithm or module claims: CAVP certificates, CMVP module status, security policy scope, and supplier change triggers. - [FIPS validation certificates for cryptographic algorithms](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/validation-certificates.md): How to read CAVP algorithm validation certificates and CMVP module validation certificates without overstating FIPS-approved cryptographic algorithm claims. - [FIPS-approved cryptographic algorithms FAQ](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq.md): Answers to common FIPS algorithm questions: approved security functions, CAVP validation, CMVP module scope, AES modes, SHA-2, SHA-3, signatures, and post-quantum algorithms. - [FIPS KDF and MAC coverage for validated modules](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/kdf-and-mac-coverage.md): Map FIPS 140-3 KDF and MAC coverage to approved security functions, CAVP evidence, self-tests, service indicators, and module security policy entries. - [FIPS Key Management Mapping for Algorithms and SSP Evidence](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/key-management-mapping.md): Map FIPS 140-3 key management requirements to approved algorithms, SSP establishment methods, CAVP evidence, module boundaries, and key-use records. - [ML-DSA vs ECDSA under FIPS 204 and FIPS 186-5](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/ml-dsa-vs-ecdsa.md): Compare ML-DSA and ECDSA for FIPS-aligned digital signature designs, including parameter choices, key handling, CAVP algorithm evidence, and CMVP module boundaries. - [FIPS 203 ML-KEM vs RSA and ECDH key establishment](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/ml-kem-vs-rsa-and-ecdh.md): Compare FIPS 203 ML-KEM with RSA and ECDH key-establishment schemes using NIST SP 800-56A, SP 800-56B, CAVP, and CMVP source support. - [Post-quantum FIPS 203, 204, and 205: ML-KEM, ML-DSA, and SLH-DSA](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/post-quantum-fips-203-204-205.md): An official source guide to the three NIST post-quantum FIPS standards: when ML-KEM, ML-DSA, and SLH-DSA apply, what evidence to keep, and how CAVP and CMVP claims differ. - [Post-Quantum Migration Tracker for FIPS 203, 204, and 205](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/post-quantum-migration-tracker.md): Track post-quantum cryptography migration evidence for FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA, CAVP algorithm certificates, and CMVP module boundaries. - [Post-Quantum Migration for FIPS Cryptography](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/post-quantum-migration.md): Plan post-quantum migration for FIPS cryptography by separating ML-KEM key establishment, ML-DSA and SLH-DSA signatures, CAVP algorithm evidence, and CMVP module validation boundaries. - [FIPS Procurement Evidence Review Workflow: CAVP, CMVP, Approved Mode](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/procurement-evidence-review-workflow.md): Review FIPS crypto procurement evidence by separating CAVP algorithm certificates from CMVP module certificates, Security Policy scope, approved mode, operating environment, change impact, and retention records. - [FIPS 180-4 and FIPS 202 secure hash guidance](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/secure-hash-fips-180-4-and-fips-202.md): Choose and evidence SHA-2, SHA-3, and SHAKE use under FIPS 180-4, FIPS 202, CAVP validation, and FIPS 140-3 module claims. - [SHA-2 vs SHA-3 under FIPS 180-4 and FIPS 202](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/sha-2-vs-sha-3.md): Compare SHA-2 and SHA-3 for FIPS use: approved functions, validation evidence, compatibility, procurement checks, and when migration is not required. - [TLS use-case mapping for FIPS algorithm evidence](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/tls-use-case-mapping.md): Map TLS uses to FIPS algorithm, CAVP, CMVP, approved-mode, certificate-authority, and evidence checks without overstating protocol validation claims. - [FIPS crypto transition and deprecation tracker](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/transition-and-deprecation-tracker.md): Track FIPS algorithm transitions, withdrawn guidance, CAVP evidence, CMVP module impact, procurement triggers, and approved-mode caveats without overstating validation status. - [ISO 22301 Audit Readiness and Certification Evidence](https://www.sorena.io/artifacts/global/iso-22301/audit-readiness-and-certification-evidence.md): Prepare ISO 22301 BCMS audit evidence for scope, BIA, risk assessment, objectives, exercises, internal audit, management review, corrective actions, and retained documented information. - [ISO 22301 BCMS Scope and Boundaries](https://www.sorena.io/artifacts/global/iso-22301/bcms-scope-and-boundaries.md): Define an ISO 22301 BCMS scope that names the organization, products and services, sites, dependencies, outsourced processes, exclusions, interfaces, evidence, and review triggers. - [ISO 22301 BIA to Recovery Strategy Workflow](https://www.sorena.io/artifacts/global/iso-22301/bia-to-recovery-strategy-workflow.md): Turn ISO 22301 business impact analysis into recovery priorities, continuity strategies, solutions, exercises, and audit-ready evidence. - [ISO 22301 Business Continuity Strategy and Solutions](https://www.sorena.io/artifacts/global/iso-22301/business-continuity-strategy-and-solutions.md): Build ISO 22301 business continuity strategies and solutions from BIA outputs, recovery objectives, resource needs, supplier dependencies, exercises, and evidence records. - [ISO 22301 Business Impact Analysis Template](https://www.sorena.io/artifacts/global/iso-22301/business-impact-analysis-template.md): Build an ISO 22301 business impact analysis template that captures activities, impacts over time, MTPD, RTO, dependencies, resource needs, evidence, review cadence, and continuity-strategy handoff. - [ISO 22301 Certification Evidence Checklist](https://www.sorena.io/artifacts/global/iso-22301/certification-evidence-checklist.md): A practical ISO 22301 certification evidence checklist for BCMS scope, BIA, risk assessment, continuity plans, exercises, audits, management review, and corrective actions. - [ISO 22301 Compliance Guide](https://www.sorena.io/artifacts/global/iso-22301/compliance.md): Build ISO 22301 compliance evidence across BCMS scope, leadership, BIA, risk assessment, continuity strategies, plans, exercises, audit, management review, and corrective action. - [ISO 22301 Business Impact Analysis FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/business-impact-analysis.md): Practical ISO 22301 BIA FAQ covering prioritized activities, impact criteria, MTPD, RTO, RPO, dependencies, resources, strategy handoff, evidence, and review triggers. - [ISO 22301 Certification Evidence FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/certification-evidence.md): FAQ guidance on ISO 22301 certification evidence: BCMS scope, documented information, BIA, risk assessment, exercises, internal audit, management review, and corrective action. - [ISO 22301 Management Review FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/management-review.md): What ISO 22301 management review should cover: inputs, outputs, decisions, evidence, improvement actions, and ownership for BCMS leadership reviews. - [ISO 22301 MTPD FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/mtpd.md): How ISO 22301 teams should define MTPD in the business impact analysis, separate it from RTO and RPO, and keep recovery evidence current. - [ISO 22301 Recovery Strategies FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/recovery-strategies.md): Practical ISO 22301 FAQ on selecting recovery strategies from BIA, risk assessment, prioritized activities, resource needs, exercises, and review evidence. - [ISO 22301 RPO FAQ: Recovery Point Objectives](https://www.sorena.io/artifacts/global/iso-22301/faq/rpo.md): How to set, evidence, test, and review recovery point objectives in an ISO 22301 business continuity management system. - [ISO 22301 RTO FAQ: Recovery Time Objectives](https://www.sorena.io/artifacts/global/iso-22301/faq/rto.md): Plain-language ISO 22301 guidance for setting recovery time objectives from BIA evidence, MTPD limits, resources, dependencies, exercises, and review triggers. - [ISO 22301 Testing Exercises FAQ](https://www.sorena.io/artifacts/global/iso-22301/faq/testing-exercises.md): How ISO 22301 teams should plan, run, evidence, and improve business continuity exercises and tests. - [ISO 22301 FAQ: BCMS, BIA, MTPD, RTO and Audit Evidence](https://www.sorena.io/artifacts/global/iso-22301/faq.md): Practical ISO 22301 FAQ for business continuity teams: BCMS scope, BIA, MTPD, RTO, RPO, strategies, exercises, audits, management review, and certification evidence. - [ISO 22301 vs DORA: BCMS and Digital Operational Resilience](https://www.sorena.io/artifacts/global/iso-22301/iso-22301-vs-dora.md): Compare ISO 22301 business continuity management with DORA digital operational resilience for financial entities, ICT risk, incidents, testing, third-party risk, and reusable evidence. - [ISO 22301 vs ISO/IEC 27001: BCMS and ISMS Comparison](https://www.sorena.io/artifacts/global/iso-22301/iso-22301-vs-iso-27001.md): Compare ISO 22301 business continuity management with ISO/IEC 27001 information security management: scope, risk work, evidence, certification boundaries, overlap, and common mistakes. - [ISO 22301 BCMS Requirements: Clauses 4-10](https://www.sorena.io/artifacts/global/iso-22301/requirements.md): A practical ISO 22301 requirements guide for BCMS scope, leadership, planning, support, operation, BIA, risk assessment, continuity strategies, plans, exercises, audits, management review, corrective action, and evidence. - [ISO 22301 Testing and Exercises Guide](https://www.sorena.io/artifacts/global/iso-22301/testing-and-exercises.md): Plan, run, evidence, and improve ISO 22301 business continuity exercises that validate strategies, plans, RTOs, MTPDs, communication procedures, and corrective actions. - [ISO/IEC 27001 Annex A Control Evidence Guide](https://www.sorena.io/artifacts/global/iso-27001/annex-a-2022-control-evidence.md): Build useful ISO/IEC 27001:2022 Annex A control evidence: selected controls, SoA rationale, owners, implementation proof, effectiveness checks, audit records, and improvement actions. - [ISO/IEC 27001 Audit Readiness Guide](https://www.sorena.io/artifacts/global/iso-27001/audit-readiness.md): Prepare ISO/IEC 27001 audit evidence across ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, internal audit, management review, and corrective actions. - [ISO/IEC 27001 Certification Stage Workflow](https://www.sorena.io/artifacts/global/iso-27001/certification-stage-workflow.md): A practical ISO/IEC 27001 certification workflow for scope readiness, Stage 1 document review, Stage 2 evidence, nonconformities, corrective action, certification decision, surveillance, and recertification. - [ISO/IEC 27001 Compliance Guide: ISMS Evidence](https://www.sorena.io/artifacts/global/iso-27001/compliance.md): Build ISO/IEC 27001 compliance around ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, audits, management review, and corrective action evidence. - [ISO/IEC 27001 Annex A Control Ownership FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/annex-a-control-ownership.md): How should teams assign Annex A Control Ownership under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Certification Body Evidence FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/certification-body-evidence.md): How should teams handle Certification Body Evidence under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Internal Audit FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/internal-audit.md): How should teams run ISO/IEC 27001 internal audits: who should own each step, what evidence is expected, and how findings are resolved. - [ISO/IEC 27001 Management Review FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/management-review.md): How should teams handle Management Review under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Risk Acceptance FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/risk-acceptance.md): How should teams handle Risk Acceptance under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 SoA Exclusions FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/soa-exclusions.md): How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 Surveillance Audits FAQ](https://www.sorena.io/artifacts/global/iso-27001/faq/surveillance-audits.md): How should teams handle Surveillance Audits under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA](https://www.sorena.io/artifacts/global/iso-27001/faq.md): Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness. - [ISO/IEC 27001 Implementation Roadmap Guide](https://www.sorena.io/artifacts/global/iso-27001/implementation-roadmap.md): ISO/IEC 27001 Implementation Roadmap for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Internal Audit and Management Review Guide](https://www.sorena.io/artifacts/global/iso-27001/internal-audit-and-management-review.md): ISO/IEC 27001 Internal Audit and Management Review for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 vs NIS2 Comparison](https://www.sorena.io/artifacts/global/iso-27001/iso-27001-vs-nis2.md): ISO/IEC 27001 vs NIS2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 vs NIST CSF 2.0 Comparison](https://www.sorena.io/artifacts/global/iso-27001/iso-27001-vs-nist-csf-2-0.md): ISO/IEC 27001 vs NIST CSF 2.0 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 vs SOC 2 Comparison](https://www.sorena.io/artifacts/global/iso-27001/iso-27001-vs-soc-2.md): ISO/IEC 27001 vs SOC 2 for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Requirements Guide](https://www.sorena.io/artifacts/global/iso-27001/requirements.md): ISO/IEC 27001 Requirements for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Risk Treatment and Residual Risk Guide](https://www.sorena.io/artifacts/global/iso-27001/risk-treatment-and-residual-risk.md): ISO/IEC 27001 Risk Treatment and Residual Risk for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Risk Treatment Register Workflow](https://www.sorena.io/artifacts/global/iso-27001/risk-treatment-register-workflow.md): ISO/IEC 27001 Risk Treatment Register Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 SoA: workflow for gathering and documenting control evidence](https://www.sorena.io/artifacts/global/iso-27001/statement-of-applicability-evidence-workflow.md): ISO/IEC 27001 Statement of Applicability Evidence Workflow for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27001 Statement of Applicability template: Annex A control selection and justification](https://www.sorena.io/artifacts/global/iso-27001/statement-of-applicability-template.md): ISO/IEC 27001 Statement of Applicability Template for ISO/IEC 27001:2022 Information Security Management System: scope decisions, ownership, evidence records, and review actions. - [ISO/IEC 27005 Compliance Guide](https://www.sorena.io/artifacts/global/iso-27005/compliance.md): ISO/IEC 27005 Compliance for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Asset and Scenario Modeling FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/asset-and-scenario-modeling.md): How should teams model assets and scenarios under ISO/IEC 27005 risk assessments? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Impact FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/impact.md): How should teams handle Impact under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Inherent vs Residual Risk FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/inherent-vs-residual-risk.md): How should teams distinguish inherent risk from residual risk under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Likelihood FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/likelihood.md): How should teams handle Likelihood under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Review Cadence FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/review-cadence.md): How should teams handle Review Cadence under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Risk Acceptance FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/risk-acceptance.md): How should teams handle Risk Acceptance under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Risk Owners FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/risk-owners.md): How should teams handle Risk Owners under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Treatment Options FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/treatment-options.md): How should teams handle Treatment Options under ISO/IEC 27005? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27005 Risk Management FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq.md): ISO/IEC 27005 FAQ for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 vs FAIR Comparison](https://www.sorena.io/artifacts/global/iso-27005/iso-27005-vs-fair.md): ISO/IEC 27005 vs FAIR for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 vs ISO 31000 Comparison](https://www.sorena.io/artifacts/global/iso-27005/iso-27005-vs-iso-31000.md): ISO/IEC 27005 vs ISO 31000 for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 vs NIST SP 800-30 Comparison](https://www.sorena.io/artifacts/global/iso-27005/iso-27005-vs-nist-800-30.md): ISO/IEC 27005 vs NIST SP 800-30 for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Qualitative vs Quantitative Method Comparison](https://www.sorena.io/artifacts/global/iso-27005/qualitative-vs-quantitative-method.md): Qualitative vs Quantitative Method for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Residual Risk Approval Workflow](https://www.sorena.io/artifacts/global/iso-27005/residual-risk-approval-workflow.md): ISO/IEC 27005 Residual Risk Approval Workflow for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Residual Risk Approval Guide](https://www.sorena.io/artifacts/global/iso-27005/residual-risk-approval.md): ISO/IEC 27005 Residual Risk Approval for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Risk Assessment Template and Workflow](https://www.sorena.io/artifacts/global/iso-27005/risk-assessment-template.md): ISO/IEC 27005 Risk Assessment Template for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Risk Criteria Setup Workflow](https://www.sorena.io/artifacts/global/iso-27005/risk-criteria-setup-workflow.md): ISO/IEC 27005 Risk Criteria Setup Workflow for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Risk Criteria Guide](https://www.sorena.io/artifacts/global/iso-27005/risk-criteria.md): ISO/IEC 27005 Risk Criteria for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Risk Register Workflow](https://www.sorena.io/artifacts/global/iso-27005/risk-register-workflow.md): ISO/IEC 27005 Risk Register Workflow for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Risk Treatment Plan Template](https://www.sorena.io/artifacts/global/iso-27005/risk-treatment-plan-template.md): ISO/IEC 27005 Risk Treatment Plan Template for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27005 Scenario Library Guide](https://www.sorena.io/artifacts/global/iso-27005/scenario-library.md): ISO/IEC 27005 Scenario Library for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Certification Reality Guide](https://www.sorena.io/artifacts/global/iso-27017/certification-reality.md): ISO/IEC 27017 Certification Reality for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Cloud Provider Checklist Template and Workflow](https://www.sorena.io/artifacts/global/iso-27017/cloud-provider-checklist.md): ISO/IEC 27017 Cloud Provider Checklist for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Compliance Guide](https://www.sorena.io/artifacts/global/iso-27017/compliance.md): ISO/IEC 27017 Compliance for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Control Mapping to ISO/IEC 27001 Guide](https://www.sorena.io/artifacts/global/iso-27017/control-mapping-to-iso-27001.md): ISO/IEC 27017 Control Mapping to ISO/IEC 27001 for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 CSP vs CSC Role Split Comparison](https://www.sorena.io/artifacts/global/iso-27017/csp-vs-csc-role-split.md): CSP vs CSC Role Split for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Audit Rights FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/audit-rights.md): How should teams handle Audit Rights under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Cloud Admin Access FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/cloud-admin-access.md): How should teams handle Cloud Admin Access under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Cloud Service Agreements FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/cloud-service-agreements.md): How should teams handle Cloud Service Agreements under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Customer Controls FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/customer-controls.md): How should teams handle Customer Controls under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Logging FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/logging.md): How should teams handle Logging under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Provider Evidence FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/provider-evidence.md): How should teams handle Provider Evidence under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Shared Responsibility FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/shared-responsibility.md): How should teams handle Shared Responsibility under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Virtualization Responsibilities FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/virtualization-responsibilities.md): How should teams handle Virtualization Responsibilities under ISO/IEC 27017? