Security and compliance: our real status, standard by standard
This page contains no generic compliance badges. A badge says nothing. What says everything, instead, is declaring — regulation by regulation, with reference to the specific article — what applies to us, what does not, and what we have implemented, so you can verify it yourself.
Between 2025 and 2027, six European acts are changing how software is designed, sold, and documented: the European Accessibility Act, the Cyber Resilience Act, NIS2, the AI Act, the new Product Liability Directive, and DORA. We have read them in the official EUR-Lex and Official Journal texts. This is a snapshot of our current position, last updated in August 2026.
What follows is the technical reading of software developers, not legal advice.
European regulations read in official texts
security answers published, ahead of time
verified sources on EUR-Lex and Official Journal
generic compliance badges
Our location, at a glance
-
AI Act – implemented and active
Transparency (art. 50) and literacy (art. 4) in production: generated content labelled, human review recorded, training tracked. Details are in the section below.
-
NIS2 – not subject, supplier-ready
We are below the thresholds of art. 3 of Legislative Decree 138/2024. But if your security office needs to evaluate us as suppliers (art. 24 c.3), the ten answers are already published on this page.
-
Cyber Resilience Act – out of scope
Our SaaS products are not «products with digital elements» (art. 3, Reg. 2024/2847). We nonetheless adopt the practices the CRA will make standard: component inventory and vulnerability management.
-
Accessibility Act – exempt, equipped
Micro-enterprises providing services are exempt (art. 3 c.3, Legislative Decree 82/2022). But our clients' e-commerce platforms may be subject: we design checkout, identification and payment processes to be accessible from the start.
-
Product liability – ready
From 9/12/2026 software is a «product» and the lack of security updates carries weight (Dir. 2024/2853, art. 11). In our contracts, who maintains what, and for how long, is written down, not implied.
-
DORA – not applicable, contracts ready
It applies to financial entities (Reg. 2022/2554). If that is your sector, the clauses of art. 30 — data location, SLA, data return — are already our standard on every project.
AI Act: not a commitment, an implementation
Internally documented programme with requirement → code → evidence matrix (July 2026), active in production on AraLith COS. The Aralìx assistant introduces itself as an AI at first contact, on all our platforms (art. 50 c.1).
The detail, rule by rule
The dates, transitional provisions and articles supporting each claim of the cards above.
Reg. (EU) 2024/1689
AI Act: dates, transparency and what we have activated
Phased application (art. 113): prohibitions and general provisions from 2 February 2025, general-purpose models and penalties from 2 August 2025, general application from 2 August 2026, high risk embedded in harmonised products from 2 August 2027.
For a CMS with AI features, the concrete obligations lie in art. 50: informing those who interact with an AI, marking synthetic outputs in a machine-readable format, disclosing AI-generated text published to inform the public unless subject to human review with editorial responsibility. This is the process we have implemented: every AI modification to published content goes through an approval queue with the reviewer and date recorded. Our systems do not fall within the high-risk categories of Annex III.
Legislative Decree 138/2024 (EU Directive 2022/2555)
NIS2: who is subject, what it requires from suppliers, and what deadlines apply
Subject to the regulation are medium and large operators in the sectors listed in Annexes I-II, plus certain categories regardless of size and public administrations (Art. 3). A small software house is not subject, but is affected by the obligations of regulated clients: Art. 24(3) requires them to assess «the cybersecurity practices of their suppliers, including secure development procedures».
The deadlines are not a calendar date: they run from the individual notification by the National Cybersecurity Agency — 9 months for notifications, 18 for governance and measures (Art. 42). Penalties of up to 10 million euros or 2% of global turnover for essential entities (Art. 38), with personal liability for members of governing bodies.
Reg. (EU) 2024/2847
Cyber Resilience Act: three dates, the transitional period, the SaaS boundary
Three dates of application (art. 71): conformity assessment bodies from 11 June 2026, obligations to report actively exploited vulnerabilities from 11 September 2026, full requirements from 11 December 2027.
The transitional period (art. 69) contains the point that almost no one talks about: products already on the market escape the requirements as long as they do not undergo a substantial modification, but they do not escape the reporting obligations. The boundary for us: a pure SaaS is not a «product with digital elements» (art. 3) — our SaaS solutions are out of scope; we nonetheless adopt an inventory of components, vulnerability management and a declared support period.
Legislative Decree 82/2022 (EU dir. 2019/882)
European Accessibility Act: who it affects, from when, who is exempt
In force from 28 June 2025, with three transitional regimes: products already in lawful use until 2030, prior contracts until expiry (max 5 years), self-service terminals up to 20 years. E-commerce is included among the services (art. 1 c.3), with no turnover thresholds; for an online shop the specific requirements concern identification, security and payment (Annex I).
