Compliance hub
Your compliance duties, and what SiteOS does for each
The duties below belong to you, the operator, except the Cyber Resilience Act, which binds us as the manufacturer. SiteOS holds no certification and does not make anyone compliant. It produces the evidence and runs the workflows these duties call for, where the status says so.
At a glance
| Regime | Instrument | Whose duty | Status |
|---|---|---|---|
| NIS2 Article 23 | Directive (EU) 2022/2555 | Essential and important entities in the EU | Planned |
| Critical Entities Resilience | Directive (EU) 2022/2557 | Entities designated as critical by a member state | Planned |
| Cyber Resilience Act | Regulation (EU) 2024/2847 | Manufacturers of products with digital elements, which includes ELEVEN22SPX for SiteOS | In progress |
| EU AI Act | Regulation (EU) 2024/1689 | Deployers and providers of AI systems in the EU | In progress |
| GDPR | Regulation (EU) 2016/679 | You, as the controller of the personal data your site collects | Available |
| CMMC 2.0 and NIST SP 800-171 | 32 CFR Part 170 and DFARS | US defence contractors handling Controlled Unclassified Information | Planned |
| ITAR, EAR and EU dual-use | 22 CFR 120–130, 15 CFR 730–774, Regulation (EU) 2021/821 | Anyone holding export-controlled technical data | In progress |
Directive (EU) 2022/2555
NIS2 Article 23
Planned- Whose duty
- Essential and important entities in the EU
- What it asks
- Report a significant incident to your CSIRT or authority: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
What SiteOS does today
- The tamper-evident audit chain records privileged actions and alert handling, with times: part of the timeline a report is built from.Available
Next
- Incident clocks for the 24-hour, 72-hour and one-month deadlines, routed per member state, with the evidence attached.Planned
Directive (EU) 2022/2557
Critical Entities Resilience
Planned- Whose duty
- Entities designated as critical by a member state
- What it asks
- Assess risks, including sabotage and hybrid threats, and take measures to protect and keep operating. Report incidents that significantly disrupt your service.
What SiteOS does today
- Perimeter, airspace and counter-UAS detection fused on one picture of the site.Available
- Incident records with the tracks and decisions that belong to them.Available
Next
- Resilience evidence packs and CER incident reporting.Planned
Regulation (EU) 2024/2847
Cyber Resilience Act
In progress- Whose duty
- Manufacturers of products with digital elements, which includes ELEVEN22SPX for SiteOS
- What it asks
- Handle vulnerabilities, publish a disclosure policy, keep a software bill of materials, and report actively exploited vulnerabilities. Reporting obligations apply from 11 September 2026; the rest from 11 December 2027.
This is our duty as the manufacturer. It is listed so buyers can see where we stand.
What SiteOS does today
- A published responsible-disclosure policy and security.txt.Available
Next
- A software bill of materials for every release.Planned
- A written vulnerability-handling and reporting procedure.Planned
Regulation (EU) 2024/1689
EU AI Act
In progress- Whose duty
- Deployers and providers of AI systems in the EU
- What it asks
- Military, defence and national-security uses are outside the Act (Art. 2(3)). AI used as a safety component in critical infrastructure, or to monitor people at work, can be high-risk, with human-oversight and logging duties for the deployer (Art. 26). The Regulation dates those from 2 August 2026 (Art. 113); amendments moving some dates have been reported, so verify before relying on them.
What SiteOS does today
- Detections are shown to people as suggestions with their evidence; engagements need a person.Available
- An AI system register: inventory of the AI components on your site, a risk self-assessment walked by you (Art. 2(3), Art. 5, Art. 6, Art. 50), an Art. 26 obligations board you evidence yourself, and a human-oversight log built from the decisions your people actually took.Available
Next
- Provider-side technical documentation for the camera-AI components, for you to attach as evidence.Planned
Regulation (EU) 2016/679
GDPR
Available- Whose duty
- You, as the controller of the personal data your site collects
- What it asks
- Keep personal data no longer than needed, answer access and erasure requests, and have a processing agreement with your processors.
What SiteOS does today
- Per-tenant retention policies with a purge preview.Available
- Erasure of a data subject's records, with a dry run and an explicit confirmation step.Available
- Export of an organisation's data for access and portability requests.Available
Next
- A reviewed data processing agreement and a current sub-processor list.In progress
32 CFR Part 170 and DFARS
CMMC 2.0 and NIST SP 800-171
Planned- Whose duty
- US defence contractors handling Controlled Unclassified Information
- What it asks
- Implement the 110 NIST SP 800-171 controls and score them in SPRS. Level 2 assessments by a C3PAO begin to appear in contracts from 10 November 2026.
What SiteOS does today
- Classification and caveat markings on data, and a tamper-evident audit chain.Available
Next
- Control tracking, SPRS scoring and a plan of action and milestones (POA&M).Planned
- ELEVEN22SPX USA's own CMMC Level 2 assessment.Not started
22 CFR 120–130, 15 CFR 730–774, Regulation (EU) 2021/821
ITAR, EAR and EU dual-use
In progress- Whose duty
- Anyone holding export-controlled technical data
- What it asks
- Keep controlled data from people who are not authorised to receive it, including foreign persons inside your own organisation.
What SiteOS does today
- ITAR, EAR, NOFORN, ORCON and REL TO caveats enforced on the data path, with a policy check you can query.Available
Next
- USML and ECCN classification, EU dual-use screening and deemed-export checks.Planned
Map it to your obligations
Tell us which regimes apply to your site. We show which parts SiteOS covers today, which are planned, and which stay entirely with you.