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27017 Cloud Security FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq.md): ISO/IEC 27017 FAQ for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Hyperscaler Evidence Pack Workflow](https://www.sorena.io/artifacts/global/iso-27017/hyperscaler-evidence-pack-workflow.md): ISO/IEC 27017 Hyperscaler Evidence Pack Workflow for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Hyperscaler Evidence Pack](https://www.sorena.io/artifacts/global/iso-27017/hyperscaler-evidence-pack.md): ISO/IEC 27017 Hyperscaler Evidence Pack for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 vs CSA CCM Comparison](https://www.sorena.io/artifacts/global/iso-27017/iso-27017-vs-csa-ccm.md): ISO/IEC 27017 vs CSA CCM for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 vs ISO/IEC 27018 Comparison](https://www.sorena.io/artifacts/global/iso-27017/iso-27017-vs-iso-27018.md): ISO/IEC 27017 vs ISO/IEC 27018 for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 vs SOC 2 Comparison](https://www.sorena.io/artifacts/global/iso-27017/iso-27017-vs-soc-2.md): ISO/IEC 27017 vs SOC 2 for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27017 Shared Responsibility Model Guide](https://www.sorena.io/artifacts/global/iso-27017/shared-responsibility-model.md): ISO/IEC 27017 Shared Responsibility Model for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Compliance Guide](https://www.sorena.io/artifacts/global/iso-27018/compliance.md): ISO/IEC 27018 Compliance for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 DPA Clause Workflow Template and Workflow](https://www.sorena.io/artifacts/global/iso-27018/dpa-clause-workflow.md): ISO/IEC 27018 DPA Clause Workflow for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Audit Evidence FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/audit-evidence.md): How should teams handle Audit Evidence under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Breach Support FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/breach-support.md): How should teams handle Breach Support under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Customer Instructions FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/customer-instructions.md): How should teams handle Customer Instructions under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 GDPR Overlap FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/gdpr-overlap.md): How should teams handle GDPR Overlap under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Government Access FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/government-access.md): How should cloud providers handle Government Access requests under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 PII Return and Deletion FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/pii-return-and-deletion.md): How should cloud providers prove PII Return and Deletion under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Processor Duties FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/processor-duties.md): How should teams handle Processor Duties under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Subprocessor Notice FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/subprocessor-notice.md): How should teams handle Subprocessor Notice under ISO/IEC 27018? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27018 Cloud Privacy FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq.md): ISO/IEC 27018 FAQ for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Government Access Evidence Workflow](https://www.sorena.io/artifacts/global/iso-27018/government-access-evidence-workflow.md): ISO/IEC 27018 Government Access Evidence Workflow for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Government Access Evidence Guide](https://www.sorena.io/artifacts/global/iso-27018/government-access-evidence.md): ISO/IEC 27018 Government Access Evidence for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 vs GDPR Comparison](https://www.sorena.io/artifacts/global/iso-27018/iso-27018-vs-gdpr.md): ISO/IEC 27018 vs GDPR for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 vs ISO 27701 Comparison](https://www.sorena.io/artifacts/global/iso-27018/iso-27018-vs-iso-27701.md): ISO/IEC 27018 vs ISO 27701 for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 vs SOC 2 Privacy Comparison](https://www.sorena.io/artifacts/global/iso-27018/iso-27018-vs-soc-2-privacy.md): ISO/IEC 27018 vs SOC 2 Privacy for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Privacy Control Checklist](https://www.sorena.io/artifacts/global/iso-27018/privacy-control-checklist.md): ISO/IEC 27018 Privacy Control Checklist for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Public Cloud PII Processor Scope Guide](https://www.sorena.io/artifacts/global/iso-27018/public-cloud-pii-processor-scope.md): Define when ISO/IEC 27018 applies to a public cloud provider acting as a PII processor, with owner, evidence, and review guidance. - [ISO/IEC 27018 Subprocessor Evidence Workflow](https://www.sorena.io/artifacts/global/iso-27018/subprocessor-evidence-workflow.md): ISO/IEC 27018 Subprocessor Evidence Workflow for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Subprocessor Evidence Guide](https://www.sorena.io/artifacts/global/iso-27018/subprocessor-evidence.md): ISO/IEC 27018 Subprocessor Evidence for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27018 Vendor Contract Requirements Guide](https://www.sorena.io/artifacts/global/iso-27018/vendor-contract-requirements.md): ISO/IEC 27018 Vendor Contract Requirements for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Compliance Guide](https://www.sorena.io/artifacts/global/iso-27035/compliance.md): ISO/IEC 27035 Compliance for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Evidence Log Template and Workflow](https://www.sorena.io/artifacts/global/iso-27035/evidence-log-template.md): ISO/IEC 27035 Evidence Log Template for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 CSIRT Roles FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/csirt-roles.md): How should teams handle CSIRT Roles under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Escalation FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/escalation.md): How should teams handle Escalation under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Event vs Incident FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/event-vs-incident.md): How should teams distinguish a security event from an information security incident under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Lessons Learned FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/lessons-learned.md): How should teams handle Lessons Learned under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Notification Evidence FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/notification-evidence.md): How should teams handle Notification Evidence under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Post Incident Review FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/post-incident-review.md): How should teams handle Post Incident Review under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Retained Logs FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/retained-logs.md): How should teams handle Retained Logs under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Severity Classification FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/severity-classification.md): How should teams handle Severity Classification under ISO/IEC 27035? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27035 Incident Management FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq.md): ISO/IEC 27035 FAQ for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Workflow](https://www.sorena.io/artifacts/global/iso-27035/incident-lifecycle-workflow.md): ISO/IEC 27035 Incident Lifecycle Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Incident Lifecycle Guide](https://www.sorena.io/artifacts/global/iso-27035/incident-lifecycle.md): ISO/IEC 27035 Incident Lifecycle for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Incident Response Playbook](https://www.sorena.io/artifacts/global/iso-27035/incident-response-playbook.md): ISO/IEC 27035 Incident Response Playbook for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Incident Severity and Escalation Matrix](https://www.sorena.io/artifacts/global/iso-27035/incident-severity-and-escalation-matrix.md): ISO/IEC 27035 Incident Severity and Escalation Matrix for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Incident Timer Workflow Template and Workflow](https://www.sorena.io/artifacts/global/iso-27035/incident-timer-workflow.md): ISO/IEC 27035 Incident Timer Workflow for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 vs ISO 22301 Comparison](https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-iso-22301.md): ISO/IEC 27035 vs ISO 22301 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 vs NIS2 Comparison](https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-nis2.md): ISO/IEC 27035 vs NIS2 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Comparison](https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-nist-800-61.md): ISO/IEC 27035 vs NIST SP 800-61 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 Comparison](https://www.sorena.io/artifacts/global/iso-27035/iso-27035-vs-nist-800-61r3.md): ISO/IEC 27035 vs NIST SP 800-61 Rev. 3 for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27035 Notification Threshold Mapping Guide](https://www.sorena.io/artifacts/global/iso-27035/notification-threshold-mapping.md): ISO/IEC 27035 Notification Threshold Mapping for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Compliance Guide](https://www.sorena.io/artifacts/global/iso-27036/compliance.md): ISO/IEC 27036 Compliance for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Contract Security Clauses Guide](https://www.sorena.io/artifacts/global/iso-27036/contract-security-clauses.md): ISO/IEC 27036 Contract Security Clauses for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Assurance Evidence FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/assurance-evidence.md): How should teams handle Assurance Evidence under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Cloud Suppliers FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/cloud-suppliers.md): How should teams handle Cloud Suppliers under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Contract Controls FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/contract-controls.md): How should teams handle Contract Controls under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Fourth Parties FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/fourth-parties.md): How should teams manage fourth-party supplier risk under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Risk Tiers FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/risk-tiers.md): How should teams handle Risk Tiers under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Supplier Incidents FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/supplier-incidents.md): How should teams handle Supplier Incidents under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Supplier Monitoring FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/supplier-monitoring.md): How should teams handle Supplier Monitoring under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Termination and Offboarding FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/termination-and-offboarding.md): How should teams handle Termination and Offboarding under ISO/IEC 27036? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 27036 Supplier Security FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq.md): ISO/IEC 27036 FAQ for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 ICT Supply Chain Lifecycle Guide](https://www.sorena.io/artifacts/global/iso-27036/ict-supply-chain-lifecycle.md): ISO/IEC 27036 ICT Supply Chain Lifecycle for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Indirect and Fourth Party Suppliers Guide](https://www.sorena.io/artifacts/global/iso-27036/indirect-and-fourth-party-suppliers.md): ISO/IEC 27036 Indirect and Fourth Party Suppliers for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 vs NIST SP 800-161 Comparison](https://www.sorena.io/artifacts/global/iso-27036/iso-27036-vs-nist-sp-800-161.md): ISO/IEC 27036 vs NIST SP 800-161 for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Onboarding and Offboarding Workflow](https://www.sorena.io/artifacts/global/iso-27036/onboarding-and-offboarding-workflow.md): ISO/IEC 27036 Onboarding and Offboarding Workflow for ISO/IEC 27036 Information security for supplier relationships: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Supplier Assurance Framework Guide](https://www.sorena.io/artifacts/global/iso-27036/supplier-assurance-framework.md): ISO/IEC 27036 Supplier Assurance Framework for ISO/IEC 27036 Information security for supplier relationships: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Supplier Monitoring Evidence Workflow](https://www.sorena.io/artifacts/global/iso-27036/supplier-monitoring-evidence-workflow.md): ISO/IEC 27036 Supplier Monitoring Evidence Workflow for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Supplier Relationship Types Guide](https://www.sorena.io/artifacts/global/iso-27036/supplier-relationship-types.md): ISO/IEC 27036 Supplier Relationship Types for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 27036 Third Party Risk Checklist](https://www.sorena.io/artifacts/global/iso-27036/third-party-risk-checklist.md): ISO/IEC 27036 Third Party Risk Checklist for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AI Impact Assessment Template](https://www.sorena.io/artifacts/global/iso-42001/ai-impact-assessment-template.md): ISO/IEC 42001 AI Impact Assessment Template for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AI System Inventory Workflow](https://www.sorena.io/artifacts/global/iso-42001/ai-system-inventory-workflow.md): ISO/IEC 42001 AI System Inventory Workflow for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AI System Inventory Guide](https://www.sorena.io/artifacts/global/iso-42001/ai-system-inventory.md): ISO/IEC 42001 AI System Inventory for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AIMS Scope Decision Workflow](https://www.sorena.io/artifacts/global/iso-42001/aims-scope-decision-workflow.md): ISO/IEC 42001 AIMS Scope Decision Workflow for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AIMS Scope Decision Guide](https://www.sorena.io/artifacts/global/iso-42001/aims-scope-decision.md): ISO/IEC 42001 AIMS Scope Decision for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 Compliance Guide](https://www.sorena.io/artifacts/global/iso-42001/compliance.md): ISO/IEC 42001 Compliance for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 Controls and Governance Model Guide](https://www.sorena.io/artifacts/global/iso-42001/controls-and-governance-model.md): ISO/IEC 42001 Controls and Governance Model for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 AI Policy FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/ai-policy.md): How should teams handle AI Policy under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Certification FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/certification.md): How should teams handle Certification under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Generative AI FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/generative-ai.md): How should teams handle Generative AI under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 High Risk AI FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/high-risk-ai.md): How should teams handle High Risk AI under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Human Oversight FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/human-oversight.md): How should teams handle Human Oversight under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Post Market Monitoring FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/post-market-monitoring.md): How should teams operate post-market monitoring evidence under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Provider and Deployer Roles FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/provider-and-deployer-roles.md): How should teams separate AI Provider and Deployer Roles under ISO/IEC 42001 and AI governance work? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 Risk Controls FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/risk-controls.md): How should teams handle Risk Controls under ISO/IEC 42001? Practical answer with owners, evidence, review triggers, and external source references. - [ISO/IEC 42001 AI Management FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq.md): ISO/IEC 42001 FAQ for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 vs EU AI Act Comparison](https://www.sorena.io/artifacts/global/iso-42001/iso-42001-vs-eu-ai-act.md): ISO/IEC 42001 vs EU AI Act for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 vs ISO 23894 Comparison](https://www.sorena.io/artifacts/global/iso-42001/iso-42001-vs-iso-23894.md): Compare ISO/IEC 42001 and ISO/IEC 23894 for AI management systems, risk governance, evidence ownership, review cadence, and cited implementation planning. - [ISO/IEC 42001 vs NIST AI RMF Comparison](https://www.sorena.io/artifacts/global/iso-42001/iso-42001-vs-nist-ai-rmf.md): ISO/IEC 42001 vs NIST AI RMF for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 Model Monitoring Evidence Guide](https://www.sorena.io/artifacts/global/iso-42001/model-monitoring-evidence.md): ISO/IEC 42001 Model Monitoring Evidence for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [ISO/IEC 42001 Requirements Guide](https://www.sorena.io/artifacts/global/iso-42001/requirements.md): ISO/IEC 42001 Requirements for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. - [NIST CSF 2.0 compliance playbook](https://www.sorena.io/artifacts/global/nist-csf-2-0/compliance.md): Practical NIST CSF 2.0 compliance playbook guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 Core Functions Deep Dive](https://www.sorena.io/artifacts/global/nist-csf-2-0/core-functions.md): Practical NIST CSF 2.0 Core Functions Deep Dive guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 Evidence Mapping Workflow](https://www.sorena.io/artifacts/global/nist-csf-2-0/csf-evidence-mapping-workflow.md): A practical NIST CSF 2.0 Evidence Mapping Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST CSF 2.0 vs CIS Controls v8: mapping table and gap analysis](https://www.sorena.io/artifacts/global/nist-csf-2-0/csf-vs-cis-controls.md): Compare NIST CSF 2.0 and CIS Controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0 vs SP 800-53 Rev. 5: control mapping and coverage gaps](https://www.sorena.io/artifacts/global/nist-csf-2-0/csf-vs-nist-sp-800-53.md): Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0 vs NIST RMF: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-csf-2-0/csf-vs-rmf.md): Compare NIST CSF 2.0 and NIST RMF with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0: step-by-step workflow for building current and target profiles](https://www.sorena.io/artifacts/global/nist-csf-2-0/current-target-profile-decision-workflow.md): Practical NIST CSF 2.0 Current and Target Profile Decision Workflow guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 current and target profile template: operating columns and evidence rows](https://www.sorena.io/artifacts/global/nist-csf-2-0/current-target-profile-template.md): A practical NIST CSF 2.0 Current and Target Profile Operating Template workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST CSF 2.0 Current vs Target Profile Template](https://www.sorena.io/artifacts/global/nist-csf-2-0/current-vs-target-profile-template.md): Practical NIST CSF 2.0 Current vs Target Profile Template guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [Which NIST CSF 2.0 metrics are useful for board and executive reporting?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/board-metrics.md): Use board-level CSF 2.0 metrics that show risk decisions, business impact, target-profile gaps, and progress against priorities. Avoid only reporting control counts; executives need to see whether cybersecurity outcomes are improving in the context of organizational objectives. - [What should an NIST CSF 2.0 Current Profile include to be useful for audits and risk decisions?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/current-profiles.md): A useful CSF 2.0 Current Profile should show current outcomes, accountable owners, supporting evidence, known gaps, dependencies, and review dates. It should be specific enough that a reviewer can understand what is true today without re-interviewing every team. - [How should teams handle evidence mapping under NIST CSF 2.0?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/evidence-mapping.md): How should teams handle evidence mapping under NIST CSF 2.0? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [NIST CSF 2.0 GOVERN Function FAQ](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/govern-function.md): Start the NIST CSF 2.0 GOVERN function by naming decision owners, risk strategy, policy expectations, oversight cadence, and supplier-risk accountability before mapping controls. - [How should teams handle implementation examples under NIST CSF 2.0?