Compliance obligations that leave evidence in your code

Most EU compliance is judgement about process, and a tool cannot help you honestly. Two regulations are different: their requirements resolve to artefacts a machine can check. These pages say what each obligation actually asks for, and the checkers are free and open source.

Cyber Resilience Act

Regulation (EU) 2024/2847. The part everyone quotes applies from 11 December 2027 — but the Article 14 reporting obligation has been in force since 11 September 2026, with a 24-hour deadline attached.

• What applies, and when — the staged timeline, scope, the three penalty tiers, and which obligations produce a document
• Article 14 reporting — the 24-hour, 72-hour and 14-day stages, where reports go, and what to write down before you need it
• The SBOM requirement — format, depth, timing and audience of what Annex I Part II(1) asks for

The checker: npx cra-ready ./your-project reports the obligations a repository cannot currently evidence, each with its article and the date it becomes enforceable.

European Accessibility Act

Enforceable since 28 June 2025. The standard behind it is EN 301 549, which for the web resolves clause by clause to WCAG 2.1 level AA.

• The Act, the standard and the mapping — who is covered, how EN 301 549 clauses map to WCAG criteria, what enforcement has looked like, and the 30–40% limit of automated testing

The checker: npx eaa-lint ./src reports WCAG 2.1 AA violations in your source with file:line, mapped to both the criterion and the EN clause.

Why source rather than a rendered page

Runtime tools see the result and cannot tell you which component produced it. Reading the source gives you a file and a line, which is where the fix has to happen — and it works in a pull request, before anything is deployed.

They answer different questions and the right setup runs both.

What these tools will never tell you

That you are compliant. Neither regulation can be satisfied by a static check: the CRA's essential product requirements are a risk assessment, and most WCAG criteria need a person with a screen reader. What a checker can do is enumerate what is provably missing, and cite the clause for each item.

Anyone selling automated conformance is selling a liability. That is not modesty; it is the difference between a defensible paper trail and a document that makes things worse when someone reads it carefully.

These pages summarise regulations to be useful. They are not legal advice, and they are not a substitute for the texts, which are linked throughout. Written by Francesco Correnti.