The Unified Compliance Engine for EU Digital Product Safety

Under the EU’s New Legislative Framework, placing a digital product on the market triggers product safety, cybersecurity, data protection, sectoral and AI-specific law at the same time. Grecta works out which obligations actually apply to your product, shows where the same evidence serves more than one regime, and keeps that picture current as the product changes and the law moves.

Join the Waitlist

Grecta: Regulatory compliance infrastructure for digital products

Programme participation and grant support:

Four things that have to be true before you can answer a regulator.

Most compliance tooling starts at the document. Grecta starts at the obligation, because until you know which ones apply to you, every document you produce is a guess about scope.

Framework identification

Grecta resolves which regulatory frameworks apply to each product from its characteristics, deployment context, jurisdictions and data processing activities, and which obligations apply within each framework. Scope is recalculated when the product changes or the law does, so you are never working from a classification someone made eighteen months ago. Where a framework does not apply, the reasoning is recorded, because a defensible negative is an answer you will be asked for.

Evidence management

Every obligation is bound to the artefact that satisfies it, with its version, its date of production, its review status and its owner. Cross-regime consolidation is identified automatically, so an encryption specification satisfying CRA Annex I, AI Act Article 15 and GDPR Article 32 is produced once and counted in all three places. Evidence that expires is flagged before it expires, not during an audit.

Audit trail

Every evaluation, every state change and every piece of evidence carries an immutable record of what was assessed, against which provision, on what date, and by whom. Regulatory state is reconstructable for any product on any past date, which is the question that actually gets asked in a market surveillance request or a product liability claim. The trail is exportable in machine-readable and document form.

Release gate sign-offs

Before a release ships, Grecta verifies that the compliance acceptance criteria attached to that release have been met and signed off, and blocks or flags where they have not. It runs in your deployment lifecycle rather than alongside it, which is the difference between compliance as a checkpoint and compliance as a quarterly panic. The sign-off becomes part of the audit trail automatically.

Corrective actions

Where an obligation is not satisfied, Grecta produces the specific action required to close it, referencing the provision, the missing or insufficient evidence, and the implementation pathway. Actions carry owners and deadlines, and they reprioritise as gaps change severity or as regulatory dates approach. Knowing you have a gap is not useful. Knowing which three things close it this quarter is.

Regulatory reporting

The same underlying record renders into whatever the recipient requires: Annex IV technical documentation under the AI Act, Annex VII and the EU declaration of conformity under the CRA, Article 30 records under GDPR, the DORA register of information, or a buyer-facing summary that discloses the position without handing over the file. Exports carry the audit trail showing what was assessed and when. You answer the question in the format the asker uses, not in yours.

Coverage across the regulatory landscape your products operate in.

Grecta provides governance infrastructure for the regulatory frameworks that apply to modern digital products. The methodology accommodates regulations, management system standards, and principle-based frameworks within a unified obligation, evidence, and evaluation model. New frameworks are added through structured authoring without modification to the platform.

EU Cyber Resilience Act (Regulation (EU) 2024/2847)

Product cybersecurity obligations for digital products placed on the EU market. Coverage of essential cybersecurity requirements (Annex I), vulnerability handling, and the manufacturer obligations under Article 13. Applies to standalone software, embedded software, and connected products with digital elements.

EU Artificial Intelligence Act (Regulation (EU) 2024/1689)

High-risk AI system obligations under Chapter III, transparency obligations under Article 50, post-market monitoring under Article 72, and the general-purpose AI model obligations under Chapter V. Coverage extends to the technical documentation and conformity assessment requirements under Annexes IV and VII.

EU General Data Protection Regulation (Regulation (EU) 2016/679)

Data protection obligations for products processing personal data, including controller and processor duties, data subject rights, lawful basis assessment, and data protection by design and by default under Article 25. Product-level scope for GDPR obligations triggered by specific data processing operations.

NIS2 (Directive (EU) 2022/2555)

Risk management measures under Article 21 including supply chain security, incident reporting obligations under Article 23, and the management body accountability provisions. Obligations are scoped to the entity and bound to the products that carry them.

DORA (Regulation (EU) 2022/2554)

ICT risk management framework obligations, the register of information on ICT third-party arrangements under Article 28, and contractual requirements where a provider supports a critical or important function. Applies since January 2025.

EU Medical Device Regulation (Regulation (EU) 2017/745)

Conformity assessment, technical documentation, and post-market surveillance obligations for medical devices placed on the EU market. Coverage includes the general safety and performance requirements (Annex I) and the integration with ISO 13485 quality management system requirements.

How It Works

Grecta operates regulatory governance as a continuous lifecycle rather than a point-in-time assessment. The economics come from consolidation: a single encryption specification can satisfy CRA Annex I, AI Act Article 15 and GDPR Article 32 simultaneously, and Grecta identifies that once rather than having three teams produce it three times.

Product Onboarding

Product characteristics, deployment context, jurisdictions of operation, data processing activities, and integration scope are submitted to the platform. Grecta resolves the regulatory frameworks applicable to the product and the obligations applicable within each framework, producing a scoped obligation set bound to the product.

Regulatory State Assessment

Each obligation in scope is evaluated against the evidence on file for the product. The platform produces a current regulatory state for every obligation — satisfied, partially satisfied, unsatisfied, or not applicable — with the supporting evaluation record showing the evidence assessed, the obligation requirements applied, and the resulting state. Cross-regime evidence consolidation is identified where a single artefact satisfies obligations under multiple frameworks (for example, an encryption specification satisfying CRA Annex I obligations, AI Act Article 15 obligations, and GDPR Article 32 obligations simultaneously).