Micro-enterprises providing services with fewer than 10 people and up to €2 million in turnover are exempt (art. 3 c.3): this is our condition. Penalties range from €5,000 to €40,000; the «5% of turnover» circulating online belongs to a different law and applies only to private entities above €500 million.
The exemption concerns our obligations, not our expertise. We know the WCAG criteria and have been applying them for years: on request we build websites, e-commerce platforms and applications fully compliant with WCAG 2.0/2.1 level AA. For clients falling within the EAA scope, and for those who want accessibility as a standard regardless of obligations.
Dir. (EU) 2024/2853
Product liability: software is a product, updates matter
The new directive explicitly includes software in the definition of product (art. 4) and applies to products placed on the market after 9 December 2026 — the same date as the national transposition deadline, the status of which should be verified at the time of reading.
The point that changes the profession: the defence "the defect did not exist at the time of delivery" does not apply when the defect arises from the lack of necessary security updates, if the software is under the manufacturer's control (art. 11 c.2). This is why in our contracts, who maintains what, and for how long, is written down. Compensable damage (art. 6) always covers individuals, but excludes goods and data used exclusively for professional purposes.
Reg. (EU) 2022/2554
DORA: when your software vendor must sign certain clauses
It applies from 17 January 2025 to financial entities: banks, payment and electronic money institutions, investment firms, insurance companies. It does not apply to their suppliers as such: it reaches suppliers through the contract.
Art. 30 lists what any ICT services contract with a financial entity must contain: location of data processing and storage, SLAs, incident support at a predefined cost, cooperation with authorities, and the clause we share most often — the return of data in an accessible format if the supplier ceases operations. For us, this is not a new obligation: full portability of code and data has always been our standard, in every sector.
The NIS2 questionnaire, already filled out
If your company is an essential or important entity, art. 24 c.2 of Legislative Decree 138/2024 lists ten categories of measures you must oversee — including towards suppliers. Sooner or later your security office would send us a questionnaire on these ten items: here are the answers, in advance.
Every project starts with a discovery phase that maps out the data processed, integrations, and regulatory constraints of the client; security decisions are documented in the repository alongside the code, with ADRs (architecture decision records) for structural choices. The platforms have written and versioned security instructions covering headers, uploads, escaping, authorizations, CORS, sessions, and logging.
The notification channel is agreed upon with each client during the contractual phase, usually via certified email, and the report is made without undue delay. For events involving the infrastructure, timelines also depend on notifications from hosting providers, according to the GDPR chain of responsibility. Application logs are centralized with access restricted to administrators, relevant actions are tracked with user and date, and a single technical point of contact knows the entire system: diagnosis does not go through handover steps.
Daily backups on SaaS platform infrastructure; code lives in Git repositories with full history, replicated outside the production server. For custom projects, the backup strategy is defined in the contract together with the client, based on their continuity requirements.
Software dependencies are managed with versioned lockfiles (Composer, npm): each third-party component is tracked with its exact version, effectively a software bill of materials. Critical infrastructure suppliers (hosting, AI providers) are few, well-known, and can be named upon request during the contractual phase.
Content-Security-Policy with nonce on every script, systematic template escaping, server-side authorization checks on every endpoint, secrets encrypted at-rest in the database, periodic dependency updates based on security advisories. Internally discovered vulnerabilities are treated as blocking bugs, with a documented fix.
Documented and dated internal audits — the last complete program, on AI governance, dates from July 2026 — with a requirement→implementation→evidence matrix and a review of practices at every relevant regulatory change, with primary sources cited in internal documents.
The platform has an active literacy system with mandatory guides, acknowledgement tracked per user and per document version, and a lock on the administration area in case of missing confirmation: training is not just declared, it is demonstrable with an exportable report.
Transport always over TLS; API keys and configuration secrets encrypted at-rest in the database with application-level encryption; no credentials in plain text in logs — sensitive content is masked by default even in the internal log viewer.
Roles and permissions verified server-side on every administrative route; the most sensitive tools (logs, configurations) are restricted to administrators; relevant modification actions record who performed them and when. Assets (domains, servers, repositories, services) are inventoried and traceable to a single responsible party.
Yes, on all our platforms: login with OTP via email as a second factor on both AraLith COS and AralithPulse; on AralithPulse, single-session per account is also active — a new login invalidates the previous one.
Sources: Reg. (EU) 2024/1689 (AI Act) · D.Lgs. 138/2024 (NIS2) · Reg. (EU) 2024/2847 (CRA) · D.Lgs. 82/2022 (EAA) · Dir. (EU) 2024/2853 (product liability) · Reg. (EU) 2022/2554 (DORA) — verified against the official texts of EUR-Lex and the Official Journal, last updated August 2026.
This page describes real and verifiable practices; it is neither a certification nor legal advice.
Does your security office have more questions?
We answer vendor security questionnaires with the same transparency as this page. If an answer is «we don't do it», you'll find it written just like that.
