{"id":16274,"date":"2026-11-07T11:20:12","date_gmt":"2026-11-07T10:20:12","guid":{"rendered":"https:\/\/safewave.ai\/compliance-and-audits\/"},"modified":"2026-11-09T15:16:16","modified_gmt":"2026-11-09T14:16:16","slug":"compliance-and-audits","status":"publish","type":"page","link":"https:\/\/safewave.ai\/en\/compliance-and-audits\/","title":{"rendered":"Compliance and Audits"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"16274\" class=\"elementor elementor-16274 elementor-16010\" data-elementor-post-type=\"page\">\n\t\t\t\t<section class=\"elementor-element elementor-element-ccb44fd e-flex e-con-boxed e-con e-parent\" data-id=\"ccb44fd\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f75ba4b elementor-widget elementor-widget-heading\" data-id=\"f75ba4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">Compliance and Audits<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab3aac4 elementor-widget elementor-widget-heading\" data-id=\"ab3aac4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">From regulations to demonstrable security<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae88c76 elementor-widget elementor-widget-text-editor\" data-id=\"ae88c76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The amendment to Poland&#8217;s National Cybersecurity System Act (KSC Act) is effective from April 3, 2026<sup><a href=\"#przypis-1\">1<\/a><\/sup>, DORA \u2013 from January 17, 2025<sup><a href=\"#przypis-2\">2<\/a><\/sup>. Additionally, there&#8217;s CRA for hardware and software manufacturers, and the AI Act. We help you determine which obligations apply to you, close gaps, and prove \u2013 including with manual penetration tests \u2013 that your security measures are effective.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6dc281e e-flex e-con-full e-con e-child\" data-id=\"6dc281e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2ff3e2d elementor-widget elementor-widget-button\" data-id=\"2ff3e2d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/safewave.ai\/en\/#SafeWave-get-in-touch\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-icon\">\n\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-arrow-circle-right\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8c137 0 248 111 248 248S393 504 256 504 8 393 8 256 119 8 256 8zm-28.9 143.6l75.5 72.4H120c-13.3 0-24 10.7-24 24v16c0 13.3 10.7 24 24 24h182.6l-75.5 72.4c-9.7 9.3-9.9 24.8-.4 34.3l11 10.9c9.4 9.4 24.6 9.4 33.9 0L404.3 273c9.4-9.4 9.4-24.6 0-33.9L271.6 106.3c-9.4-9.4-24.6-9.4-33.9 0l-11 10.9c-9.5 9.6-9.3 25.1.4 34.4z\"><\/path><\/svg>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Check Your Obligations<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e98986e elementor-widget elementor-widget-button\" data-id=\"e98986e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"#jak-dziala\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">How It Works<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-4a901c3 e-flex e-con-boxed e-con e-parent\" data-id=\"4a901c3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7809b07 elementor-widget elementor-widget-heading\" data-id=\"7809b07\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What the data shows<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-db7eb32 e-flex e-con-full e-con e-child\" data-id=\"db7eb32\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-e37dce3 e-flex e-con-full e-con e-child\" data-id=\"e37dce3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-71d1327 elementor-widget elementor-widget-heading\" data-id=\"71d1327\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">2027<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad64398 elementor-widget elementor-widget-text-editor\" data-id=\"ad64398\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>April 3 is the deadline for implementing obligations from the amendment to the KSC Act<\/strong> for essential and important entities that met the criteria on its effective date.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d48561e e-flex e-con-full e-con e-child\" data-id=\"d48561e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4568029 elementor-widget elementor-widget-text-editor\" data-id=\"4568029\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-stat\"><p class=\"sw-num\">October 3, 2026<\/p><p class=\"sw-txt\">deadline for submitting an application for inclusion in the list of essential and important entities passed.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">2028<\/p><p class=\"sw-txt\">by April 3, the first audit for essential entities, then at least every three years. From this date, penalties can also be imposed for most obligations.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">2%<\/p><p class=\"sw-txt\">of annual turnover or EUR 10 million \u2013 NIS2 requires penalties for essential entities to reach at least this threshold (for important entities: 1.4% or EUR 7 million).