Comply.Land
Comply.Land provides a vertically integrated compliance ecosystem for manufacturers navigating the EU Cyber Resilience Act (CRA), combining consultancy, training, software tooling, and EU Authorised Representation. The platform includes Fleet, an on-premises system for signed binary distribution and SBOM management, and Achilles, a free desktop app that inventories installed software and checks for known vulnerabilities against ENISA's EU Vulnerability Database.
- Regulatory & Compliance Technology
- Cybersecurity
- Software Only
- Artificial Intelligence
- Enterprise Software
Funding
Founders
Founder details are not available yet.
Product
Problem
Manufacturers of products with digital elements face complex, evolving EU Cyber Resilience Act (CRA) requirements with mandatory vulnerability reporting starting September 2026 and full conformity by December 2027. Many existing compliance assessments, including AI-generated ones, contain errors or misclassifications that will not withstand regulatory scrutiny from notified bodies and market surveillance authorities.
Solution
Comply.Land offers a vertically integrated compliance ecosystem that combines CRA consultancy, practical workshops, structured training courses, and EU Authorised Representation services under one roof. The platform provides bespoke gap assessments, product classification, cybersecurity risk assessment, technical documentation support, and vulnerability management guidance tailored to each company's specific products and market route. Comply.Land also develops software tooling including Fleet, an on-premises platform for signed binary distribution and SBOM management, and Achilles, a free desktop application that inventories installed software and checks for known vulnerabilities. Their team includes active ETSI Rapporteurs who are drafting the harmonised standards that implement the CRA, providing direct insight into how the regulation is being operationalised.
Target Audience
Primary customers are manufacturers of software, connected devices, IoT products, and products with digital elements—including those based outside the EU—as well as importers, distributors, and commercial open-source businesses placing products on the European market.
Features
- Fleet: on-premises platform for signed binary distribution, SBOM ingestion (SPDX and CycloneDX), CRA Annex I requirement tracking, and one-click evidence pack generation for notified bodies
- Achilles: free open-source desktop app (macOS, Windows, Linux) that inventories installed applications, detects frameworks and runtimes, reviews code signing and hardening, and queries ENISA's EU Vulnerability Database plus OSV, NVD, and GHSA feeds
- CRA consultancy covering scope determination, product classification (default, Class I, Class II, critical), gap assessments, vulnerability reporting workflows, technical documentation preparation, and software supply chain review
- Tailored CRA workshops delivered online or on-site that produce documentation and evidence maps, TARA-to-CRA requirement mappings, responsibility matrices, and prioritised action plans
- Free assessment review: experts evaluate existing gap analyses or technical documentation and return a pass or fail determination within 2 working days, with no obligation
- EU Authorised Representation from Malta for non-EU manufacturers, providing an accountable point of contact with market surveillance authorities