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/implementation-examples.md): How should teams handle implementation examples under NIST CSF 2.0? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle supplier risk under NIST CSF 2.0?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/supplier-risk.md): How should teams handle supplier risk under NIST CSF 2.0? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle target profiles under NIST CSF 2.0?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/target-profiles.md): How should teams handle target profiles under NIST CSF 2.0? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle tiers under NIST CSF 2.0?](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/tiers.md): How should teams handle tiers under NIST CSF 2.0? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [NIST CSF 2.0 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq.md): Standalone NIST CSF 2.0 FAQ questions with cited answers, implementation checklists, and evidence guidance. - [NIST CSF 2.0 Governance and Metrics Guide](https://www.sorena.io/artifacts/global/nist-csf-2-0/governance-and-metrics.md): Practical NIST CSF 2.0 Governance and Metrics Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 Implementation Examples Guide](https://www.sorena.io/artifacts/global/nist-csf-2-0/implementation-examples.md): Practical NIST CSF 2.0 Implementation Examples Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 vs CIS Controls: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-cis-controls.md): Compare NIST CSF 2.0 and CIS Controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0 vs ISO/IEC 27001: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-iso-27001.md): Compare NIST CSF 2.0 and ISO/IEC 27001 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0 vs NIST SP 800-53 Rev. 5: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-csf-2-0/nist-csf-vs-nist-sp-800-53.md): Compare NIST CSF 2.0 and NIST SP 800-53 Rev. 5 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST CSF 2.0 Profile Workshop Template](https://www.sorena.io/artifacts/global/nist-csf-2-0/profile-workshop-template.md): Practical NIST CSF 2.0 Profile Workshop Template guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST CSF 2.0 Profile Workshop Workflow](https://www.sorena.io/artifacts/global/nist-csf-2-0/profile-workshop-workflow.md): A practical NIST CSF 2.0 Profile Workshop Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/c-scrm-governance-checklist.md): A practical NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-161 Rev. 1 C-SCRM Governance Guide](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/c-scrm-governance.md): Practical NIST SP 800-161 Rev. 1 C-SCRM Governance Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-161 Rev. 1 compliance playbook](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/compliance.md): Practical NIST SP 800-161 Rev. 1 compliance playbook guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-161 Rev. 1 Contract and Monitoring Controls](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/contract-and-monitoring-controls.md): Practical NIST SP 800-161 Rev. 1 Contract and Monitoring Controls guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-161 Rev. 1 Criticality Analysis Guide](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/criticality-analysis.md): Practical NIST SP 800-161 Rev. 1 Criticality Analysis Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [Which contract controls should teams define under NIST SP 800-161 Rev. 1?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md): Which contract controls should teams define under NIST SP 800-161 Rev. 1? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md): How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md): How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md): How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md): How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md): How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md): How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md): How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [NIST SP 800-161 Rev. 1 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq.md): Standalone NIST SP 800-161 Rev. 1 FAQ questions with cited answers, implementation checklists, and evidence guidance. - [NIST SP 800-161 Rev. 1 vs DORA ICT third-party risk: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/nist-sp-800-161-vs-dora.md): Compare NIST SP 800-161 Rev. 1 and DORA ICT third-party risk with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-161 Rev. 1 vs ISO/IEC 27036 supplier relationships: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/nist-sp-800-161-vs-iso-27036.md): Compare NIST SP 800-161 Rev. 1 and ISO/IEC 27036 supplier relationships with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/provenance-and-sbom-supplier-controls.md): Practical NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-161 Rev. 1: workflow for collecting and validating C-SCRM supplier evidence](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/supplier-assessment-evidence-workflow.md): A practical NIST SP 800-161 Rev. 1 Supplier Assessment Evidence Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-161 Rev. 1 supplier assessment evidence: required artefacts and evaluation criteria](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/supplier-assessment-evidence.md): Practical NIST SP 800-161 Rev. 1 Supplier Assessment Evidence Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-161 Rev. 1 Supplier Risk Tiering](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/supplier-risk-tiering.md): Practical NIST SP 800-161 Rev. 1 Supplier Risk Tiering guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-218 SSDF compliance playbook](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/compliance.md): Practical NIST SP 800-218 SSDF compliance playbook guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-218 SSDF Evidence for Audits Guide](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/evidence-for-audits.md): Practical NIST SP 800-218 SSDF Evidence for Audits Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [What build integrity should teams keep for NIST SSDF SP 800-218?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/build-integrity.md): What build integrity should teams keep for NIST SSDF SP 800-218. Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle code scanning under NIST SP 800-218 SSDF?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/code-scanning.md): How should teams handle code scanning under NIST SP 800-218 SSDF? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle components under NIST SP 800-218 SSDF?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/components.md): How should teams handle components under NIST SP 800-218 SSDF? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [Why does provenance matter in NIST SP 800-218 SSDF implementation?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/provenance.md): Provenance matters in NIST SP 800-218 SSDF implementation because teams need reviewable evidence for source, dependencies, build process, approvals, and software artifact lineage. - [How should teams handle release gates under NIST SP 800-218 SSDF?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/release-gates.md): How should teams handle release gates under NIST SP 800-218 SSDF? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [What secure coding evidence should teams keep for NIST SSDF SP 800-218?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/secure-coding-evidence.md): What secure coding evidence should teams keep for NIST SSDF SP 800-218. Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle threat modeling under NIST SP 800-218 SSDF?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/threat-modeling.md): How should teams handle threat modeling under NIST SP 800-218 SSDF? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle vulnerability disclosure under NIST SP 800-218 SSDF?](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/vulnerability-disclosure.md): How should teams handle vulnerability disclosure under NIST SP 800-218 SSDF? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [NIST SP 800-218 SSDF FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq.md): Standalone NIST SP 800-218 SSDF FAQ questions with cited answers, implementation checklists, and evidence guidance. - [NIST SP 800-218 SSDF PO, PS, PW, and RV Practice Deep Dive](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/practice-groups.md): Practical NIST SP 800-218 SSDF PO, PS, PW, and RV Practice Deep Dive guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-218 SSDF SBOM and Provenance Workflow](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/sbom-and-provenance-workflow.md): Practical NIST SP 800-218 SSDF SBOM and Provenance Workflow guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-218 SSDF Secure Development Practices Guide](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/secure-development-practices.md): Practical NIST SP 800-218 SSDF Secure Development Practices Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-218 SSDF Self-Attestation Workflow](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/ssdf-self-attestation-workflow.md): A practical NIST SP 800-218 SSDF Self-Attestation Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-218 SSDF Self-Attestation Guide](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/ssdf-self-attestation.md): Practical NIST SP 800-218 SSDF Self-Attestation Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SSDF vs SP 800-53 SA controls: practice-to-control mapping table](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/ssdf-vs-800-53-sa-controls.md): Compare NIST SSDF and NIST SP 800-53 SA controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SSDF vs NIST SP 800-53 SA controls: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/ssdf-vs-nist-800-53-sa-controls.md): Compare NIST SSDF and NIST SP 800-53 SA controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SSDF vs SLSA: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/ssdf-vs-slsa.md): Compare NIST SSDF and SLSA with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-53 Rev. 5 vs NIST SP 800-171 Decision Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/800-53-vs-800-171.md): Practical guidance for applying NIST SP 800-53 Rev. 5 vs NIST SP 800-171 Decision Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-53 Rev. 5 vs CIS Controls Decision Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/800-53-vs-cis-controls.md): Practical guidance for applying NIST SP 800-53 Rev. 5 vs CIS Controls Decision Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-53 Rev. 5 vs NIST CSF Decision Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/800-53-vs-csf.md): Practical guidance for applying NIST SP 800-53 Rev. 5 vs NIST CSF Decision Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-53 Rev. 5 SP 800-53A Assessment Procedures Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/assessment-procedures-800-53a.md): NIST SP 800-53A gives assessors a methodology and set of procedures for checking whether security and privacy controls are implemented correctly, operating as intended, and producing the desired outcome. - [NIST SP 800-53 Rev. 5 Baseline Selection Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/baseline-selection.md): Practical guidance for applying NIST SP 800-53 Rev. 5 Baseline Selection Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-53 Rev. 5 compliance playbook](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/compliance.md): Practical NIST SP 800-53 Rev. 5 compliance playbook guidance with scoped outcomes, accountable ownership, and evidence expectations. - [NIST SP 800-53 Rev. 5 Control Assessment Evidence Workflow](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/control-assessment-evidence-workflow.md): A practical NIST SP 800-53 Rev. 5 Control Assessment Evidence Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-53 Rev. 5 Control Family Deep Dive](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/control-families.md): Practical NIST SP 800-53 Rev. 5 Control Family Deep Dive guidance with scoped outcomes, accountable ownership, and evidence expectations. - [NIST SP 800-53 Rev. 5 Control Tailoring Method](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/control-tailoring-method.md): Practical NIST SP 800-53 Rev. 5 Control Tailoring Method guidance with scoped outcomes, accountable ownership, and evidence expectations. - [NIST SP 800-53 Rev. 5 Evidence and Audit Readiness Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/evidence-and-audit-readiness.md): Practical guidance for applying NIST SP 800-53 Rev. 5 Evidence and Audit Readiness Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [What evidence should teams collect for NIST SP 800-53A control assessments?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/800-53a-assessment-evidence.md): Collect evidence that matches the assessment objective and method: documents for examine, people and decisions for interview, and operating results for test. Each evidence item should be dated, scoped, and tied to the assessed control. - [How should teams handle assessment methods under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/assessment-methods.md): How should teams handle assessment methods under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle baselines under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/baselines.md): How should teams handle baselines under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle common controls under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/common-controls.md): How should teams handle common controls under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle control enhancements under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/control-enhancements.md): How should teams handle control enhancements under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle inheritance under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/inheritance.md): How should teams handle inheritance under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle parameters under NIST SP 800-53 Rev. 5?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/parameters.md): How should teams handle parameters under NIST SP 800-53 Rev. 5? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [What should a POA&M item include for NIST SP 800-53 Rev. 5 control gaps?](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/poam-items.md): A POA&M item should state the control gap, risk, affected system, required remediation, owner, milestone dates, evidence needed for closure, and approval path for any residual risk or delay. - [NIST SP 800-53 Rev. 5 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq.md): Standalone NIST SP 800-53 Rev. 5 FAQ questions with cited answers, implementation checklists, and evidence guidance. - [NIST SP 800-53 Rev. 5 vs NIST SP 800-171 Rev. 3: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/nist-800-53-vs-800-171.md): Compare NIST SP 800-53 Rev. 5 and NIST SP 800-171 Rev. 3 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-53 Rev. 5 vs CIS Controls: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/nist-800-53-vs-cis-controls.md): Compare NIST SP 800-53 Rev. 5 and CIS Controls with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-53 Rev. 5 vs ISO/IEC 27001: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/nist-800-53-vs-iso-27001.md): Compare NIST SP 800-53 Rev. 5 and ISO/IEC 27001 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-53 Rev. 5 vs NIST CSF 2.0: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/nist-800-53-vs-nist-csf.md): Compare NIST SP 800-53 Rev. 5 and NIST CSF 2.0 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-53 Rev. 5 Overlays and Common Controls Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/overlays-and-common-controls.md): Practical guidance for applying NIST SP 800-53 Rev. 5 Overlays and Common Controls Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-53 Rev. 5 POA&M Evidence Workflow](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/poam-evidence-workflow.md): A practical NIST SP 800-53 Rev. 5 POA&M Evidence Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-53 Rev. 5 POA&M Evidence Guide](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/poam-evidence.md): Practical guidance for applying NIST SP 800-53 Rev. 5 POA&M Evidence Guide using scoped outcomes, accountable ownership, evidence expectations, and review checkpoints. - [NIST SP 800-61 Rev. 3 incident communications: stakeholder matrix and notification templates](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/communications-and-escalation.md): Practical NIST SP 800-61 Rev. 3 Communications and Escalation Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-61 Rev. 3: escalation decision workflow for incident communications](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/communications-escalation-workflow.md): A practical NIST SP 800-61 Rev. 3 Communications Escalation Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-61 Rev. 3 compliance playbook](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/compliance.md): Practical NIST SP 800-61 Rev. 3 compliance playbook guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-61 Rev. 3 CSF 2.0 Incident Profile Guide](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/csf-2-0-incident-profile.md): Practical NIST SP 800-61 Rev. 3 CSF 2.0 Incident Profile Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [How should teams handle communications under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/communications.md): How should teams handle communications under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [Which CSIRT roles should teams define under NIST SP 800-61 Rev. 3?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/csirt-roles.md): Which CSIRT roles should teams define under NIST SP 800-61 Rev. 3? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle event vs. incident under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/event-vs-incident.md): How should teams handle event vs. incident under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle lessons learned under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/lessons-learned.md): How should teams handle lessons learned under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle post-incident evidence under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/post-incident-evidence.md): How should teams handle post-incident evidence under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [What should recovery include in a NIST SP 800-61 Rev. 3 incident response process?