<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">September 11, 2026<\/p><p class=\"sw-txt\">from this date, manufacturers report actively exploited vulnerabilities (CRA). The main CRA requirements apply from December 11, 2027.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-81eb188 elementor-widget elementor-widget-text-editor\" data-id=\"81eb188\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Conclusion:<\/strong> deadlines are closer than they seem. Identifying, analyzing gaps, planning, and implementing technical security measures typically takes many months of work, in our experience \u2013 especially when purchases and vendors are involved.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-d1c64c3 e-flex e-con-boxed e-con e-parent\" data-id=\"d1c64c3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-f5bfee3 e-flex e-con-full e-con e-child\" data-id=\"f5bfee3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-929b6c2 elementor-widget elementor-widget-heading\" data-id=\"929b6c2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Most common gaps \u2013 six areas<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eb853e5 elementor-widget elementor-widget-text-editor\" data-id=\"eb853e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Areas from NIS2, DORA, CRA, and the AI Act where more than just a document is often missing. For each: what we do and which solution technically closes the gap.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47da1de e-flex e-con-full e-con e-child\" data-id=\"47da1de\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6b4d74d elementor-widget elementor-widget-text-editor\" data-id=\"6b4d74d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-item\"><h3>Risk analysis from years ago<\/h3><p>NIS2 begins the list of mandatory measures with risk analysis and information system security policies (Article 21(2)(a)).<sup><a href=\"#przypis-3\">3<\/a><\/sup> An analysis from several years ago does not cover cloud, AI, or new vendors.<\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> current risk assessment for systems and processes your services depend on, and the resulting policies.<\/p><\/div><div class=\"sw-item\"><h3>Incident without a practiced procedure<\/h3><p>An early warning must be sent within 24 hours of detecting a significant incident.<sup><a href=\"#przypis-3\">3<\/a><\/sup> Without monitoring and an established decision path, this deadline is unrealistic.<\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> incident handling and reporting procedure, scenario-based exercises, and 24\/7 monitoring \u2013 see <a href=\"https:\/\/safewave.ai\/en\/soc-xdr-and-threat-intelligence\/\">SOC, XDR, and Threat Intelligence<\/a>.<\/p><\/div><div class=\"sw-item\"><h3>Uncontrolled suppliers<\/h3><p>NIS2 requires supply chain security (Article 21(2)(d)).<sup><a href=\"#przypis-3\">3<\/a><\/sup> DORA goes further: financial entities must maintain a register of information on all contracts with ICT service providers (Article 28(3)).<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> ICT vendor registry, risk assessment, and security requirements for contracts.<\/p><\/div><div class=\"sw-item\"><h3>Lack of proof that security measures work<\/h3><p>NIS2 requires policies and procedures for assessing the effectiveness of risk management measures (Article 21(2)(f)).<sup><a href=\"#przypis-3\">3<\/a><\/sup> DORA explicitly mentions penetration tests in the resilience testing program (Articles 24\u201325).<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> manual penetration tests with a report and retest, and continuous validation \u2013 see <a href=\"https:\/\/safewave.ai\/en\/ctem-and-resilience-validation\/\">CTEM and Resilience Validation<\/a>.<\/p><\/div><div class=\"sw-item\"><h3>Product without a vulnerability handling process<\/h3><p>If you place hardware or software on the EU market, CRA covers you as a manufacturer. From September 11, 2026, actively exploited vulnerabilities must be reported \u2013 an early warning within 24 hours.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> assessment of whether and which products are subject to CRA, vulnerability handling and reporting process, and product security tests.<\/p><\/div><div class=\"sw-item\"><h3>AI without rules and an owner<\/h3><p>From August 2, 2026, transparency obligations from the AI Act apply, and requirements for high-risk systems from Annex III \u2013 from December 2, 2027.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> AI governance \u2013 inventory of applications, policy, risk assessment, and classification according to the AI Act, in the spirit of ISO\/IEC 42001.<sup><a href=\"#przypis-6\">6<\/a><\/sup> See <a href=\"https:\/\/safewave.ai\/en\/secure-and-responsible-ai\/\">Secure and Responsible AI<\/a>.