An assessment for the AI Act, the Machinery Regulation, the Cyber Resilience Act, and NIS2. Plus consulting services for IT and OT security, ranging from awareness training to critical infrastructure. And an ecosystem that handles implementation. Here you’ll find detailed information on all our services.
A lifecycle from clarity to ongoing security. A one-time assessment and roadmap, with ongoing security and verification. A single project leads to lasting, verifiable compliance.
What regulatory frameworks do you comply with, and where do you stand today? Record it once, use it across all regulatory frameworks.
Learn morePrioritized measures featuring quick wins and a consolidated set of controls, implemented in collaboration with our partners.
Learn moreCRA documentation for your supplier base. A program provided to your suppliers to serve as the basis for your declaration of conformity.
Learn moreContinuously monitors your audit and compliance capabilities, with annual reassessments, a complete audit trail, and version control.
Learn morePractical training for production and office staff, tailored to your OT environment. Includes handouts, exercises, and sample solutions that work in everyday situations.
Assessment of compliance with the minimum ICT standards, which are already mandatory for the electricity sector. Compact, affordable, and with a clear report on the results.
A structured workshop series for manufacturers looking to enter the EU market. Topics range from manufacturer status to the Machinery Directive and the Cyber Resilience Act.
Four sets of EU regulations are affecting the mechanical and plant engineering sectors almost simultaneously. As a manufacturer and operator, you are subject to both sets of obligations. Obligations, deadlines, and liability all converge.
Cybersecurity requirements for wireless devices with Bluetooth or Wi-Fi are already in effect. They will be replaced by the CRA as of December 11, 2027.
Cybersecurity Obligations for Operators. Reporting Requirements and Liability of Management.
Transparency requirements under Article 50 apply. Existing systems must be labeled by December 2, 2026.
Actively exploited vulnerabilities and serious incidents must be reported (Art. 14).
For the first time, digital and AI risks are being considered as part of product safety.
Obligations for autonomous high-risk AI (Annex III), as newly established under the Digital Omnibus.
Security by Design for products with digital elements.
Requirements for high-risk AI in regulated products (Annex I). Machine learning is largely covered by the GDPR.
Machinery and plant manufacturers are almost always both at the same time. This is precisely where the leverage of convergence is greatest.
Security by Design, technical documentation, and product conformity assessment.
Risk management, reporting requirements, and ongoing, safe operations.
Those who manage the two separately create two separate compliance frameworks. We integrate both into a common ISMS framework based on ISO 27001, with IEC 62443 serving as a bridge between product security and operational security. Manufacturer and operator responsibilities are consolidated into a single system.
Each pillar follows the same logic of legal requirements, certifiable evidence, and proven methodology. Which of these components you actually need depends on your products, markets, and roles.
Four sets of regulations, eleven frameworks, hundreds of individual requirements. Our convergence matrix condenses all of this into 14 measures and shows which ones count toward multiple requirements. This saves you three to four times the project effort.
A single unaddressed vulnerability often affects seven sets of regulations at once. The matrix reveals where your greatest opportunities and your most dangerous vulnerabilities lie only when we apply it to your company. You can only learn this through a conversation—not online.
Schedule a Quick CheckFour key trends will shape the coming years in mechanical and plant engineering. We understand them in detail and translate them into a feasible roadmap.
The AI competence requirement under Article 4 has been in effect since February 2025, while the labeling requirements under Article 50 have been in effect since August 2026, with a deadline of December 2, 2026, for existing systems. High-risk requirements will be phased in through 2028. Of the ten planned standards, only one has been published, and none have been cited as legally binding. Ironically, the one on safety is missing.
Security by Design for products with digital components, vulnerability management throughout the entire lifecycle, and mandatory SBOM reporting. The reporting requirement applies retroactively to products that have already been shipped. Without a declaration of conformity, sales may be suspended starting at the end of 2027.
Replaces the Machinery Directive with an abrupt transition and no grace period for selling off existing stock. For the first time, digital and AI risks are included in product safety requirements, including protection against tampering with safety-critical software and documentation requirements regarding modifications and software versions.
The Swiss benchmark for ICT resilience, based on the NIST Cybersecurity Framework and comprising over 100 specific measures. Already mandatory for the electricity sector; for other sectors, it serves as the gateway to regulated supply chains.
From ISG and the Minimum ICT Standard to PrSG/MaschV, the EU Machinery Directive, NIS2, and the Cyber Resilience Act. This white paper provides a Swiss perspective on which national and EU regulations apply, what deadlines are in effect, and how you can efficiently meet all requirements using an integrated approach.
Request a White Paper
In this 30-minute quick check, we'll show you which regulations you need to comply with and where your greatest leverage lies.
SecureComply GmbH
info@securecomply.ch
+41 79 746 35 88
Sitelinks
About Us
Services
White Papers
Contact