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/recovery.md): Recovery should include restoring affected services, validating that the incident is contained, confirming monitoring is in place, communicating status, preserving evidence, and deciding when normal operations can safely resume. - [How should teams handle reporting clocks under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/reporting-clocks.md): How should teams handle reporting clocks under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [How should teams handle severity under NIST SP 800-61 Rev. 3 incident response?](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/severity.md): How should teams handle severity under NIST SP 800-61 Rev. 3 incident response? Clear, cited guidance with practical evidence checks, owner decisions, and implementation steps. - [NIST SP 800-61 Rev. 3 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq.md): Standalone NIST SP 800-61 Rev. 3 FAQ questions with cited answers, implementation checklists, and evidence guidance. - [NIST SP 800-61 Rev. 3 Incident Response Playbook Template](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/incident-response-playbook-template.md): Practical NIST SP 800-61 Rev. 3 Incident Response Playbook Template guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-61 Rev. 3 vs CISA playbooks: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/nist-800-61-vs-cisa-playbooks.md): Compare NIST SP 800-61 Rev. 3 and CISA playbooks with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-61 Rev. 3 vs ISO 22301 business continuity: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/nist-800-61-vs-iso-22301.md): Compare NIST SP 800-61 Rev. 3 and ISO 22301 business continuity with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-61 Rev. 3 vs ISO/IEC 27035: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/nist-800-61-vs-iso-27035.md): Compare NIST SP 800-61 Rev. 3 and ISO/IEC 27035 with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-61 Rev. 3 vs NIS2 incident reporting: practical side-by-side comparison](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/nist-800-61-vs-nis2.md): Compare NIST SP 800-61 Rev. 3 and NIS2 incident reporting with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows. - [NIST SP 800-61 Rev. 3 Post-Incident Evidence Log Workflow](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/post-incident-evidence-log-workflow.md): A practical NIST SP 800-61 Rev. 3 Post-Incident Evidence Log Workflow with steps, owners, evidence fields, decisions, and cited-source review triggers. - [NIST SP 800-61 Rev. 3 Changes Guide](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/rev-3-changes.md): Practical NIST SP 800-61 Rev. 3 Changes Guide guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [NIST SP 800-61 Rev. 3 Severity Classification and SLA Model](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/severity-classification-and-sla-model.md): Practical NIST SP 800-61 Rev. 3 Severity Classification and SLA Model guidance with cited decisions, owner checklists, evidence records, and implementation steps. - [Brazil LGPD Anpd Enforcement and Fines Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/anpd-enforcement-and-fines.md): Brazil LGPD guidance for Anpd Enforcement and Fines, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Applicability Test Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/applicability-test.md): Practical guidance for the Brazil LGPD applicability test, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Breach Notification Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/breach-notification.md): Brazil LGPD guidance for Breach Notification, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Checklist](https://www.sorena.io/artifacts/latam/brazil-lgpd/checklist.md): Practical guidance for the Brazil LGPD checklist, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Compliance Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/compliance.md): Practical guidance for the Brazil LGPD compliance, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Controller Operator and DPO Roles Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/controller-operator-and-dpo-roles.md): Brazil LGPD guidance for Controller Operator and DPO Roles, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Data Subject Rights Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/data-subject-rights.md): Brazil LGPD guidance for Data Subject Rights, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/deadlines-and-compliance-calendar.md): Brazil LGPD guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD DSAR Workflow Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/dsar-workflow.md): Brazil LGPD guidance for DSAR Workflow, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Children's Data under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/children-s-data.md): Brazil LGPD guidance for Children's Data, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Controller Operator and DPO Roles under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/controller-operator-and-dpo-roles.md): Brazil LGPD guidance for Controller Operator and DPO Roles, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Cookies under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/cookies.md): Brazil LGPD guidance for Cookies, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Incident Reporting To ANPD under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/incident-reporting-to-anpd.md): Brazil LGPD guidance for Incident Reporting To ANPD, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about International Transfer Mechanisms under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/international-transfer-mechanisms.md): Brazil LGPD guidance for International Transfer Mechanisms, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Legal Bases under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/legal-bases.md): Brazil LGPD guidance for Legal Bases, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Legitimate Interest Balancing under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/legitimate-interest-balancing.md): Brazil LGPD guidance for Legitimate Interest Balancing, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Ripd and DPIA under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/ripd-and-dpia.md): Brazil LGPD guidance for Ripd and DPIA, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sanctions Methodology under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/sanctions-methodology.md): Brazil LGPD guidance for Sanctions Methodology, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Small Processing Agents under the Brazil LGPD?](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/small-processing-agents.md): Brazil LGPD guidance for Small Processing Agents, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Privacy Law FAQ](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq.md): Practical guidance for the Brazil LGPD FAQ, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Incident Reporting To Anpd Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/incident-reporting-to-anpd.md): Brazil LGPD guidance for Incident Reporting To Anpd, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Incident Workflow Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/incident-workflow.md): Brazil LGPD guidance for Incident Workflow, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD International Transfer Mechanisms Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/international-transfer-mechanisms.md): Brazil LGPD guidance for International Transfer Mechanisms, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD International Transfers Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/international-transfers.md): Brazil LGPD guidance for International Transfers, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Lawful Bases Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/lawful-bases.md): Brazil LGPD guidance for Lawful Bases, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Legal Bases and Legitimate Interest Balancing Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/legal-bases-and-legitimate-interest-balancing.md): Brazil LGPD guidance for Legal Bases and Legitimate Interest Balancing, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD DSAR Response Template Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/lgpd-dsar-response-template.md): Brazil LGPD guidance for LGPD DSAR Response Template, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD vs CCPA Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/lgpd-vs-ccpa.md): Brazil LGPD guidance for LGPD vs CCPA, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD vs GDPR Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/lgpd-vs-gdpr.md): Brazil LGPD guidance for LGPD vs GDPR, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD penalties and fines Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/penalties-and-fines.md): Brazil LGPD guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Requirements Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/requirements.md): Practical guidance for the Brazil LGPD requirements, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Ripd and DPIA Evidence Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/ripd-and-dpia-evidence.md): Brazil LGPD guidance for Ripd and DPIA Evidence, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Ripd Workflow Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/ripd-workflow.md): Brazil LGPD guidance for Ripd Workflow, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Small Processing Agents Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/small-processing-agents.md): Brazil LGPD guidance for Small Processing Agents, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Templates Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/templates.md): Practical guidance for the Brazil LGPD templates, with practical decisions, evidence, edge cases, and external source citations. - [Brazil LGPD Transfer Workflow Guide](https://www.sorena.io/artifacts/latam/brazil-lgpd/transfer-workflow.md): Brazil LGPD guidance for Transfer Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Age Assurance Options Guide](https://www.sorena.io/artifacts/uk/online-safety-act/age-assurance-options.md): UK Online Safety Act guidance for Age Assurance Options, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Age Assurance Selection Workflow Guide](https://www.sorena.io/artifacts/uk/online-safety-act/age-assurance-selection-workflow.md): UK Online Safety Act guidance for Age Assurance Selection Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Age Assurance Guide](https://www.sorena.io/artifacts/uk/online-safety-act/age-assurance.md): UK Online Safety Act guidance for Age Assurance, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Applicability Test Guide](https://www.sorena.io/artifacts/uk/online-safety-act/applicability-test.md): Practical guidance for the UK Online Safety Act applicability test, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Categorisation Guide](https://www.sorena.io/artifacts/uk/online-safety-act/categorisation.md): UK Online Safety Act guidance for Categorisation, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Checklist](https://www.sorena.io/artifacts/uk/online-safety-act/checklist.md): Practical guidance for the UK Online Safety Act checklist, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Children's Access Assessment Guide](https://www.sorena.io/artifacts/uk/online-safety-act/children-s-access-assessment.md): UK Online Safety Act guidance for Children's Access Assessment, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Children's Safety Duties Guide](https://www.sorena.io/artifacts/uk/online-safety-act/children-safety-duties.md): UK Online Safety Act guidance for Children's Safety Duties, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Complaint and Appeal Handling Workflow Guide](https://www.sorena.io/artifacts/uk/online-safety-act/complaint-and-appeal-handling-workflow.md): UK Online Safety Act guidance for Complaint and Appeal Handling Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Compliance Guide](https://www.sorena.io/artifacts/uk/online-safety-act/compliance.md): Practical guidance for the UK Online Safety Act compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Content Moderation and Appeals Guide](https://www.sorena.io/artifacts/uk/online-safety-act/content-moderation-and-appeals.md): UK Online Safety Act guidance for Content Moderation and Appeals, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/uk/online-safety-act/deadlines-and-compliance-calendar.md): UK Online Safety Act guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Enforcement and Penalties Guide](https://www.sorena.io/artifacts/uk/online-safety-act/enforcement-and-penalties.md): UK Online Safety Act guidance for Enforcement and Penalties, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Age Assurance under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/age-assurance.md): UK Online Safety Act guidance for Age Assurance, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Categorisation under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/categorisation.md): UK Online Safety Act guidance for Categorisation, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Children's Access Assessment under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/children-s-access-assessment.md): UK Online Safety Act guidance for Children's Access Assessment, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Ico Overlap under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/ico-overlap.md): UK Online Safety Act guidance for Ico Overlap, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Illegal Content Risk Assessment under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/illegal-content-risk-assessment.md): UK Online Safety Act guidance for Illegal Content Risk Assessment, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Moderation and Appeals under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/moderation-and-appeals.md): UK Online Safety Act guidance for Moderation and Appeals, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Ofcom enforcement: penalty tiers, investigations, and senior manager liability](https://www.sorena.io/artifacts/uk/online-safety-act/faq/ofcom-enforcement.md): UK Online Safety Act guidance for Ofcom Enforcement, with practical decisions, evidence, edge cases, and external source citations. - [How should teams decide whether UK Online Safety Act applies?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/regulated-service-scope.md): UK Online Safety Act guidance for Regulated Service Scope, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Senior Manager Liability under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/senior-manager-liability.md): UK Online Safety Act guidance for Senior Manager Liability, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Transparency Reporting under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/transparency-reporting.md): UK Online Safety Act guidance for Transparency Reporting, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about User-to-user and Search Services under the UK Online Safety Act?](https://www.sorena.io/artifacts/uk/online-safety-act/faq/user-to-user-and-search-services.md): UK Online Safety Act guidance for User-to-user and Search Services, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act FAQ](https://www.sorena.io/artifacts/uk/online-safety-act/faq.md): Practical guidance for the UK Online Safety Act FAQ, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act ICO Overlap Guide](https://www.sorena.io/artifacts/uk/online-safety-act/ico-overlap.md): UK Online Safety Act guidance for ICO Overlap, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Illegal Content Duties Explained Guide](https://www.sorena.io/artifacts/uk/online-safety-act/illegal-content-duties-explained.md): UK Online Safety Act guidance for Illegal Content Duties Explained, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Illegal Content Risk Assessment Guide](https://www.sorena.io/artifacts/uk/online-safety-act/illegal-content-risk-assessment.md): UK Online Safety Act guidance for Illegal Content Risk Assessment, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Moderation and Appeals Guide](https://www.sorena.io/artifacts/uk/online-safety-act/moderation-and-appeals.md): UK Online Safety Act guidance for Moderation and Appeals, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Ofcom Enforcement Guide](https://www.sorena.io/artifacts/uk/online-safety-act/ofcom-enforcement.md): UK Online Safety Act guidance for Ofcom Enforcement, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act vs Dsa Guide](https://www.sorena.io/artifacts/uk/online-safety-act/online-safety-act-vs-dsa.md): UK Online Safety Act guidance for Online Safety Act vs Dsa, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Online Safety Risk Assessment Template Guide](https://www.sorena.io/artifacts/uk/online-safety-act/online-safety-risk-assessment-template.md): UK Online Safety Act guidance for Online Safety Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act penalties and fines Guide](https://www.sorena.io/artifacts/uk/online-safety-act/penalties-and-fines.md): UK Online Safety Act guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Regulated Service Scope Guide](https://www.sorena.io/artifacts/uk/online-safety-act/regulated-service-scope.md): UK Online Safety Act guidance for Regulated Service Scope, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Requirements Guide](https://www.sorena.io/artifacts/uk/online-safety-act/requirements.md): Practical guidance for the UK Online Safety Act requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Risk Assessment Workflow Guide](https://www.sorena.io/artifacts/uk/online-safety-act/risk-assessment-workflow.md): UK Online Safety Act guidance for Risk Assessment Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Risk Assessments Playbook Guide](https://www.sorena.io/artifacts/uk/online-safety-act/risk-assessments-playbook.md): UK Online Safety Act guidance for Risk Assessments Playbook, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Senior Manager Liability Guide](https://www.sorena.io/artifacts/uk/online-safety-act/senior-manager-liability.md): UK Online Safety Act guidance for Senior Manager Liability, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Service Classification Workflow Guide](https://www.sorena.io/artifacts/uk/online-safety-act/service-classification-workflow.md): UK Online Safety Act guidance for Service Classification Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Service Scope and Categorization Guide](https://www.sorena.io/artifacts/uk/online-safety-act/service-scope-and-categorization.md): UK Online Safety Act guidance for Service Scope and Categorization, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act Transparency Reporting Guide](https://www.sorena.io/artifacts/uk/online-safety-act/transparency-reporting.md): UK Online Safety Act guidance for Transparency Reporting, with practical decisions, evidence, edge cases, and external source citations. - [UK Online Safety Act User-to-user and Search Services Guide](https://www.sorena.io/artifacts/uk/online-safety-act/user-to-user-and-search-services.md): UK Online Safety Act guidance for User-to-user and Search Services, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Applicability Test Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/applicability-test.md): Practical guidance for the UK PSTI Product Security applicability test, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Checklist](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/checklist.md): Practical guidance for the UK PSTI Product Security checklist, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Compliance Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/compliance.md): Practical guidance for the UK PSTI Product Security compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/deadlines-and-compliance-calendar.md): UK PSTI Product Security guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Default Password Requirements](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/default-password-requirements.md): A cited guide to the UK PSTI default password rule for consumer connectable products: unique passwords, user-defined setup, prohibited patterns, and evidence to keep. - [UK PSTI Product Security ETSI Evidence Mapping Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/etsi-evidence-mapping.md): UK PSTI Product Security guidance for ETSI Evidence Mapping, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Default Passwords under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/default-passwords.md): UK PSTI Product Security guidance for Default Passwords, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about ETSI Evidence under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/etsi-evidence.md): UK PSTI Product Security guidance for ETSI Evidence, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Excepted Products under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/excepted-products.md): UK PSTI Product Security guidance for Excepted Products, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Importer and Distributor Duties under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/importer-and-distributor-duties.md): UK PSTI Product Security guidance for Importer and Distributor Duties, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about OPSS Notices under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/opss-notices.md): UK PSTI Product Security guidance for OPSS Notices, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Relevant Connectable Products under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/relevant-connectable-products.md): UK PSTI Product Security guidance for Relevant Connectable Products, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Statement Of Compliance under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/statement-of-compliance.md): UK PSTI Product Security guidance for Statement Of Compliance, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Support Periods under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/support-periods.md): UK PSTI Product Security guidance for Support Periods, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Update Transparency under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/update-transparency.md): UK PSTI Product Security guidance for Update Transparency, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Vulnerability Disclosure under UK PSTI Product Security?