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-e0311f2 e-flex e-con-boxed e-con e-parent\" data-id=\"e0311f2\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da41508 elementor-widget elementor-widget-heading\" data-id=\"da41508\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where compliance usually ends<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2604e54 elementor-widget elementor-widget-text-editor\" data-id=\"2604e54\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-lead\">Policies in a binder are a good start. However, an auditor will ask how they work in practice \u2013 and ask for proof.<\/p><div class=\"sw-cols\"><div class=\"sw-card sw-ok\"><h3>Usually in place<\/h3><ul><li>Information security policy<\/li><li>GDPR procedures<\/li><li>List of existing security measures<\/li><\/ul><\/div><div class=\"sw-card sw-gap\"><h3>Usually missing<\/h3><ul><li>Assignment of NIS2\/KSC obligations to systems and individuals<\/li><li>Registry of ICT vendors and their risks<\/li><li>Practiced 24-hour incident reporting procedure<\/li><li>Current penetration test and evidence that security measures are effective<\/li><li>Rules for using AI<\/li><\/ul><\/div><\/div><p class=\"sw-note\">A document is not a security measure. Compliance is a demonstrable state.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-2ad6b58 e-flex e-con-boxed e-con e-parent\" data-id=\"2ad6b58\" data-element_type=\"container\" data-e-type=\"container\" id=\"jak-dziala\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4ec01bd elementor-widget elementor-widget-heading\" data-id=\"4ec01bd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">SafeWave<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab27e4b elementor-widget elementor-widget-heading\" data-id=\"ab27e4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">From gap analysis to audit readiness<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c24551 elementor-widget elementor-widget-text-editor\" data-id=\"9c24551\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-lead\">We connect legal requirements with technology we know inside out. This ensures that the compliance plan immediately translates into concrete security measures, not just documents.<\/p><div class=\"sw-tiles\"><div class=\"sw-tile\"><h3>Gap and risk analysis<\/h3><p>Determining whether you are subject to NIS2\/KSC, DORA, or CRA, comparing current status with requirements and ISO\/IEC 27001, risk assessment.<sup><a href=\"#przypis-7\">7<\/a><\/sup><\/p><\/div><div class=\"sw-tile\"><h3>Plan, implementation, audit<\/h3><p>Schedule with owners, implementation of security measures from our areas, and documentation for the auditor.<\/p><\/div><div class=\"sw-tile\"><h3>CRA for manufacturers<\/h3><p>Scope assessment, vulnerability handling and reporting process, product security documentation.<\/p><\/div><div class=\"sw-tile\"><h3>AI governance<\/h3><p>AI policy, inventory of applications, risk assessment, and classification according to the AI Act.<\/p><\/div><div class=\"sw-tile\"><h3>Manual penetration tests<\/h3><p>Tests conducted by pentesters \u2013 applications, APIs, and infrastructure \u2013 with a report, recommendations, and retest.<\/p><\/div><div class=\"sw-tile\"><h3>Board and training<\/h3><p>Training for the board on NIS2 obligations and a regular, understandable security status report.<\/p><\/div><\/div><p class=\"sw-vendor\">It is advisable to confirm the interpretation of regulations in a specific case with a lawyer. We are responsible for ensuring that requirements are transformed into effective security measures.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c2cccdf elementor-widget elementor-widget-text-editor\" data-id=\"c2cccdf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3 class=\"sw-more-h\">Four regimes, one approach<\/h3><div class=\"sw-more\"><div class=\"sw-card\"><p class=\"sw-card__vendor\">NIS2 and the KSC Act<\/p><h4>Essential and important entities<\/h4><ul><li>Sectors of high criticality and other critical sectors \u2013 including energy, transport, banking, healthcare, water, digital infrastructure, manufacturing.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/li><li>Risk management measures, incident reporting, board responsibility.<\/li><li>First audit for essential entities by April 3, 2028.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/li><\/ul><p class=\"sw-card__stat\"><strong>18<\/strong> sectors in Annexes I and II of the NIS2 Directive.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><\/div><div class=\"sw-card\"><p class=\"sw-card__vendor\">DORA<\/p><h4>Financial sector<\/h4><ul><li>Banks, insurance companies, investment firms, payment institutions, and others.<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/li><li>ICT risk management, reporting of major incidents, resilience testing, ICT third-party risk.<\/li><li>Register of information on contracts with ICT service providers.<\/li><\/ul><p class=\"sw-card__stat\"><strong>January 17, 2025<\/strong> \u2013 from this date, DORA applies across the EU.<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/p><\/div><div class=\"sw-card\"><p class=\"sw-card__vendor\">CRA<\/p><h4>Hardware and software manufacturers<\/h4><ul><li>Products with digital elements placed on the EU market.