Regulations and standards

The rules ask for proof that stays true

A certificate describes one version. The law now follows the product through its whole life.

None of these texts says "remote attestation" in so many words. They ask for integrity, identity, updates and evidence over the lifetime of a product. Attestation, repeated, is the most direct way to produce that evidence.

The dates

Since 11 Sep 2026: Cyber Resilience Act: 24-hour reporting of exploited vulnerabilities
24 Dec 2026: EU Digital Identity Wallets due in every member state
20 Jan 2027: EU Machinery Regulation applies
2 Dec 2027: AI Act duties for high-risk AI systems
11 Dec 2027: Cyber Resilience Act applies in full

The rules

eIDAS 2.0 and the EU Digital Identity Wallet Cyber Resilience Act EU AI Act EU Machinery Regulation IEC 62443 UN Regulations 155 and 156 DORA NIS2 ISO 27001 and SOC 2 GDPR Swiss Federal Act on Data Protection European Health Data Space GxP data integrity rules EU network code on cybersecurity for electricity

eIDAS 2.0 and the EU Digital Identity Wallet

Regulation (EU) 2024/1183

Who it reaches: Wallet providers, issuers of identity data and credentials, trust service providers, banks and other relying parties.
When: Member states must offer a wallet by 24 December 2026. Public services accept it from then; regulated private sectors follow about a year later.
What it asks: The wallet provider vouches for each wallet unit and its keys with a Wallet Unit Attestation, keeps it current and revokes it when the unit is no longer trustworthy. Wallets are certified.
Where re-attestation fits: This is re-attestation written into an architecture. The open questions are operational: validity periods, triggers, revocation that reaches every dependent credential, and remote attestation of HSM-based key stores.
Our work: Attested wallets and digital identity
Official text: Regulation (EU) 2024/1183

Cyber Resilience Act

Regulation (EU) 2024/2847

Who it reaches: Makers, importers and distributors of products with digital elements sold in the EU: devices, robots, machines, software.
When: Reporting duties apply since 11 September 2026, also for products already on the market. All other duties apply from 11 December 2027.
What it asks: Security by design, security updates through the support period, a software bill of materials, and reporting of actively exploited vulnerabilities within 24 hours.
Where re-attestation fits: To report within 24 hours you must know which units run the affected version. To claim an update fixed it, you must show the update arrived. Attestation is evidence for both; a version database is only an intention.
Our work: Attested devices · Attested robots · Attested autonomous vehicles and machines · Attested software supply chain
Official text: Regulation (EU) 2024/2847

EU AI Act

Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744

Who it reaches: Providers and deployers of high-risk AI systems, including AI built into machinery, vehicles and medical devices.
When: High-risk duties apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for AI inside regulated products.
What it asks: Accuracy, robustness and cybersecurity over the whole life of the system, logging, and a quality system that covers changes after release.
Where re-attestation fits: A model that is retrained or swapped is a changed system. Attestation that includes the model in its measurements shows which version made which decision, and re-attestation makes each change visible.
Our work: Attested AI · Attested AI agents · Attested robots
Official text: Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744

EU Machinery Regulation

Regulation (EU) 2023/1230

Who it reaches: Makers of machinery, including robots, mobile machines and autonomous off-road vehicles.
When: Applies from 20 January 2027 and replaces the Machinery Directive.
What it asks: Protection against corruption: safety functions must not be compromised through connected devices or software, and evidence of interventions must be kept.
Where re-attestation fits: Safety now depends on software integrity. Measured boot and attestation let a fleet operator check that integrity remotely, after every update and repair, instead of assuming it from the last inspection.
Our work: Attested robots · Attested autonomous vehicles and machines
Official text: Regulation (EU) 2023/1230

IEC 62443

International standard series for industrial automation and control systems

Who it reaches: Makers and integrators of industrial components and systems. Robots count as components; the 2025 edition of the robot safety standard ISO 10218 adds its own cybersecurity clause.
When: No legal date of its own. It is what industrial buyers put in tenders, and it informs the standards being written for the Cyber Resilience Act.
What it asks: Component requirements include boot integrity, software integrity, device identification and, at higher security levels, hardware roots of trust.
Where re-attestation fits: A 62443 certificate is issued for one version of a component. Attestation is how the owner checks the same properties on the deployed unit, remotely, each time the software changes.
Our work: Attested robots · Attested devices · Attested autonomous vehicles and machines
Official text: International standard series for industrial automation and control systems

UN Regulations 155 and 156

UNECE vehicle type approval: cybersecurity and software updates

Who it reaches: Manufacturers of road vehicles, including trucks, and through them their software suppliers.
When: In the EU, required for new vehicle types since 2022 and for all new vehicles since 2024.
What it asks: A cybersecurity management system for the vehicle's whole life, and a software update management system that identifies approval-relevant software with an identifier (RXSWIN).
Where re-attestation fits: An identifier that the vehicle reports is a claim. An attested measurement is evidence. The difference matters most when autonomy software from a supplier is updated on a vehicle approved by the manufacturer.
Our work: Attested autonomous vehicles and machines
Official text: UNECE vehicle type approval: cybersecurity and software updates

DORA

Regulation (EU) 2022/2554

Who it reaches: Banks, insurers and other financial firms in the EU, and the technology suppliers they depend on.
When: Applies since 17 January 2025.
What it asks: Control over ICT third-party risk: financial firms must know and test how their suppliers protect data and services.
Where re-attestation fits: This is where the long security questionnaire for AI and cloud vendors comes from. A supplier that can hand over verifiable attestation evidence answers it faster than one that hands over policies.
Our work: Attested AI · Attested cloud workloads · Continuous compliance
Official text: Regulation (EU) 2022/2554

NIS2

Directive (EU) 2022/2555

Who it reaches: Operators in energy, transport, health, digital infrastructure, manufacturing and other essential or important sectors.
When: In national law across the EU, country by country.
What it asks: Risk management measures, supply chain security and incident reporting, with management held responsible.
Where re-attestation fits: Supply chain security turns into questions to every supplier. Machine evidence of what a supplied system runs is the strongest possible answer.
Our work: Attested devices · Attested cloud workloads · Attested software supply chain
Official text: Directive (EU) 2022/2555

ISO 27001 and SOC 2

Information security certification and assurance reports

Who it reaches: Almost every company that sells software or services to other companies.
When: Renewed in yearly cycles.
What it asks: Controls that are designed, operated and evidenced over a period.
Where re-attestation fits: Auditors sample. Attestation evidence collected at every deploy covers the whole period and costs nothing extra to collect once the design is in place.
Our work: Continuous compliance · Attested cloud workloads

Swiss Federal Act on Data Protection

Revised FADP (nDSG)

Who it reaches: Companies that process personal data in Switzerland or of people in Switzerland.
When: The revised act applies since 1 September 2023.
What it asks: Data security appropriate to the risk, privacy by design, and care when data is processed by others or abroad. Responsible individuals can be fined personally.
Where re-attestation fits: The duty falls on people, which raises the value of evidence. An attested processing environment gives the responsible person something to point to.
Our work: Attested AI · Attested cloud workloads · Continuous compliance
Official text: Revised FADP (nDSG)

European Health Data Space

Regulation (EU) 2025/327

Who it reaches: Health data holders, researchers, and bodies that give access to health data for research and policy.
When: In force since 26 March 2025. It applies in general from 26 March 2027. The rules on using health data for research apply from 26 March 2029.
What it asks: Health data used for research is to be processed in secure processing environments, with control over what goes in and what comes out.
Where re-attestation fits: A secure processing environment is a claim about software and hardware. Attestation is how a data holder checks that claim before releasing records, and again when the environment changes.
Our work: Attested AI · Attested cloud workloads
Official text: Regulation (EU) 2025/327

GxP data integrity rules

EU GMP Annex 11, US 21 CFR Part 11 and related guidance

Who it reaches: Pharma and biotech companies, their laboratories, manufacturers and contractors.
When: Long in force. Inspections focus more and more on computerised systems.
What it asks: Records that are attributable, original and accurate, produced by validated systems that stay in a controlled state.
Where re-attestation fits: Validation shows a system was right on one day. Attestation shows it is still that system when it produces a record, and ties the record to the software version.
Our work: Attested OT and industrial control · Attested devices · Attested AI
Official text: EU GMP Annex 11, US 21 CFR Part 11 and related guidance

EU network code on cybersecurity for electricity

Delegated Regulation (EU) 2024/1366

Who it reaches: Grid operators and other entities with an impact on cross-border electricity flows.
When: In force since June 2024, with duties phased in.
What it asks: Risk assessments, minimum and advanced security controls, and control over the supply chain of critical equipment.
Where re-attestation fits: Supply chain control over devices you do not own needs evidence from the devices. Attested firmware versions give the operator that evidence.
Our work: Attested OT and industrial control · Attested devices
Official text: Delegated Regulation (EU) 2024/1366

Summary for product teams, checked 12 November 2026. It is not legal advice; read the texts and ask your counsel for the reading that applies to you.

Working on a deadline? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.

Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.

Book a 30-minute call Get expert help

NextReattestation Review →Take the self-check →Vulnerability tracker →