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/vulnerability-disclosure.md): UK PSTI Product Security guidance for Vulnerability Disclosure, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security FAQ](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq.md): Practical guidance for the UK PSTI Product Security FAQ, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Importer and Distributor Duties Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/importer-and-distributor-duties.md): UK PSTI Product Security guidance for Importer and Distributor Duties, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Minimum Support Period and Update Transparency Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/minimum-support-period-and-update-transparency.md): UK PSTI Product Security guidance for Minimum Support Period and Update Transparency, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security OPSS Enforcement and Penalties Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/opss-enforcement-and-penalties.md): UK PSTI Product Security guidance for OPSS enforcement and penalties, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security OPSS Notices Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/opss-notices.md): UK PSTI Product Security guidance for OPSS Notices, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security penalties and fines Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/penalties-and-fines.md): UK PSTI Product Security guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Password and Update Policy Requirements Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-password-and-update-policy-requirements.md): UK PSTI Product Security guidance for PSTI Password and Update Policy Requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Scope Classifier Workflow Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-scope-classifier-workflow.md): UK PSTI Product Security guidance for PSTI Scope Classifier Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Statement Of Compliance Template Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-statement-of-compliance-template.md): UK PSTI Product Security guidance for PSTI Statement Of Compliance Template, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI vs Australia Cyber Security Act Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-australia-cyber-security-act.md): UK PSTI Product Security guidance for PSTI vs Australia Cyber Security Act, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs CRA Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-cra.md): UK PSTI Product Security guidance for PSTI vs CRA, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs ETSI EN 303 645 Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-etsi-en-303-645.md): UK PSTI Product Security guidance for PSTI vs ETSI EN 303 645, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs EU Cyber Resilience Act Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-eu-cyber-resilience-act.md): UK PSTI Product Security guidance for PSTI vs EU Cyber Resilience Act, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: is your product a relevant connectable product? scope test](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/relevant-connectable-product-scope.md): UK PSTI Product Security guidance for Relevant Connectable Product Scope, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act relevant connectable products: full scope and category definitions](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/relevant-connectable-products-scope.md): UK PSTI Product Security guidance for Relevant Connectable Products Scope, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Requirements Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/requirements.md): Practical guidance for the UK PSTI Product Security requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Requirements In Practice Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/security-requirements-in-practice.md): UK PSTI Product Security guidance for Security Requirements In Practice, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act statement of compliance: evidence requirements and audit documentation](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance-and-evidence.md): UK PSTI Product Security guidance for Statement Of Compliance and Evidence, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: step-by-step statement of compliance preparation workflow](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance-workflow.md): UK PSTI Product Security guidance for Statement Of Compliance Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act statement of compliance: what must the SoC contain?](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance.md): UK PSTI Product Security guidance for Statement Of Compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Supply Chain Roles Manufacturer Importer Distributor Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/supply-chain-roles-manufacturer-importer-distributor.md): UK PSTI Product Security guidance for Supply Chain Roles Manufacturer Importer Distributor, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Support Period Evidence Workflow Guide](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/support-period-evidence-workflow.md): UK PSTI Product Security guidance for Support Period Evidence Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: vulnerability disclosure policy requirements and template](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/vulnerability-disclosure-policy.md): UK PSTI Product Security guidance for Vulnerability Disclosure Policy, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: step-by-step vulnerability disclosure process workflow](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/vulnerability-disclosure-workflow.md): UK PSTI Product Security guidance for Vulnerability Disclosure Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR 72-hour Breach Reporting Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/72-hour-breach-reporting.md): UK GDPR guidance for 72-hour Breach Reporting, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Adequacy Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/adequacy.md): UK GDPR guidance for Adequacy, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR AI and Automated Decisions Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/ai-and-automated-decisions.md): UK GDPR guidance for AI and Automated Decisions, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Applicability Test Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/applicability-test.md): Practical guidance for the UK GDPR applicability test, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Article 30 Records Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/article-30-records.md): UK GDPR guidance for Article 30 Records, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Breach Notification Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/breach-notification.md): UK GDPR guidance for Breach Notification, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Breach Workflow Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/breach-workflow.md): UK GDPR guidance for Breach Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Compliance Checklist](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/checklist.md): Practical guidance for the UK GDPR checklist, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Children and Age Appropriate Design Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/children-and-age-appropriate-design.md): UK GDPR guidance for Children and Age Appropriate Design, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Children's Code Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/children-s-code.md): UK GDPR guidance for Children's Code, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Compliance Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/compliance.md): Practical guidance for the UK GDPR compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Controller and Processor Status Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/controller-and-processor-status.md): UK GDPR guidance for Controller and Processor Status, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Data Subject Rights Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/data-subject-rights.md): UK GDPR guidance for Data Subject Rights, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/deadlines-and-compliance-calendar.md): UK GDPR guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR DPIA Workflow Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/dpia-workflow.md): UK GDPR guidance for DPIA Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR DPIAs and DPOs Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/dpias-and-dpos.md): UK GDPR guidance for DPIAs and DPOs, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR DSAR Workflow Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/dsar-workflow.md): UK GDPR guidance for DSAR Workflow, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about 72-hour Breach Reporting under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/72-hour-breach-reporting.md): UK GDPR guidance for 72-hour Breach Reporting, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Adequacy under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/adequacy.md): UK GDPR guidance for Adequacy, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about AI and Automated Decisions under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/ai-and-automated-decisions.md): UK GDPR guidance for AI and Automated Decisions, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Article 30 Records under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/article-30-records.md): UK GDPR guidance for Article 30 Records, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Children's Code under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/children-s-code.md): UK GDPR guidance for Children's Code, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Controller and Processor Status under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/controller-and-processor-status.md): UK GDPR guidance for Controller and Processor Status, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about DPIAs under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/dpias.md): UK GDPR guidance for DPIAs, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about DPOs under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/dpos.md): UK GDPR guidance for DPOs, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about IDTA addendum and transfer risk assessment under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/idta-addendum-and-transfer-risk-assessment.md): UK GDPR guidance for IDTA addendum and transfer risk assessment, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Lawful Bases under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/lawful-bases.md): UK GDPR guidance for Lawful Bases, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about PECR Cookies under the UK GDPR?](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/pecr-cookies.md): UK GDPR guidance for PECR Cookies, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Compliance FAQ](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq.md): Practical guidance for the UK GDPR FAQ, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR IDTA Addendum and Transfer Risk Assessment Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/idta-addendum-and-transfer-risk-assessment.md): UK GDPR guidance for IDTA addendum and transfer risk assessment, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR IDTA vs EU SCCs Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/idta-vs-eu-sccs.md): UK GDPR guidance for IDTA vs EU SCCs, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Lawful Bases Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/lawful-bases.md): UK GDPR guidance for Lawful Bases, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR PECR Cookies Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/pecr-cookies.md): UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions. - [UK GDPR penalties and fines Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/penalties-and-fines.md): UK GDPR guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Requirements Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/requirements.md): Practical guidance for the UK GDPR requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Transfer Workflow Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/transfer-workflow.md): UK GDPR guidance for Transfer Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR Transfers, IDTA, and UK Addendum Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/transfers-idta-and-uk-addendum.md): UK GDPR guidance for transfers, IDTA, and UK Addendum, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR vs Data Protection Act 2018 Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/uk-gdpr-vs-data-protection-act-2018.md): UK GDPR guidance for UK GDPR vs Data Protection Act 2018, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR vs EU GDPR Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/uk-gdpr-vs-eu-gdpr.md): UK GDPR guidance for UK GDPR vs EU GDPR, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR UK vs EU Differences Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/uk-vs-eu-differences.md): UK GDPR guidance for UK vs EU Differences, with practical decisions, evidence, edge cases, and external source citations. - [UK GDPR UK vs EU GDPR Differences Guide](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/uk-vs-eu-gdpr-differences.md): UK GDPR guidance for UK vs EU GDPR Differences, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Applicability Test Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/applicability-test.md): Practical guidance for the US CCPA applicability test, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Privacy Policy Template Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/ccpa-privacy-policy-template.md): US CCPA guidance for CCPA Privacy Policy Template, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA vs CPRA Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/ccpa-vs-cpra.md): US CCPA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA vs GDPR Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/ccpa-vs-gdpr.md): US CCPA guidance for CCPA vs GDPR, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Compliance Checklist](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/checklist.md): Practical guidance for the US CCPA checklist, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Compliance Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/compliance.md): Practical guidance for the US CCPA compliance, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Consumer Rights Workflow Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/consumer-rights-workflow.md): US CCPA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Contract Classification Workflow Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/contract-classification-workflow.md): US CCPA guidance for Contract Classification Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Dark Patterns Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/dark-patterns.md): US CCPA guidance for Dark Patterns, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Data Broker Crossover Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/data-broker-crossover.md): US CCPA guidance for Data Broker Crossover, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/deadlines-and-compliance-calendar.md): US CCPA guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Do not sell or share Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/do-not-sell-or-share.md): US CCPA guidance for Do not sell or share, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Do Not Sell Share Implementation Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/do-not-sell-share-implementation.md): US CCPA guidance for Do Not Sell Share Implementation, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA DSAR Verification Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/dsar-verification.md): US CCPA guidance for DSAR Verification, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA DSAR Workflow Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/dsar-workflow.md): US CCPA guidance for DSAR Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Enforcement and Penalties Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/enforcement-and-penalties.md): US CCPA guidance for Enforcement and Penalties, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Dark Patterns under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/dark-patterns.md): US CCPA guidance for Dark Patterns, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Data Broker Crossover under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/data-broker-crossover.md): US CCPA guidance for Data Broker Crossover, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Do not sell or share under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/do-not-sell-or-share.md): US CCPA guidance for Do not sell or share, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about consumer request verification under the CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/dsar-verification.md): US CCPA guidance for consumer request verification, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Financial Incentives under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/financial-incentives.md): US CCPA guidance for Financial Incentives, with practical decisions, evidence, edge cases, and external source citations. - [CCPA Global Privacy Control (GPC): team obligations and technical implementation](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/gpc.md): US CCPA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Minors under the California CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/minors.md): US CCPA guidance for Minors, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Notice at collection under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/notice-at-collection.md): US CCPA guidance for Notice at collection, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Personal and Sensitive Pi Categories under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/personal-and-sensitive-pi-categories.md): US CCPA guidance for Personal and Sensitive Pi Categories, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Privacy Policy under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/privacy-policy.md): US CCPA guidance for Privacy Policy, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Risk and Cyber Audits under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/risk-and-cyber-audits.md): US CCPA guidance for Risk and Cyber Audits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Service Provider and Contractor Contracts under the US CCPA?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/service-provider-and-contractor-contracts.md): US CCPA guidance for Service Provider and Contractor Contracts, with practical decisions, evidence, edge cases, and external source citations. - [How should teams decide whether US CCPA applies?](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/thresholds.md): US CCPA guidance for Thresholds, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Privacy Law FAQ](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq.md): Practical guidance for the US CCPA FAQ, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Financial Incentives Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/financial-incentives.md): US CCPA guidance for Financial Incentives, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA GPC Signal Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/gpc.md): US CCPA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Minors Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/minors.md): US CCPA guidance for Minors, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Notice at collection Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/notice-at-collection.md): US CCPA guidance for Notice at collection, with practical decisions, evidence, edge cases, and external source citations. - [California CCPA/CPRA Opt Out Signal Workflow Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/opt-out-signal-workflow.md): California CCPA/CPRA guidance for Opt Out Signal Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA penalties and fines Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/penalties-and-fines.md): US CCPA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Personal and Sensitive Pi Categories Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/personal-and-sensitive-pi-categories.md): US CCPA guidance for Personal and Sensitive Pi Categories, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Privacy Notices and Disclosures Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/privacy-notices-and-disclosures.md): US CCPA guidance for Privacy Notices and Disclosures, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Privacy Policy Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/privacy-policy.md): US CCPA guidance for Privacy Policy, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Requirements Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/requirements.md): Practical guidance for the US CCPA requirements, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Risk and Cyber Audits Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/risk-and-cyber-audits.md): US CCPA guidance for Risk and Cyber Audits, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Scope and Thresholds Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/scope-and-thresholds.md): US CCPA guidance for Scope and Thresholds, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Service Provider Contractor and Third Party Contracts Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/service-provider-contractor-and-third-party-contracts.md): US CCPA guidance for Service Provider Contractor and Third Party Contracts, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Service Provider Contractor Contracts Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/service-provider-contractor-contracts.md): US CCPA guidance for Service Provider Contractor Contracts, with practical decisions, evidence, edge cases, and external source citations. - [US CCPA Thresholds Guide](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/thresholds.md): US CCPA guidance for Thresholds, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Applicability Test Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/applicability-test.md): Practical guidance for the US CPRA applicability test, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA CCPA vs CPRA Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/ccpa-vs-cpra.md): US CPRA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Checklist](https://www.sorena.io/artifacts/us/california-privacy-rights-act/checklist.md): Practical