Gap Remediation

For obligations not satisfied, Grecta produces structured corrective actions referencing the source regulatory provision, the missing or insufficient evidence, and the implementation pathway required to close the gap. Actions are assigned to internal owners, tracked through completion, and resolved with versioned evidence captured against the regulatory record.

Continuous Posture Maintenance

The regulatory posture for each product is maintained continuously across the lifecycle. The platform recalculates obligation scope when regulations are updated, recalculates regulatory state when evidence is added or expires, and recalculates corrective actions when gaps change. A regulatory record for any product is exportable in machine-readable and document formats for submission to regulatory authorities, conformity assessment bodies, or audit functions on demand.

Free Resource: The 2026 EU Digital Governance Map

One page showing every EU regime now applying to digital products, what triggers each one, when it bites, and where they overlap. Built from the consolidated texts and current Commission guidance, not from secondary commentary. Get the map in October!

What it covers:

Every EU regime now applying to digital products: the Cyber Resilience Act, the AI Act, GDPR, NIS2, DORA, the revised Product Liability Directive, the Medical Device Regulation, the Machinery Regulation, and 60 more active EU frameworks that may touch your product. Built from the consolidated texts and current Commission guidance.

Why it exists:

Every vendor maps its own regime and stops there, so a product team ends up holding five partial pictures and no landscape. Meanwhile the dates keep moving, which means most of the timelines circulating in decks and LinkedIn posts are quietly wrong. This is one page you can put in front of a board or a buyer without checking it first.

What it is not:

It tells you which regimes touch a product like yours. It does not tell you which specific obligations within them apply to your product, which evidence satisfies them, or where one artefact can satisfy several at once. That work is what the platform does, and no map can do it, because the answer depends on your product rather than on the law.

The EU AI Act High-Risk Enforcement Deadline Has Changed — What the Digital Omnibus Means for Your Compliance Timeline

Join the Waitlist for Early Access

Grecta is preparing for general availability. Organisations operating digital products under multi-regime obligations can join the waitlist for updates on availability, framework coverage releases and early access programmes as they open.

Join the Waitlist

Members receive communications about platform availability, GRECTA framework release, and early access.

FAQs

What does Grecta do?

Grecta is regulatory governance infrastructure for digital products subject to multi-regime regulations obligations. The platform determines which regulatory obligations apply to each of your digital products, evaluates each obligation against the evidence you hold, and tells you what is missing and what to do about it. It maintains that position continuously as your product changes and as the law changes, and exports the resulting record for regulators, conformity assessment bodies, auditors and enterprise buyers.

Which regulatory frameworks does Grecta cover?

The Cyber Resilience Act, the AI Act, GDPR, NIS2, DORA, the Medical Device Regulation, ISO/IEC 42001 and the NIST AI Risk Management Framework, with coverage expanding. Frameworks are added through structured authoring rather than engineering work, so a new regime is a content release rather than a product release.

How does Grecta differ from GRC platforms like ServiceNow or document management systems like Veeva Vault?

Those platforms manage the workflow around compliance work you have already scoped. Grecta does the scoping. It resolves which obligations apply from the product's own characteristics, binds each to evidence at provision level, and recalculates when either side moves. A GRC platform will faithfully track a control framework someone else decided was correct. Grecta decides, and shows its reasoning.

What kind of organisations is Grecta designed for?

Companies placing digital products on the EU market that are subject to more than one regime at once. Typically that means software and connected product companies in regulated sectors, AI providers and deployers with high-risk exposure, and financial and health technology companies where cybersecurity, data protection and sectoral obligations stack on the same product. It is built for organisations where the compliance function is smaller than the obligation set.

Does the platform use generative AI methods for regulatory evaluation?

No. Regulatory evaluation is deterministic. The same inputs produce the same regulatory state every time, and every state traces to the provision that produced it. Language models are used at the input boundary to help structure what you describe about your product, and a human confirms that structuring before anything is derived from it. No legal conclusion in the platform is model-generated.

How is regulatory content kept current as frameworks are updated?

Regulatory content is maintained centrally against the official sources, including consolidated texts and harmonised standards as they are cited. When a provision changes, every product whose obligation set touches it is flagged with what moved, what it affects and the date it takes effect. Prior versions of the regulatory record remain addressable, because the question in a dispute is what applied at the time.

What evidence formats does the platform accept?

Documents, structured data, system exports and links to artefacts held in your own systems. Evidence is bound to obligations by reference, so the artefact stays where it lives and Grecta records what it satisfies, when it was produced, who reviewed it and when it expires.

How is the regulatory record exported for regulatory submission or audit purposes?

In machine-readable and document formats, structured to the regime being addressed. Annex IV technical documentation under the AI Act, Annex VII and the EU declaration of conformity under the CRA, Article 30 records under GDPR, and the DORA register of information each render from the same underlying record. The export carries the audit trail showing what was assessed and when.

Ready when your regulatory landscape is

Framework coverage is expanding across the landscape digital products actually operate in. Join the waitlist for availability and early access, or take the governance map and see where your products sit today.

Join the Waitlist

No commitment. Unsubscribe at any time.