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/li><li>Security throughout the product lifecycle and vulnerability handling.<\/li><li>Reporting of actively exploited vulnerabilities from September 11, 2026.<\/li><\/ul><p class=\"sw-card__stat\"><strong>December 11, 2027<\/strong> \u2013 from this date, the main CRA requirements apply.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><\/div><div class=\"sw-card\"><p class=\"sw-card__vendor\">AI Act<\/p><h4>Companies that provide or use AI<\/h4><ul><li>Obligations depend on the role and risk level of the AI system.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/li><li>Transparency from August 2, 2026.<\/li><li>High-risk systems from Annex III from December 2, 2027.<\/li><\/ul><p class=\"sw-card__stat\"><strong>ISO\/IEC 42001<\/strong> \u2013 AI management system standard as a governance framework.<sup><a href=\"#przypis-6\">6<\/a><\/sup><\/p><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-ac5729a e-flex e-con-boxed e-con e-parent\" data-id=\"ac5729a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-d15d5b8 e-flex e-con-full e-con e-child\" data-id=\"d15d5b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8ee1aea elementor-widget elementor-widget-heading\" data-id=\"8ee1aea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The board is responsible \u2013 and must understand the risk<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7658d8 elementor-widget elementor-widget-text-editor\" data-id=\"d7658d8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 shifts responsibility for cybersecurity to the board level. Members of management bodies approve risk management measures, oversee their implementation, and can be held liable for breaches.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><p>The amendment to the KSC Act also indicates the responsibility of managers for cybersecurity tasks.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-927eecf e-flex e-con-full e-con e-child\" data-id=\"927eecf\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-84156a3 elementor-widget elementor-widget-text-editor\" data-id=\"84156a3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3>What the board should know<\/h3><ul><li><strong>Approves:<\/strong> cybersecurity risk management measures.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/li><li><strong>Oversees:<\/strong> their implementation, not just signing policies.<\/li><li><strong>Trains:<\/strong> NIS2 requires training for members of management bodies.<\/li><li><strong>Is liable:<\/strong> for breaches of obligations.<\/li><li><strong>Deadlines:<\/strong> KSC obligations by April 3, 2027, penalties for most of them from April 3, 2028.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-f536ff9 e-flex e-con-boxed e-con e-parent\" data-id=\"f536ff9\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8bf493c elementor-widget elementor-widget-heading\" data-id=\"8bf493c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What regulations say<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5410bbe elementor-widget elementor-widget-text-editor\" data-id=\"5410bbe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-law\"><div class=\"sw-law-item\"><h3>NIS2<\/h3><p>Article 20 \u2013 board responsibility, Article 21 \u2013 ten areas of risk management measures, Article 23 \u2013 incident reporting, Article 34 \u2013 penalties.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>KSC Act<\/h3><p>Effective from April 3, 2026. Entry into the register by October 3, 2026, implementation of obligations by April 3, 2027, first audit for essential entities by April 3, 2028.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>DORA<\/h3><p>From January 17, 2025: ICT risk management, incident reporting, resilience testing \u2013 including penetration tests \u2013 ICT third-party risk, and information sharing on threats.<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>CRA<\/h3><p>Regulation (EU) 2024\/2847 is effective from December 10, 2024. Reporting of actively exploited vulnerabilities from September 11, 2026, main requirements from December 11, 2027.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>AI Act<\/h3><p>Regulation (EU) 2024\/1689, amended by Regulation (EU) 2026\/1744: obligations according to role and risk level, transparency from August 2, 2026, high-risk (Annex III) from December 2, 2027.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>ISO\/IEC standards<\/h3><p>ISO\/IEC 27001 for information security<sup><a href=\"#przypis-7\">7<\/a><\/sup> and ISO\/IEC 42001 for AI management<sup><a href=\"#przypis-6\">6<\/a><\/sup> \u2013 a common language for auditors, supervision, and contractors.