guidance for the California CPRA checklist, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Compliance Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/compliance.md): Practical guidance for the US CPRA compliance, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Consumer Rights Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/consumer-rights-workflow.md): US CPRA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contract Terms Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contracts Contractors and Service Providers Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/contracts-contractors-and-service-providers.md): US CPRA guidance for Contracts Contractors and Service Providers, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Correction Rights Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cppa Regulations Tracker Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/cppa-regulations-tracker.md): US CPRA guidance for Cppa Regulations Tracker, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Template Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/cpra-risk-assessment-template.md): US CPRA guidance for CPRA Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Colorado Privacy Act Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/cpra-vs-colorado-privacy-act.md): US CPRA guidance for CPRA vs Colorado Privacy Act, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Virginia Vcdpa Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/cpra-vs-virginia-vcdpa.md): US CPRA guidance for CPRA vs Virginia Vcdpa, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cyber Audit Readiness Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/cyber-audit-readiness-workflow.md): US CPRA guidance for Cyber Audit Readiness Workflow, with practical decisions, evidence, edge cases, and external source citations. - [California Data Broker Deletion Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/data-broker-deletion-workflow.md): California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations. - [California Data Broker Registry and DROP Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/data-broker-registry-and-drop.md): California Delete Act guide to the Data Broker Registry and DROP, with practical decisions, evidence, edge cases, and official source citations. - [US CPRA Deadlines and Compliance Calendar Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/deadlines-and-compliance-calendar.md): US CPRA guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA DSAR and Correction Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/dsar-and-correction-workflow.md): US CPRA guidance for DSAR and Correction Workflow, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about ADMT under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/admt.md): US CPRA guidance for ADMT, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Contract Terms under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Correction Rights under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Cybersecurity Audits under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/cybersecurity-audits.md): US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [California Delete Act data broker registry and DROP guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/data-broker-registry-and-drop.md): California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources. - [CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/enforcement-advisories.md): US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations. - [CPRA Global Privacy Control (GPC): opt-out requirements and enforcement FAQ](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/gpc.md): US CPRA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about retention under the California CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/retention.md): California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations. - [What should teams do about Risk Assessments under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/risk-assessments.md): US CPRA guidance for Risk Assessments, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sensitive Personal Information Limits under the US CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sharing and Cross-Context Behavioral Advertising under the California CPRA?](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/sharing-and-cross-context-behavioral-advertising.md): California CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA FAQ](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq.md): Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations. - [US CPRA GPC Handling Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/gpc-handling-workflow.md): US CPRA guidance for GPC Handling Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA GPC Handling Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/gpc-handling.md): US CPRA guidance for GPC Handling, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA penalties and fines Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/penalties-and-fines.md): US CPRA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Requirements Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/requirements.md): Practical guidance for California CPRA requirements, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Retention Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/retention.md): US CPRA guidance for Retention, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Intake Workflow Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessment-intake-workflow.md): US CPRA guidance for Risk Assessment Intake Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessments and Cybersecurity Audits Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessments-and-cybersecurity-audits.md): US CPRA guidance for Risk Assessments and Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/risk-assessments-cybersecurity-audits-and-admt.md): California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Limits Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/sensitive-personal-information.md): US CPRA guidance for Sensitive Personal Information, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sharing and Cross-Context Behavioral Advertising Guide](https://www.sorena.io/artifacts/us/california-privacy-rights-act/sharing-and-cross-context-behavioral-advertising.md): US CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. - [Australia Cyber Security Act FAQ](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/items.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. (FAQ items index) - [Australia Cyber Security Act FAQ - Page 2](https://www.sorena.io/artifacts/apac/australia-cyber-security-act/faq/items/page/2.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. (FAQ items page 2 of 2) - [China Cryptography Law FAQ](https://www.sorena.io/artifacts/apac/china-cryptography-law/faq/items.md): Answers to practical China Cryptography Law questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [China Cybersecurity Law FAQ](https://www.sorena.io/artifacts/apac/china-cybersecurity-law/faq/items.md): Answers to practical China Cybersecurity Law questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [China E-Waste Law FAQ](https://www.sorena.io/artifacts/apac/china-e-waste-law/faq/items.md): Answers to practical China E-Waste Law questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [China Privacy Law FAQ](https://www.sorena.io/artifacts/apac/china-privacy-law/faq/items.md): Answers to practical China Privacy Law questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [China RoHS FAQ](https://www.sorena.io/artifacts/apac/china-rohs-regulation/faq/items.md): Answers to practical China RoHS questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [China Telecom and Wireless FAQ](https://www.sorena.io/artifacts/apac/china-telecom-wireless-regulation/faq/items.md): Answers to practical China Telecom and Wireless questions for scope, official source triggers, evidence records, and related China scope decisions. (FAQ items index) - [Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/items.md): FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks. (FAQ items index) - [Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC - Page 2](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/items/page/2.md): FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks. (FAQ items page 2 of 3) - [Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC - Page 3](https://www.sorena.io/artifacts/apac/singapore-pdpa/faq/items/page/3.md): FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks. (FAQ items page 3 of 3) - [EU Accessibility Act FAQ: scope, dates, services, Article 14](https://www.sorena.io/artifacts/eu/accessibility-act/faq/items.md): Clear answers on EU Accessibility Act scope, 28 June 2025 application, covered products and services, microenterprises, Article 14, service information, standards, and penalties. (FAQ items index) - [EU Accessibility Act FAQ: scope, dates, services, Article 14 - Page 2](https://www.sorena.io/artifacts/eu/accessibility-act/faq/items/page/2.md): Clear answers on EU Accessibility Act scope, 28 June 2025 application, covered products and services, microenterprises, Article 14, service information, standards, and penalties. (FAQ items page 2 of 3) - [EU Accessibility Act FAQ: scope, dates, services, Article 14 - Page 3](https://www.sorena.io/artifacts/eu/accessibility-act/faq/items/page/3.md): Clear answers on EU Accessibility Act scope, 28 June 2025 application, covered products and services, microenterprises, Article 14, service information, standards, and penalties. (FAQ items page 3 of 3) - [EU AI Act FAQ: scope, roles, high-risk AI, GPAI, FRIA, and dates](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/items.md): Source-backed EU AI Act FAQ covering scope, provider and deployer roles, prohibited practices, high-risk classification, GPAI duties, transparency notices, FRIAs, EU database registration, serious incidents, and staged application dates. (FAQ items index) - [EU AI Act FAQ: scope, roles, high-risk AI, GPAI, FRIA, and dates - Page 2](https://www.sorena.io/artifacts/eu/artificial-intelligence-act/faq/items/page/2.md): Source-backed EU AI Act FAQ covering scope, provider and deployer roles, prohibited practices, high-risk classification, GPAI duties, transparency notices, FRIAs, EU database registration, serious incidents, and staged application dates. (FAQ items page 2 of 2) - [EU Batteries Regulation FAQ](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/items.md): Answers to practical EU Batteries Regulation questions on battery categories, CE conformity, QR labels, battery passports, due diligence, removability, and waste collection duties. (FAQ items index) - [EU Batteries Regulation FAQ - Page 2](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/items/page/2.md): Answers to practical EU Batteries Regulation questions on battery categories, CE conformity, QR labels, battery passports, due diligence, removability, and waste collection duties. (FAQ items page 2 of 3) - [EU Batteries Regulation FAQ - Page 3](https://www.sorena.io/artifacts/eu/batteries-regulation/faq/items/page/3.md): Answers to practical EU Batteries Regulation questions on battery categories, CE conformity, QR labels, battery passports, due diligence, removability, and waste collection duties. (FAQ items page 3 of 3) - [CSDDD FAQ: scope, dates, duties, liability, and evidence](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/items.md): Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence. (FAQ items index) - [CSDDD FAQ: scope, dates, duties, liability, and evidence - Page 2](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/items/page/2.md): Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence. (FAQ items page 2 of 4) - [CSDDD FAQ: scope, dates, duties, liability, and evidence - Page 3](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/items/page/3.md): Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence. (FAQ items page 3 of 4) - [CSDDD FAQ: scope, dates, duties, liability, and evidence - Page 4](https://www.sorena.io/artifacts/eu/corporate-sustainability-due-diligence-directive/faq/items/page/4.md): Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence. (FAQ items page 4 of 4) - [CSRD and ESRS FAQ: scope, materiality, assurance, tagging, and value chain](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/items.md): CSRD and ESRS FAQ hub covering company scope, reporting waves, ESRS structure, double materiality, assurance, digital tagging, Taxonomy Article 8, and value chain data. (FAQ items index) - [CSRD and ESRS FAQ: scope, materiality, assurance, tagging, and value chain - Page 2](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/items/page/2.md): CSRD and ESRS FAQ hub covering company scope, reporting waves, ESRS structure, double materiality, assurance, digital tagging, Taxonomy Article 8, and value chain data. (FAQ items page 2 of 3) - [CSRD and ESRS FAQ: scope, materiality, assurance, tagging, and value chain - Page 3](https://www.sorena.io/artifacts/eu/corporate-sustainability-reporting-directive/faq/items/page/3.md): CSRD and ESRS FAQ hub covering company scope, reporting waves, ESRS structure, double materiality, assurance, digital tagging, Taxonomy Article 8, and value chain data. (FAQ items page 3 of 3) - [EU Cyber Resilience Act FAQ](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items index) - [EU Cyber Resilience Act FAQ - Page 2](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/2.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 2 of 42) - [EU Cyber Resilience Act FAQ - Page 3](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/3.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 3 of 42) - [EU Cyber Resilience Act FAQ - Page 4](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/4.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 4 of 42) - [EU Cyber Resilience Act FAQ - Page 5](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/5.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 5 of 42) - [EU Cyber Resilience Act FAQ - Page 6](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/6.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 6 of 42) - [EU Cyber Resilience Act FAQ - Page 7](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/7.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 7 of 42) - [EU Cyber Resilience Act FAQ - Page 8](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/8.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 8 of 42) - [EU Cyber Resilience Act FAQ - Page 9](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/9.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 9 of 42) - [EU Cyber Resilience Act FAQ - Page 10](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/10.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 10 of 42) - [EU Cyber Resilience Act FAQ - Page 11](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/11.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 11 of 42) - [EU Cyber Resilience Act FAQ - Page 12](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/12.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 12 of 42) - [EU Cyber Resilience Act FAQ - Page 13](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/13.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 13 of 42) - [EU Cyber Resilience Act FAQ - Page 14](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/14.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 14 of 42) - [EU Cyber Resilience Act FAQ - Page 15](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/15.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 15 of 42) - [EU Cyber Resilience Act FAQ - Page 16](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/16.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 16 of 42) - [EU Cyber Resilience Act FAQ - Page 17](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/17.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 17 of 42) - [EU Cyber Resilience Act FAQ - Page 18](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/18.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 18 of 42) - [EU Cyber Resilience Act FAQ - Page 19](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/19.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 19 of 42) - [EU Cyber Resilience Act FAQ - Page 20](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/20.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 20 of 42) - [EU Cyber Resilience Act FAQ - Page 21](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/21.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 21 of 42) - [EU Cyber Resilience Act FAQ - Page 22](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/22.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 22 of 42) - [EU Cyber Resilience Act FAQ - Page 23](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/23.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 23 of 42) - [EU Cyber Resilience Act FAQ - Page 24](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/24.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 24 of 42) - [EU Cyber Resilience Act FAQ - Page 25](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/25.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 25 of 42) - [EU Cyber Resilience Act FAQ - Page 26](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/26.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 26 of 42) - [EU Cyber Resilience Act FAQ - Page 27](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/27.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 27 of 42) - [EU Cyber Resilience Act FAQ - Page 28](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/28.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 28 of 42) - [EU Cyber Resilience Act FAQ - Page 29](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/29.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 29 of 42) - [EU Cyber Resilience Act FAQ - Page 30](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/30.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 30 of 42) - [EU Cyber Resilience Act FAQ - Page 31](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/31.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 31 of 42) - [EU Cyber Resilience Act FAQ - Page 32](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/32.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 32 of 42) - [EU Cyber Resilience Act FAQ - Page 33](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/33.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 33 of 42) - [EU Cyber Resilience Act FAQ - Page 34](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/34.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 34 of 42) - [EU Cyber Resilience Act FAQ - Page 35](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/35.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 35 of 42) - [EU Cyber Resilience Act FAQ - Page 36](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/36.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 36 of 42) - [EU Cyber Resilience Act FAQ - Page 37](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/37.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 37 of 42) - [EU Cyber Resilience Act FAQ - Page 38](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/38.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 38 of 42) - [EU Cyber Resilience Act FAQ - Page 39](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/39.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 39 of 42) - [EU Cyber Resilience Act FAQ - Page 40](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/40.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 40 of 42) - [EU Cyber Resilience Act FAQ - Page 41](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/41.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 41 of 42) - [EU Cyber Resilience Act FAQ - Page 42](https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/42.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. (FAQ items page 42 of 42) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates](https://www.sorena.io/artifacts/eu/data-act/faq/items.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items index) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 2](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/2.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 2 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 3](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/3.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 3 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 4](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/4.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 4 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 5](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/5.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 5 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 6](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/6.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 6 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 7](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/7.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 7 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 8](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/8.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 8 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 9](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/9.