Why now
Three things changed
For years it was enough to check a product once. Three things ended that: the law, the attacks and the customers.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.
1. The law sets dates
New EU rules follow a product through its whole life. They ask for integrity, updates and evidence, and they come with fixed dates.
All 14 rules, with what each asks and its official text.
2. Attacks make old proof worthless
Each of these broke something that products relied on. After each one, proof made before the fix says less than it did.
- Intra-handshake.fail (2026). The belief that evidence verified inside the handshake proves you are talking to the attested machine.
- TEE.fail (October 2025). Any decision that reads 'valid quote' as 'genuine, untampered machine' when someone can touch the hardware.
- Battering RAM (September 2025). Boot-time checks as proof of a trustworthy memory path for the rest of the uptime.
- WireTap (October 2025). Quotes signed under keys from machines whose physical security is unknown.
- BadRAM (December 2024). Every attestation report from a platform below the fixed firmware version.
The full vulnerability tracker, with what to prove again after each.
3. Customers ask, and waiting costs money
- Deals that wait. Large customers ask how they can check what runs on their data. Each week a deal sits in security review is a week of delayed revenue, and some reviews end with no.
- Fines. The Cyber Resilience Act allows fines up to 15 million euros or 2.5 percent of worldwide turnover. The AI Act goes up to 35 million euros or 7 percent for the worst cases. NIS2 allows up to 10 million euros or 2 percent for essential entities.
- Incidents. IBM puts the average cost of a data breach in 2026 at 4.99 million dollars, and more than twice that in the United States. Breaches that take longer to find cost more. A product that reports its own state shortens the search.
- Recalls and downtime. When a flaw is announced and you cannot tell which units are affected, you treat all of them as affected. That means stopping fleets, re-imaging machines or sending technicians.
- Audits. Teams spend weeks each year collecting screenshots for auditors. Evidence the product produces by itself is collected once and reused for every audit and every customer.
The numbers and five questions for your board: the business case.
Questions we are often asked
We already do remote attestation.
Good. The question is what happens after the first one. If an update, a repair or a published flaw does not lead to a new proof, you attest once and trust afterwards.
We have ISO 27001 and SOC 2.
They show your processes were sound over a period. They do not show what one unit of your product runs today. Large customers and the new EU rules ask the second question.
It is too early for us.
The cheapest moment is before the fleet exists. An identity that was not put in at the factory, or measurements nobody recorded at build, cannot be added later.
Our engineers can do this.
They can, and they should own it. What saves months is a design and a complete list of the events to cover, from someone who works on nothing else.
Working on a date or a deal? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.