<\/p><\/div><\/div><p class=\"sw-note\">This page organizes the most important obligations and deadlines but does not replace reading the regulations or seeking legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-29e3d2a e-flex e-con-boxed e-con e-parent\" data-id=\"29e3d2a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-35c871c e-flex e-con-full e-con e-child\" data-id=\"35c871c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d83c762 elementor-widget elementor-widget-heading\" data-id=\"d83c762\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How we work<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b219ee elementor-widget elementor-widget-text-editor\" data-id=\"1b219ee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>SafeWave has been operating since 1998 as a vendor-agnostic integrator. We treat compliance as a security plan, not a documentation project.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4b602fb e-flex e-con-full e-con e-child\" data-id=\"4b602fb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-42951e5 elementor-widget elementor-widget-text-editor\" data-id=\"42951e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol class=\"sw-steps\"><li><h3>Identification<\/h3><p>We determine which regulations you are subject to \u2013 NIS2\/KSC, DORA, CRA, AI Act \u2013 and which systems, products, and services are in scope.<\/p><\/li><li><h3>Gap and risk analysis<\/h3><p>We compare the current state with requirements and assess risk. Result: a prioritized list of gaps.<\/p><\/li><li><h3>Plan and implementation<\/h3><p>Schedule with owners and implementation of security measures \u2013 organizational and technical.<\/p><\/li><li><h3>Proof and maintenance<\/h3><p>Manual penetration tests, documentation for the auditor, incident exercises, and a report for the board. Support in English and Polish.<\/p><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-261e6ba e-flex e-con-boxed e-con e-parent\" data-id=\"261e6ba\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7dcffdc elementor-widget elementor-widget-heading\" data-id=\"7dcffdc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Check how much is left to do before April 2027<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9be9f0c elementor-widget elementor-widget-text-editor\" data-id=\"9be9f0c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Let&#8217;s start with a brief analysis: which regulations apply to you \u2013 NIS2\/KSC, DORA, CRA, AI Act \u2013 what obligations concern you, and where the biggest gaps are.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1c98491 elementor-widget elementor-widget-button\" data-id=\"1c98491\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/safewave.ai\/en\/#SafeWave-get-in-touch\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-icon\">\n\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-arrow-circle-right\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8c137 0 248 111 248 248S393 504 256 504 8 393 8 256 119 8 256 8zm-28.9 143.6l75.5 72.4H120c-13.3 0-24 10.7-24 24v16c0 13.3 10.7 24 24 24h182.6l-75.5 72.4c-9.7 9.3-9.9 24.8-.4 34.3l11 10.9c9.4 9.4 24.6 9.4 33.9 0L404.3 273c9.4-9.4 9.4-24.6 0-33.9L271.6 106.3c-9.4-9.4-24.6-9.4-33.9 0l-11 10.9c-9.5 9.6-9.3 25.1.4 34.4z\"><\/path><\/svg>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Schedule a Gap Analysis<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<aside class=\"elementor-element elementor-element-f087df3 e-flex e-con-boxed e-con e-parent\" data-id=\"f087df3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c292d6c elementor-widget elementor-widget-text-editor\" data-id=\"c292d6c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-h\">Sources<\/p><ol class=\"sw-src-list\"><li id=\"przypis-1\"><a href=\"https:\/\/www.gov.pl\/web\/cyfryzacja\/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-zaczyna-obowiazywac\" target=\"_blank\" rel=\"noopener\">Ministry of Digital Affairs, \u201cAmendment to the National Cybersecurity System Act enters into force\u201d<\/a><\/li><li id=\"przypis-2\"><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2022\/2554\/oj\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2022\/2554 (DORA)<\/a><\/li><li id=\"przypis-3\"><a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\" target=\"_blank\" rel=\"noopener\">Directive (EU) 2022\/2555 (NIS2)<\/a><\/li><li id=\"przypis-4\"><a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cyber-resilience-act\" target=\"_blank\" rel=\"noopener\">European Commission, Cyber Resilience Act<\/a>; <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2024\/2847 (CRA)<\/a><\/li><li id=\"przypis-5\"><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2024\/1689 (AI Act)<\/a>; <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2026\/1744\/oj\/eng\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2026\/1744 (Digital Omnibus on AI)<\/a><\/li><li id=\"przypis-6\"><a href=\"https:\/\/www.iso.org\/standard\/42001\" target=\"_blank\" rel=\"noopener\">ISO\/IEC 42001 \u2013 AI management system<\/a><\/li><li id=\"przypis-7\"><a href=\"https:\/\/www.iso.org\/standard\/27001\" target=\"_blank\" rel=\"noopener\">ISO\/IEC 27001 \u2013 Information