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 9 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 10](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/10.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 10 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 11](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/11.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 11 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 12](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/12.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 12 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 13](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/13.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 13 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 14](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/14.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 14 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 15](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/15.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 15 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 16](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/16.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 16 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 17](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/17.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 17 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 18](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/18.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 18 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 19](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/19.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 19 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 20](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/20.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 20 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 21](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/21.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 21 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 22](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/22.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 22 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 23](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/23.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 23 of 24) - [EU Data Act FAQ: scope, access rights, B2G, cloud switching, GDPR, and dates - Page 24](https://www.sorena.io/artifacts/eu/data-act/faq/items/page/24.md): Official source EU Data Act FAQ index covering connected-product data access, third-party sharing, B2G exceptional need, cloud switching, smart contracts, GDPR boundaries, unfair terms, trade secrets, and application dates. (FAQ items page 24 of 24) - [EU Deforestation Regulation FAQ](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/items.md): Concise EU Deforestation Regulation answers on scope, covered commodities, operator and trader roles, due diligence statements, geolocation, low-risk countries, customs release, SME timing, enforcement, and records. (FAQ items index) - [EU Deforestation Regulation FAQ - Page 2](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/items/page/2.md): Concise EU Deforestation Regulation answers on scope, covered commodities, operator and trader roles, due diligence statements, geolocation, low-risk countries, customs release, SME timing, enforcement, and records. (FAQ items page 2 of 3) - [EU Deforestation Regulation FAQ - Page 3](https://www.sorena.io/artifacts/eu/deforestation-regulation/faq/items/page/3.md): Concise EU Deforestation Regulation answers on scope, covered commodities, operator and trader roles, due diligence statements, geolocation, low-risk countries, customs release, SME timing, enforcement, and records. (FAQ items page 3 of 3) - [EU Digital Markets Act FAQ: gatekeepers, DMA obligations, reports, and enforcement](https://www.sorena.io/artifacts/eu/digital-markets-act/faq/items.md): Concise FAQ on the EU Digital Markets Act for gatekeeper designation, core platform services, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, business-user data access, compliance evidence, and enforcement. (FAQ items index) - [EU Digital Product Passport FAQ](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/items.md): Direct answers on EU Digital Product Passport scope, creators, product groups, registry, customs checks, access rights, identifiers, data carriers, and governance. (FAQ items index) - [EU Digital Product Passport FAQ - Page 2](https://www.sorena.io/artifacts/eu/digital-product-passport/faq/items/page/2.md): Direct answers on EU Digital Product Passport scope, creators, product groups, registry, customs checks, access rights, identifiers, data carriers, and governance. (FAQ items page 2 of 2) - [EU Digital Services Act FAQ: DSA scope, platform duties, VLOPs, reports, and penalties](https://www.sorena.io/artifacts/eu/digital-services-act/faq/items.md): Concise EU Digital Services Act FAQ covering intermediary-service scope, active-recipient thresholds, illegal-content notices, statements of reasons, trader traceability, recommender transparency, systemic-risk duties, reporting, penalties, and complaints. (FAQ items index) - [EU Digital Services Act FAQ: DSA scope, platform duties, VLOPs, reports, and penalties - Page 2](https://www.sorena.io/artifacts/eu/digital-services-act/faq/items/page/2.md): Concise EU Digital Services Act FAQ covering intermediary-service scope, active-recipient thresholds, illegal-content notices, statements of reasons, trader traceability, recommender transparency, systemic-risk duties, reporting, penalties, and complaints. (FAQ items page 2 of 2) - [EU DORA FAQ: scope, incidents, ICT contracts, testing, and evidence](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/items.md): Concise DORA FAQ covering who is in scope, proportionality, ICT third-party contracts, register-of-information records, major ICT incident thresholds and reporting, TLPT, testing, enforcement, and evidence. (FAQ items index) - [EU DORA FAQ: scope, incidents, ICT contracts, testing, and evidence - Page 2](https://www.sorena.io/artifacts/eu/digital-operational-resilience-act/faq/items/page/2.md): Concise DORA FAQ covering who is in scope, proportionality, ICT third-party contracts, register-of-information records, major ICT incident thresholds and reporting, TLPT, testing, enforcement, and evidence. (FAQ items page 2 of 2) - [EU eIDAS FAQ: signatures, QTSPs, trusted lists, QWACs, wallets, and validation](https://www.sorena.io/artifacts/eu/electronic-identification-and-trust-services-regulation/faq/items.md): FAQ on eIDAS trust services and the European Digital Identity framework, covering advanced and qualified electronic signatures, QTSP status, trusted lists, QWACs, EUDI Wallet relying parties, attestations of attributes, and validation evidence. (FAQ items index) - [EU EMC Directive FAQ: apparatus, fixed installations, importers](https://www.sorena.io/artifacts/eu/emc-directive/faq/items.md): Answers to common EU EMC Directive questions on apparatus, fixed installations, cables, passive components, importers, failed tests, radio modules, modifications, standards, and documentation. (FAQ items index) - [EU EMC Directive FAQ: apparatus, fixed installations, importers - Page 2](https://www.sorena.io/artifacts/eu/emc-directive/faq/items/page/2.md): Answers to common EU EMC Directive questions on apparatus, fixed installations, cables, passive components, importers, failed tests, radio modules, modifications, standards, and documentation. (FAQ items page 2 of 2) - [EU Energy Efficiency Directive FAQ](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/items.md): Answers to common EU Energy Efficiency Directive questions on Article 11 thresholds, energy audits, energy management systems, data centres, public bodies, penalties, audit reports, and reporting overlap. (FAQ items index) - [EU Energy Efficiency Directive FAQ - Page 2](https://www.sorena.io/artifacts/eu/energy-efficiency-directive/faq/items/page/2.md): Answers to common EU Energy Efficiency Directive questions on Article 11 thresholds, energy audits, energy management systems, data centres, public bodies, penalties, audit reports, and reporting overlap. (FAQ items page 2 of 2) - [EU ePrivacy Directive FAQ: cookies, consent, marketing, GDPR interplay](https://www.sorena.io/artifacts/eu/eprivacy-directive/faq/items.md): Answers to recurring EU ePrivacy Directive questions on Article 5(3), terminal-equipment access, cookie consent, exemptions, analytics, direct marketing, GDPR interplay, national enforcement, and evidence. (FAQ items index) - [ESPR FAQ: scope, delegated acts, DPP, unsold goods](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/items.md): Standalone ESPR FAQ answers on product scope, delegated acts, Digital Product Passports, unsold goods, product priorities, standards, surveillance, and source limits. (FAQ items index) - [ESPR FAQ: scope, delegated acts, DPP, unsold goods - Page 2](https://www.sorena.io/artifacts/eu/ecodesign-for-sustainable-products-regulation/faq/items/page/2.md): Standalone ESPR FAQ answers on product scope, delegated acts, Digital Product Passports, unsold goods, product priorities, standards, surveillance, and source limits. (FAQ items page 2 of 2) - [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/items.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers. (FAQ items index) - [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers - Page 2](https://www.sorena.io/artifacts/eu/general-data-protection-regulation/faq/items/page/2.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers. (FAQ items page 2 of 2) - [EU GPSR FAQ: scope, listings, recalls, reporting](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/items.md): FAQ on GPSR consumer-product scope, economic operator duties, EU responsible person, online marketplace listings, Safety Business Gateway reporting, recalls, and evidence. (FAQ items index) - [EU GPSR FAQ: scope, listings, recalls, reporting - Page 2](https://www.sorena.io/artifacts/eu/general-product-safety-regulation/faq/items/page/2.md): FAQ on GPSR consumer-product scope, economic operator duties, EU responsible person, online marketplace listings, Safety Business Gateway reporting, recalls, and evidence. (FAQ items page 2 of 2) - [EU Green Claims Directive FAQ: scope, evidence, labels, offsets, and status](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/items.md): Direct answers on the EU Green Claims Directive proposal, explicit environmental claims, substantiation, labels, offsets, PEF/OEF evidence, UCPD overlap, and penalties. (FAQ items index) - [EU Green Claims Directive FAQ: scope, evidence, labels, offsets, and status - Page 2](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/items/page/2.md): Direct answers on the EU Green Claims Directive proposal, explicit environmental claims, substantiation, labels, offsets, PEF/OEF evidence, UCPD overlap, and penalties. (FAQ items page 2 of 3) - [EU Green Claims Directive FAQ: scope, evidence, labels, offsets, and status - Page 3](https://www.sorena.io/artifacts/eu/green-claims-directive/faq/items/page/3.md): Direct answers on the EU Green Claims Directive proposal, explicit environmental claims, substantiation, labels, offsets, PEF/OEF evidence, UCPD overlap, and penalties. (FAQ items page 3 of 3) - [EU Low Voltage Directive FAQ: scope, duties, CE marking](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/items.md): Answers to practical LVD questions on voltage limits, Annex II exclusions, batteries, chargers, components, economic operators, instructions, standards, CE marking, and post-market controls. (FAQ items index) - [EU Low Voltage Directive FAQ: scope, duties, CE marking - Page 2](https://www.sorena.io/artifacts/eu/low-voltage-directive/faq/items/page/2.md): Answers to practical LVD questions on voltage limits, Annex II exclusions, batteries, chargers, components, economic operators, instructions, standards, CE marking, and post-market controls. (FAQ items page 2 of 2) - [EU Machinery Regulation FAQ](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/items.md): Answers to Machinery Regulation questions on scope, partly completed machinery, Annex I categories, Article 25 conformity assessment, digital instructions, software, cybersecurity, transition, CE files, and overlap with other EU product laws. (FAQ items index) - [EU Machinery Regulation FAQ - Page 2](https://www.sorena.io/artifacts/eu/machinery-regulation/faq/items/page/2.md): Answers to Machinery Regulation questions on scope, partly completed machinery, Annex I categories, Article 25 conformity assessment, digital instructions, software, cybersecurity, transition, CE files, and overlap with other EU product laws. (FAQ items page 2 of 2) - [EU Market Surveillance Regulation FAQ](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/items.md): Concise FAQ on Regulation (EU) 2019/1020: Article 4 economic operators, distance sales, authority requests, customs controls, corrective action, serious risk, ICSMS, Safety Gate, and EUPCN. (FAQ items index) - [EU Market Surveillance Regulation FAQ - Page 2](https://www.sorena.io/artifacts/eu/market-surveillance-regulation/faq/items/page/2.md): Concise FAQ on Regulation (EU) 2019/1020: Article 4 economic operators, distance sales, authority requests, customs controls, corrective action, serious risk, ICSMS, Safety Gate, and EUPCN. (FAQ items page 2 of 2) - [EU MDR FAQ: qualification, evidence, UDI, and transition](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/items.md): Concise EU MDR FAQ covering device qualification, software classification, accessories, custom-made devices, clinical evidence, UDI, EUDAMED, notified bodies, significant changes, and legacy transition. (FAQ items index) - [EU MDR FAQ: qualification, evidence, UDI, and transition - Page 2](https://www.sorena.io/artifacts/eu/medical-device-regulation/faq/items/page/2.md): Concise EU MDR FAQ covering device qualification, software classification, accessories, custom-made devices, clinical evidence, UDI, EUDAMED, notified bodies, significant changes, and legacy transition. (FAQ items page 2 of 2) - [NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties](https://www.sorena.io/artifacts/eu/nis2-directive/faq/items.md): cited NIS2 FAQ for teams deciding whether they are in scope, whether they are essential or important entities, which Article 21 cybersecurity measures apply, how Article 23 incident reporting works, and what penalties and evidence records to plan for. (FAQ items index) - [PPWR FAQ: Scope, Recyclability, Reuse, Labelling, and EPR](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/items.md): FAQ index for Regulation (EU) 2025/40 on packaging and packaging waste, covering PPWR scope, recyclability, recycled content, minimisation, reuse, labelling, EPR, and evidence. (FAQ items index) - [PPWR FAQ: Scope, Recyclability, Reuse, Labelling, and EPR - Page 2](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/items/page/2.md): FAQ index for Regulation (EU) 2025/40 on packaging and packaging waste, covering PPWR scope, recyclability, recycled content, minimisation, reuse, labelling, EPR, and evidence. (FAQ items page 2 of 3) - [PPWR FAQ: Scope, Recyclability, Reuse, Labelling, and EPR - Page 3](https://www.sorena.io/artifacts/eu/packaging-waste-regulation/faq/items/page/3.md): FAQ index for Regulation (EU) 2025/40 on packaging and packaging waste, covering PPWR scope, recyclability, recycled content, minimisation, reuse, labelling, EPR, and evidence. (FAQ items page 3 of 3) - [EU RED FAQ: Scope, CE and USB-C](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/items.md): Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence. (FAQ items index) - [EU RED FAQ: Scope, CE and USB-C - Page 2](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/items/page/2.md): Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence. (FAQ items page 2 of 3) - [EU RED FAQ: Scope, CE and USB-C - Page 3](https://www.sorena.io/artifacts/eu/radio-equipment-directive/faq/items/page/3.md): Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence. (FAQ items page 3 of 3) - [EU RoHS Directive FAQ: scope, substances, CE marking](https://www.sorena.io/artifacts/eu/rohs-directive/faq/items.md): Practical EU RoHS Directive FAQ covering EEE scope, Annex II substance limits, cables, spare parts, technical documentation, CE marking, and exemptions. (FAQ items index) - [EU RoHS Directive FAQ: scope, substances, CE marking - Page 2](https://www.sorena.io/artifacts/eu/rohs-directive/faq/items/page/2.md): Practical EU RoHS Directive FAQ covering EEE scope, Annex II substance limits, cables, spare parts, technical documentation, CE marking, and exemptions. (FAQ items page 2 of 3) - [EU RoHS Directive FAQ: scope, substances, CE marking - Page 3](https://www.sorena.io/artifacts/eu/rohs-directive/faq/items/page/3.md): Practical EU RoHS Directive FAQ covering EEE scope, Annex II substance limits, cables, spare parts, technical documentation, CE marking, and exemptions. (FAQ items page 3 of 3) - [EU Taxonomy FAQ: eligibility, alignment, DNSH, safeguards, and Article 8](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/items.md): EU Taxonomy FAQ hub for eligibility, alignment, technical screening criteria, DNSH, minimum safeguards, Article 8 KPIs, delegated acts, and evidence records. (FAQ items index) - [EU Taxonomy FAQ: eligibility, alignment, DNSH, safeguards, and Article 8 - Page 2](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/items/page/2.md): EU Taxonomy FAQ hub for eligibility, alignment, technical screening criteria, DNSH, minimum safeguards, Article 8 KPIs, delegated acts, and evidence records. (FAQ items page 2 of 3) - [EU Taxonomy FAQ: eligibility, alignment, DNSH, safeguards, and Article 8 - Page 3](https://www.sorena.io/artifacts/eu/taxonomy-regulation/faq/items/page/3.md): EU Taxonomy FAQ hub for eligibility, alignment, technical screening criteria, DNSH, minimum safeguards, Article 8 KPIs, delegated acts, and evidence records. (FAQ items page 3 of 3) - [ETSI EN 303 645 FAQ: Consumer IoT Security Questions](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/items.md): cited answers to common ETSI EN 303 645 questions on consumer IoT scope, associated services, default passwords, updates, vulnerability disclosure, telemetry, deletion, and TS 103 701 evidence. (FAQ items index) - [ETSI EN 303 645 FAQ: Consumer IoT Security Questions - Page 2](https://www.sorena.io/artifacts/global/etsi-en-303-645/faq/items/page/2.md): cited answers to common ETSI EN 303 645 questions on consumer IoT scope, associated services, default passwords, updates, vulnerability disclosure, telemetry, deletion, and TS 103 701 evidence. (FAQ items page 2 of 2) - [ETSI EN 319 401 FAQ for trust service providers](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/items.md): cited ETSI EN 319 401 FAQ for TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence. (FAQ items index) - [ETSI EN 319 401 FAQ for trust service providers - Page 2](https://www.sorena.io/artifacts/global/etsi-en-319-401/faq/items/page/2.md): cited ETSI EN 319 401 FAQ for TSP scope, trust service practice statements, risk assessment, incidents, records, continuity, and supplier evidence. (FAQ items page 2 of 2) - [ETSI EN 319 411-1 FAQ for Certificate Services](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/items.md): Answers to common ETSI EN 319 411-1 questions on certificate policies, CPS content, CA and RA boundaries, subscriber evidence, revocation, status services, and record retention. (FAQ items index) - [ETSI EN 319 411-1 FAQ for Certificate Services - Page 2](https://www.sorena.io/artifacts/global/etsi-en-319-411-1/faq/items/page/2.md): Answers to common ETSI EN 319 411-1 questions on certificate policies, CPS content, CA and RA boundaries, subscriber evidence, revocation, status services, and record retention. (FAQ items page 2 of 2) - [ETSI EN 319 411-2 FAQ for EU Qualified Certificates](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/items.md): Answers to common ETSI EN 319 411-2 questions about EU qualified certificate policies, QSCD use, identity validation, trusted lists, and revocation status services. (FAQ items index) - [ETSI EN 319 411-2 FAQ for EU Qualified Certificates - Page 2](https://www.sorena.io/artifacts/global/etsi-en-319-411-2/faq/items/page/2.md): Answers to common ETSI EN 319 411-2 questions about EU qualified certificate policies, QSCD use, identity validation, trusted lists, and revocation status services. (FAQ items page 2 of 2) - [FIPS 140-3 FAQ for Cryptographic Modules](https://www.sorena.io/artifacts/global/fips-140-3/faq/items.md): Answers to common FIPS 140-3 questions about scope, CMVP validation, algorithm certificates, module boundaries, approved mode, and validation evidence. (FAQ items index) - [FIPS 140-3 FAQ for Cryptographic Modules - Page 2](https://www.sorena.io/artifacts/global/fips-140-3/faq/items/page/2.md): Answers to common FIPS 140-3 questions about scope, CMVP validation, algorithm certificates, module boundaries, approved mode, and validation evidence. (FAQ items page 2 of 2) - [FIPS-approved cryptographic algorithms FAQ](https://www.sorena.io/artifacts/global/fips-crypto-algorithms/faq/items.md): Answers to common FIPS algorithm questions: approved security functions, CAVP validation, CMVP module scope, AES modes, SHA-2, SHA-3, signatures, and post-quantum algorithms. (FAQ items index) - [ISO 22301 FAQ: BCMS, BIA, MTPD, RTO and Audit Evidence](https://www.sorena.io/artifacts/global/iso-22301/faq/items.md): Practical ISO 22301 FAQ for business continuity teams: BCMS scope, BIA, MTPD, RTO, RPO, strategies, exercises, audits, management review, and certification evidence. (FAQ items index) - [ISO 22301 FAQ: BCMS, BIA, MTPD, RTO and Audit Evidence - Page 2](https://www.sorena.io/artifacts/global/iso-22301/faq/items/page/2.md): Practical ISO 22301 FAQ for business continuity teams: BCMS scope, BIA, MTPD, RTO, RPO, strategies, exercises, audits, management review, and certification evidence. (FAQ items page 2 of 2) - [ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA](https://www.sorena.io/artifacts/global/iso-27001/faq/items.md): Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness. (FAQ items index) - [ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA - Page 2](https://www.sorena.io/artifacts/global/iso-27001/faq/items/page/2.md): Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness. (FAQ items page 2 of 2) - [ISO/IEC 27005 Risk Management FAQ](https://www.sorena.io/artifacts/global/iso-27005/faq/items.md): ISO/IEC 27005 FAQ for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 27005 Risk Management FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-27005/faq/items/page/2.md): ISO/IEC 27005 FAQ for ISO/IEC 27005 Information Security Risk Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [ISO/IEC 27017 Cloud Security FAQ](https://www.sorena.io/artifacts/global/iso-27017/faq/items.md): ISO/IEC 27017 FAQ for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 27017 Cloud Security FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-27017/faq/items/page/2.md): ISO/IEC 27017 FAQ for ISO/IEC 27017 Cloud Security Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [ISO/IEC 27018 Cloud Privacy FAQ](https://www.sorena.io/artifacts/global/iso-27018/faq/items.md): ISO/IEC 27018 FAQ for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 27018 Cloud Privacy FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-27018/faq/items/page/2.md): ISO/IEC 27018 FAQ for ISO/IEC 27018 Public Cloud PII Processor Privacy Controls: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [ISO/IEC 27035 Incident Management FAQ](https://www.sorena.io/artifacts/global/iso-27035/faq/items.md): ISO/IEC 27035 FAQ for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 27035 Incident Management FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-27035/faq/items/page/2.md): ISO/IEC 27035 FAQ for ISO/IEC 27035 Information Security Incident Management: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [ISO/IEC 27036 Supplier Security FAQ](https://www.sorena.io/artifacts/global/iso-27036/faq/items.md): ISO/IEC 27036 FAQ for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 27036 Supplier Security FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-27036/faq/items/page/2.md): ISO/IEC 27036 FAQ for ISO/IEC 27036 Supplier Relationship Security: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [ISO/IEC 42001 AI Management FAQ](https://www.sorena.io/artifacts/global/iso-42001/faq/items.md): ISO/IEC 42001 FAQ for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items index) - [ISO/IEC 42001 AI Management FAQ - Page 2](https://www.sorena.io/artifacts/global/iso-42001/faq/items/page/2.md): ISO/IEC 42001 FAQ for ISO/IEC 42001 Artificial Intelligence Management System: practical decisions, evidence, owners, review cadence, and cited implementation guidance. (FAQ items page 2 of 2) - [NIST CSF 2.0 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-csf-2-0/faq/items.md): Standalone NIST CSF 2.0 FAQ questions with cited answers, implementation checklists, and evidence guidance. (FAQ items index) - [NIST SP 800-161 Rev. 1 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/items.md): Standalone NIST SP 800-161 Rev. 1 FAQ questions with cited answers, implementation checklists, and evidence guidance. (FAQ items index) - [NIST SP 800-218 SSDF FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-218-ssdf/faq/items.md): Standalone NIST SP 800-218 SSDF FAQ questions with cited answers, implementation checklists, and evidence guidance. (FAQ items index) - [NIST SP 800-53 Rev. 5 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-53-rev-5/faq/items.md): Standalone NIST SP 800-53 Rev. 5 FAQ questions with cited answers, implementation checklists, and evidence guidance. (FAQ items index) - [NIST SP 800-61 Rev. 3 FAQ: practical implementation questions](https://www.sorena.io/artifacts/global/nist-sp-800-61-rev-3/faq/items.md): Standalone NIST SP 800-61 Rev. 3 FAQ questions with cited answers, implementation checklists, and evidence guidance. (FAQ items index) - [Brazil LGPD Privacy Law FAQ](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/items.md): Practical guidance for the Brazil LGPD FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items index) - [Brazil LGPD Privacy Law FAQ - Page 2](https://www.sorena.io/artifacts/latam/brazil-lgpd/faq/items/page/2.md): Practical guidance for the Brazil LGPD FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items page 2 of 2) - [UK Online Safety Act FAQ](https://www.sorena.io/artifacts/uk/online-safety-act/faq/items.md): Practical guidance for the UK Online Safety Act FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items index) - [UK Online Safety Act FAQ - Page 2](https://www.sorena.io/artifacts/uk/online-safety-act/faq/items/page/2.md): Practical guidance for the UK Online Safety Act FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items page 2 of 2) - [UK PSTI Product Security FAQ](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/items.md): Practical guidance for the UK PSTI Product Security FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items index) - [UK PSTI Product Security FAQ - Page 2](https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/items/page/2.md): Practical guidance for the UK PSTI Product Security FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items page 2 of 2) - [UK GDPR Compliance FAQ](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/items.md): Practical guidance for the UK GDPR FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items index) - [UK GDPR Compliance FAQ - Page 2](https://www.sorena.io/artifacts/uk/general-data-protection-regulation/faq/items/page/2.md): Practical guidance for the UK GDPR FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items page 2 of 2) - [US CCPA Privacy Law FAQ](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/items.md): Practical guidance for the US CCPA FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items index) - [US CCPA Privacy Law FAQ - Page 2](https://www.sorena.io/artifacts/us/california-consumer-privacy-act/faq/items/page/2.md): Practical guidance for the US CCPA FAQ, with practical decisions, evidence, edge cases, and external source citations. (FAQ items page 2 of 2) - [California CPRA FAQ](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/items.md): Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations. (FAQ items index) - [California CPRA FAQ - Page 2](https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/items/page/2.md): Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations. (FAQ items page 2 of 2) ## Resources GRC resources from the team building Sorena AI: benchmarks, execution playbooks, ESG, and AI security guidance for governance, risk, and compliance teams. - [Sorena AI Resources](https://www.sorena.io/resources.md): Sorena Resources: benchmarks, execution playbooks, ESG, and AI security for GRC teams. - [A Two-Word Amendment Can Break Your Compliance](https://www.sorena.io/resources/a-two-word-amendment.md): Knowing a regulation changed is not enough on its own. The risk lives in the exact delta, a redefined term or a shifted threshold, that a human skimming a diff can read right past. Detection has to be clause-level or it is not useful. - [Accept, Mitigate, or Transfer. But Decide on Purpose.](https://www.sorena.io/resources/accept-mitigate-or-transfer.md): Every risk in your register needs a response: accept it, avoid it, mitigate it, share or transfer it, or change the work that creates it. The worst outcome is the one nobody chose: the risk that stayed open until the organization carried it by neglect. - [Coverage Is the Number That Matters](https://www.sorena.io/resources/coverage-is-the-number-that-matters.md): Fluency scores well and audits poorly. The metric that decides a compliance outcome is not how good the answer sounds. It is coverage: did the system catch everything you owe. - [Hear It From an Alert, Not a Fine](https://www.sorena.io/resources/an-alert-not-a-fine.md): The best way to learn that a rule affects you is an alert you set up. The worst is an enforcement letter you did not see coming. The first arrives in time to act. The second sets its own price. - [Make Your AIs Argue Before You Believe Them](https://www.sorena.io/resources/make-your-ais-agree.md): One model answering alone is a confident guess dressed as a fact. Make several specialized agents answer independently and reconcile, and their agreement becomes a correctness signal. Their disagreement becomes a louder one. When agents disagree, that is a reason to stop, not ship. - [How to Benchmark AI for Compliance](https://www.sorena.io/resources/how-to-benchmark-ai-for-compliance.md): A high generic benchmark score is not proof that an AI can do compliance work. Multiple-choice tests like MMLU measure answer selection, not completeness on real obligations. Here is how to design one that predicts performance. - [One Average Score Hides a Dozen Failures](https://www.sorena.io/resources/one-average-score-hides-failures.md): A headline benchmark number is an average, and an average is a blender. It purees a model that aced GDPR and flunked the EU AI Act into one comfortable figure. For GRC, that figure is a liability. - [Weeks of Legal Review, or a First Pass in Hours](https://www.sorena.io/resources/legal-review-in-hours-not-weeks.md): Contract review is where deals go to wait. The commercial terms are settled, the customer wants to sign, and the document sits in a legal queue for weeks. The fix is not a faster reader. It is AI doing the first pass so legal spends its time on judgment, not on reading boilerplate. - [You Can't Answer What You Can't Find.](https://www.sorena.io/resources/you-cannot-answer-what-you-cannot-find.md): Centralizing your data is only half the job. If the system cannot pull the exact passage the moment someone asks, the knowledge might as well not exist. Indexing and retrieval are the line between a data graveyard and an answer. - [Your AI Is Only as Good as What It Reads](https://www.sorena.io/resources/only-as-good-as-what-it-reads.md): Grounding tells you the model can read your sources. This is the harder question: which sources did you let it read? The source set shapes the ceiling on every response. Curate the trusted set or inherit its junk. - [Your ESG Data Lives in Six Teams](https://www.sorena.io/resources/esg-data-across-six-teams.md): The report is the easy part. The hard part is that a CSRD filing can pull from finance, operations, procurement, HR, product, and suppliers, with hundreds of datapoint decisions that were never designed to line up. - [What a New Rule Actually Hits: Map It or Miss It](https://www.sorena.io/resources/what-a-new-rule-actually-hits.md): Everyone celebrates catching the regulatory alert. But an alert is not an answer. The work starts when you map the new rule to the controls, policies, and obligations it touches. - [A Risk With No Owner Is a Risk Nobody Is Treating](https://www.sorena.io/resources/a-risk-with-no-owner.md): Every risk in your register needs an owner. If nobody is assigned, the default outcome is drift: no treatment decision, no escalation path, and no evidence that anyone accepted the exposure on purpose. - [AI Drafts It. A Human Approves It. Nobody Chases It.](https://www.sorena.io/resources/ai-drafts-a-human-approves.md): Governed automation is not autopilot and it is not busywork. The system does the collection, mapping, and drafting. A human owns the judgment and the sign-off. The approval trail is built in, not bolted on. - [Audit Season Should Be Boring.](https://www.sorena.io/resources/make-audit-season-boring.md): The last-minute audit scramble is not the nature of audits. It is the cost of collecting evidence only when the auditor shows up. Gather it continuously and the audit becomes a boring review. - [Shadow AI at Work: Why Banning It Fails](https://www.sorena.io/resources/blocking-ai-does-not-stop-the-leak.md): Companies fear private files ending up in personal AI accounts, so they block AI. Employees route around the block, and now the leak is invisible. The fix is a safe AI everyone actually wants to use. - [Bring Your Own Model. Keep Your Own Control.](https://www.sorena.io/resources/bring-your-own-model-keep-control.md): The model market changes fast. Your governance cannot move that casually. The answer is not to pick one provider forever, it is to make the model swappable and the control permanent. - [If Compliance Lives in 12 Tools, It Lives Nowhere.](https://www.sorena.io/resources/twelve-copies-of-the-truth.md): When the same policy sits in a wiki, a drive, a spreadsheet, and four SaaS tools, you do not have twelve records. You have twelve chances to be wrong. Fragmentation is the failure, and it has a fix. - [No Source, No Answer: Why AI Must Cite Its Work](https://www.sorena.io/resources/no-source-no-answer.md): An AI answer with no source attached is a claim you cannot check. In GRC, a claim you cannot check is unusable, no matter how confident it sounds. The citation is not a nice-to-have. It is the product. - [Nobody Complies With a PDF. Turn It Into Tasks.](https://www.sorena.io/resources/framework-into-a-to-do-list.md): A framework is not a document. It is a list of obligations wearing a document costume. Until you extract each one into a task with an owner and a due date, the PDF sits on a drive and nothing changes. - [The Renewal Nobody Read Just Cost You a Year](https://www.sorena.io/resources/the-renewal-you-forgot.md): The auto-renewal fired while you were busy. The termination window closed. Now you are carrying another term you meant to review. This is not bad luck. It is what happens when nobody is tracking the dates. - [Not Every Risk Deserves a Meeting](https://www.sorena.io/resources/not-every-risk-deserves-a-meeting.md): When every risk gets the same alert, the same review, and the same seat at the table, the one that actually matters gets buried. Score impact and likelihood, decide against appetite, and stop spending your best people on noise. - [Why One AI Is Not Enough for a Defensible Answer](https://www.sorena.io/resources/why-one-ai-is-not-enough.md): A single model gives you one fluent answer with no second opinion. Ask several specialized agents to challenge the same claim, and idiosyncratic errors get caught before they reach you. That is the difference between a guess and an answer worth reviewing. - [Scope ESG Before You Scramble to Report](https://www.sorena.io/resources/what-esg-rules-actually-apply.md): Teams burn cycles disclosing against frameworks that never touched them, and skip the ones that did. Half the work is knowing what applies by size, sector, and geography. Scope before you scramble. - [Stop Re-Reading Long Regulations: Let AI Find the Passage](https://www.sorena.io/resources/stop-reading-400-pages.md): Most regulatory research is a search problem dressed up as a reading problem. The answer often sits in one clause, recital, annex, or cross-reference. AI should find that passage and cite it. Your expert should judge it. Nobody should re-read the whole stack for every question. - [The Clause You Skimmed Is the One That Burns You](https://www.sorena.io/resources/the-clause-you-skimmed.md): Nobody reads every line of every contract. Under deadline, the indemnity, the liability cap, the auto-renewal, and the data clause get skimmed. That is exactly where the loss hides. AI can flag the clause. Humans decide what matters. - [EU Compliance Deadlines Arrive Regardless of Your Backlog](https://www.sorena.io/resources/deadlines-dont-care-you-were-busy.md): The AI Act, NIS2, DORA, and CSRD all run on published legal milestones. A deadline is not a suggestion. If a date moves, it moves by formal legal change, not because your team was busy. Plan backward from the date in force with named owners and collected evidence. - [The Fastest Way to Lose a Customer Is to Leak the Last One's Data.](https://www.sorena.io/resources/one-workspace-never-sees-another.md): A customer forgives a slow feature. They do not forgive seeing another company's data in their workspace. Isolation and least privilege are not selling points. They are the price of being trusted at all. - [The Law Changed Overnight and Your Compliance Didn't](https://www.sorena.io/resources/the-rules-changed-overnight.md): Regulators, supervisory authorities, and standards bodies keep moving the rulebook. Most companies find out about the changes that matter far too late, and not from a clean alert. They find out from a fine, a customer questionnaire, or a failed audit. - [The Risk Nobody Logged Is the One That Sinks You](https://www.sorena.io/resources/the-risk-nobody-logged.md): The risk that hurts you is often not the one on your register. It is the one somebody noticed, meant to write down, and never did. You cannot govern a risk you never captured. So give every material risk one governed place to land. - [Ungrounded AI Is Just Confident Fiction](https://www.sorena.io/resources/ungrounded-ai-is-confident-fiction.md): An AI is only as trustworthy as the material it is allowed to read. Point it at nothing relevant and it can fill the gap with plausible invention, delivered with total confidence. Ground it in curated, trusted sources, or expect fiction. - [You Already Answered This. Twice. Last Quarter.](https://www.sorena.io/resources/you-already-answered-this.md): Many security questionnaires and RFPs ask the same control questions in a slightly different order. Your team retypes the same answers every quarter. Answer once, ground it, reuse it until the facts change. - [Your Board Wants One Number, Not Forty Emails](https://www.sorena.io/resources/one-number-not-forty-emails.md): The board asks one question: where do we stand on risk? Answering it can mean days of chased emails, merged spreadsheets, and slides that are stale before the meeting starts. The fix is not a better deck. It is one live view everyone reads from. - [Your Compliance Answers Are Trapped in Tools That Don't Talk](https://www.sorena.io/resources/connect-your-compliance-stack.md): The answer to the auditor's question often already exists. It is just split across tools that were not built to talk to each other, so a human has to be the integration. Connect the stack and the relay shrinks. - [Your Contracts Are Data, Not Paper](https://www.sorena.io/resources/contracts-are-data-trapped-in-pdfs.md): Every contract you sign contains a dataset of obligations, dates, and risk. Left only inside a PDF, that data is hard to operate. World Commerce and Contracting found poor contracting erodes value equivalent to almost 9% of annual revenue. The fix is treating contracts as structured operating records, not just stored documents. - [Your ESG Report Now Needs an Audit Trail Like Your Books](https://www.sorena.io/resources/esg-audited-like-your-finances.md): ESG used to be a narrative you published. Under the CSRD, in-scope sustainability statements are subject to external assurance. Sustainability data now needs an audit trail, just like financial data. - [When AI Agents Follow Malicious Instructions](https://www.sorena.io/resources/ai-agents-malicious-instructions.md): AI agents are useful because they follow instructions and take action. That is also exactly why they are dangerous. We do not pretend otherwise, and here is what we do about it. - [AI Is Not Free. ESG Is the Minimum We Owe.](https://www.sorena.io/resources/ai-esg-the-minimum-we-owe.md): AI is real-world consumption at scale. That does not make it a mistake. It makes how we use it a responsibility, and reducing ESG waste is the baseline, not the ambition. - [General-Purpose AI in GRC: Helpful or False Confidence?](https://www.sorena.io/resources/chatgpt-in-grc-false-confidence.md): GRC is not about how fast you get an answer. It is about whether the answer is complete, correct, grounded, and auditable. We put both to the test across 43 auditor-scored tasks. - [Your GRC Tool Tracks Work. Ours Does the Work.](https://www.sorena.io/resources/grc-tool-tracks-work-ours-does-the-work.md): Most teams do not struggle with GRC because they lack expertise. They struggle because the operating model creates constant friction. The fix is to change where the work happens. ## Company Company background, values, culture, and contact information. Sorena AI is based in Stockholm, Sweden. - [About Sorena AI](https://www.sorena.io/about-us.md): About Sorena AI - our story, values, and culture - [Contact Sorena AI](https://www.sorena.io/contact.md): Contact Sorena AI for demos, partnerships, and support ## Legal Legal and policy documents: privacy policy, terms of use, and DMCA. - [Privacy Policy](https://www.sorena.io/privacy.md): Privacy policy and data protection practices - [Terms of Use](https://www.sorena.io/terms-of-use.md): Terms of use and service guidelines - [DMCA Policy](https://www.sorena.io/dmca.md): DMCA notice and takedown policy