Compliance
Per-article, by construction.
Every regulation we hear in EU enterprise procurement reviews. Each row names the layer that satisfies it. No bolt-ons.
EU AI Act
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| Article 5 | Prohibited practices | In force 2025-02-02 | — |
| Article 12 | Logging & traceability (high-risk AI) | Throughout 2026 | HATP L3 receipts + L4 evidence packs |
| Article 22 | Automated decision rights | GDPR-aligned, ongoing | Receipt replay per data subject |
| Article 50 | AI disclosure / content labelling | Enforcement 2026-08-02 | C2PA-compatible evidence in S3 Toolkit |
NIS2
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| Article 21.2(j) | Logged autonomous security decisions | Audits under way | HATP L1+L3 chains via DE:FENDER |
| Article 21.2(k) | Risk management measures | Ongoing | S5 NIS2 Audit Evidence |
| Article 23 | Incident reporting | Ongoing | L4 incident evidence packs |
DORA
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| Article 18 | ICT incident reporting | In force 2025-01-17 | S6 evidence packs, ECB-aligned |
| Article 19 | Operational resilience testing | Ongoing | DE:EPER environment preparation and execution rig + attested artefacts |
| Articles 28–30 | Third-party ICT risk | Ongoing | Receipts include upstream provider identity |
GDPR
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| Article 22 | Right to explanation for automated decisions | In force | Receipt replay per affected subject |
| Data residency | EU jurisdictional processing | In force | All Hetzner+Scaleway EU regions |
Cyber Resilience Act
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| Full enforcement | Signed firmware, update integrity | December 2027 | Roadmapped — receipts already meet signing model |
| Vulnerability reporting | Mandatory CVD process | 2026-09-11 | Coordinated via DE:FENDER alerts |
Other
| Article | Requirement | Status / date | We satisfy via |
|---|---|---|---|
| EU Data Act | Data portability, cloud-switching | 2025-09-12 | Receipts are portable JSON-LD |
| eIDAS 2.0 | Verifiable credentials infra | 2026–2027 | Roadmapped |
Need a specific article walked end-to-end?
We will trace exactly which Decent Edge primitive satisfies the article, demo a receipt chain for it, and provide a draft EU DPA aligned to your procurement requirements.
Request a walkthrough