security management system<\/a><\/li><\/ol><p class=\"sw-asof\">Status as of November 7, 2026. This page does not constitute legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/aside>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-16274","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Compliance and Audits &#8211; SafeWave<\/title>\n<meta name=\"description\" content=\"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/safewave.ai\/en\/compliance-and-audits\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Compliance and Audits &#8211; SafeWave\" \/>\n<meta property=\"og:description\" content=\"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/safewave.ai\/en\/compliance-and-audits\/\" \/>\n<meta property=\"og:site_name\" content=\"SafeWave\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T14:16:16+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/compliance-and-audits\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/compliance-and-audits\\\/\",\"name\":\"Compliance and Audits &#8211; SafeWave\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\"},\"datePublished\":\"2026-11-07T10:20:12+00:00\",\"dateModified\":\"2026-11-09T14:16:16+00:00\",\"description\":\"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/compliance-and-audits\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/safewave.ai\\\/en\\\/compliance-and-audits\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/compliance-and-audits\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Compliance and Audits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"name\":\"SafeWave\",\"description\":\"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud\",\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"alternateName\":\"SafeWave sp. z o.o.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/safewave.ai\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\",\"name\":\"SafeWave\",\"alternateName\":\"SafeWave sp. z o.o.\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"contentUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"width\":350,\"height\":270,\"caption\":\"SafeWave\"},\"image\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/safewave-ai\",\"https:\\\/\\\/www.youtube.com\\\/@SafeWaveAI\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Compliance and Audits &#8211; SafeWave","description":"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/safewave.ai\/en\/compliance-and-audits\/","og_locale":"en_US","og_type":"article","og_title":"Compliance and Audits &#8211; SafeWave","og_description":"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.","og_url":"https:\/\/safewave.ai\/en\/compliance-and-audits\/","og_site_name":"SafeWave","article_modified_time":"2026-11-09T14:16:16+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/safewave.ai\/en\/compliance-and-audits\/","url":"https:\/\/safewave.ai\/en\/compliance-and-audits\/","name":"Compliance and Audits &#8211; SafeWave","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/#website"},"datePublished":"2026-11-07T10:20:12+00:00","dateModified":"2026-11-09T14:16:16+00:00","description":"Compliance and Audits: NIS2 and the KSC Act, DORA, CRA, AI Act and AI governance, manual penetration tests \u2013 gap analysis, implementation plan, and audit readiness.","breadcrumb":{"@id":"https:\/\/safewave.ai\/en\/compliance-and-audits\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/safewave.ai\/en\/compliance-and-audits\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/safewave.ai\/en\/compliance-and-audits\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/safewave.ai\/en\/"},{"@type":"ListItem","position":2,"name":"Compliance and Audits"}]},{"@type":"WebSite","@id":"https:\/\/safewave.ai\/en\/#website","url":"https:\/\/safewave.ai\/en\/","name":"SafeWave","description":"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud","publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"alternateName":"SafeWave sp. z o.o.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/safewave.ai\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/safewave.ai\/en\/#organization","name":"SafeWave","alternateName":"SafeWave sp. z o.o.","url":"https:\/\/safewave.ai\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/","url":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","contentUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","width":350,"height":270,"caption":"SafeWave"},"image":{"@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/safewave-ai","https:\/\/www.youtube.com\/@SafeWaveAI"]}]}},"_links":{"self":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/comments?post=16274"}],"version-history":[{"count":4,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16274\/revisions"}],"predecessor-version":[{"id":16503,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16274\/revisions\/16503"}],"wp:attachment":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/media?parent=16274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}