PRODUCE · v1.0
Twenty things a European buyer will ask you to produce, and whether you can
Every check asks one thing: on the day a regulated buyer asks, can you hand it over? Not whether a policy exists.
| Score | Meaning |
|---|---|
| 0 | Cannot produce it, or would have to build it first. |
| 1 | Can produce it with work, inside the time the buyer allows. |
| 2 | Exists now, and can be handed over on demand. |
| Band | What it means for a regulated buyer |
|---|---|
| 44–52 | Ready. The file survives a supervisor reading it. |
| 31–43 | Sellable, with a remediation plan attached to the contract. |
| under 31 | Not yet contractible for a critical or important function. |
13 checks are knock-outs. A zero on any of them stops the assessment, whatever the total. They are marked in the list.
Before anything is signed, the buyer has to be able to enter you in a register a supervisor can read.
1. Can you produce a valid, active LEI, or an EUID?
Financial entities shall use a valid and active legal entity identifier (LEI) or the European Unique IdentifierITS REGISTRE 2024-2956
What counts as evidence The identifier itself, with its renewal date. An expired LEI is a missing LEI.
What to produce Your LEI certificate with its renewal date, or the EUID from your national register. Renewal is annual and lapses silently.
2. Can you name every subcontractor that effectively underpins the service, not just the ones you contract with directly?
information on all subcontractors that effectively underpin ICT services supporting critical or important functions or material parts thereofITS REGISTRE 2024-2956
What counts as evidence A written chain, per service, down to the layer that would stop the service if it failed.
What to produce One table per service: every subcontractor that would stop it, what they do, and where they sit. Depth is decided by dependency, not by contract.
3. Can you obtain the LEI or EUID of those subcontractors when your client asks for them?
What counts as evidence Either the identifiers, or the clause in your own supplier contracts that lets you demand them.
What to produce A clause in your own supplier contracts obliging them to give you their LEI or EUID on request. Add it at the next renewal.
The buyer cannot sign what it cannot evidence to its supervisor.
4. Is your full contract, service levels included, in one written document?
The full contract shall include the service level agreements and be documented in one written documentDORA 2022-2554
What counts as evidence One executed document. Service levels living on a web page you can edit do not qualify.
What to produce One executed PDF containing the terms and the service levels. If your SLAs live on a page you can edit, they are not in the contract.
5. Are the rights and obligations of each party allocated in writing, rather than implied?
The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writingDORA 2022-2554
What counts as evidence The clause that does the allocating, quoted by number.
What to produce A two-column table: obligation, and which clause allocates it. Anything with an empty second column is unallocated.
6. Does your contract carry every mandatory element, or only the ones you were asked about?
The contractual arrangements on the use of ICT services shall include at least the following elementsDORA 2022-2554
What counts as evidence A clause-by-clause mapping against the list. Not a statement that you comply.
What to produce A clause-by-clause map against the Article 30(2) list. Where a clause is missing, draft it now rather than in the negotiation.
7. Can the client leave without disruption, and can you show how?
For ICT services supporting critical or important functions, financial entities shall put in place exit strategiesDORA 2022-2554
What counts as evidence A written exit plan with a transition period, a data return format, and who does what.
What to produce An exit plan naming the transition period, the data return format, who runs the migration, and what it costs. Two pages is enough.
8. Does your runbook start the vulnerability clock when the fix exists, rather than when you found out?
no later than 14 days after a corrective or mitigating measure is availableCRA 2024-2847
What counts as evidence The runbook, with the trigger written on it.
What to produce One line in the runbook: the clock starts when a corrective or mitigating measure is available. Not at discovery.
9. Does your runbook use a separate, longer clock for severe incidents?
within one month after the submission of the incident notificationCRA 2024-2847
What counts as evidence Two tracks in one document, not one row saying CRA.
What to produce A second track in the same runbook, with its own clock, running one month from the 72-hour notification.
10. If you have no establishment in the Union, can you name the CSIRT that receives your report, and say why it is that one?
What counts as evidence The reasoning written down before the incident, not decided during it.
What to produce A written note, decided in advance, naming the CSIRT and the reason. During an incident is the wrong moment to reason about it.
11. Is there a contact address for reporting vulnerabilities that does not require an account?
providing a contact address for the reporting of the vulnerabilitiesCRA 2024-2847
What counts as evidence The address, reachable by a researcher who has never met you.
What to produce A reporting address published where a researcher can find it, reachable without an account.
12. Can you produce a software bill of materials for the components you ship?
a formal record containing details and supply chain relationships of components included in the software elements of a productCRA 2024-2847
What counts as evidence The file, at the depth you actually ship, not a list of your direct dependencies.
What to produce An SBOM at the depth you ship, refreshed at each release. Direct dependencies are not the supply chain.
13. Does your technical documentation exist, and would it survive being read by someone who did not build the product?
The technical documentation shall contain all relevant data or details of the means used by the manufacturerCRA 2024-2847
What counts as evidence The file itself. Its existence is the check.
What to produce The technical file, written so a stranger can follow it. If nobody outside the team can read it, it does not exist.
14. Is the end date of the support period given to the user, as a date?
What counts as evidence The date, where a buyer can see it before purchase. "At least five years" is not a date.
What to produce The end date of the support period, as a date, visible before purchase.
15. Do you have a published coordinated vulnerability disclosure policy?
put in place and enforce a policy on coordinated vulnerability disclosureCRA 2024-2847
What counts as evidence The published policy, with its address.
What to produce A published disclosure policy with its address, and the response times you actually intend to hold.
16. If your system generates text, image, audio or video, are the outputs marked in a machine-readable format?
marked in a machine-readable format and detectable as artificially generated or manipulatedAI ACT 2024-1689
What counts as evidence The marking, verifiable by a third party. Not a sentence in your terms of use.
What to produce The marking, verifiable by a third party. Terms of use are not a marking.
17. Were you on the market before 2 August 2026, and do you know the date that gives you?
shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026OMNIBUS IA 2026-1744
What counts as evidence The date in your plan. It is not in the AI Act, which is why it is missed.
What to produce The date in your plan, and the person who owns it. It is in the amending regulation, not the AI Act, which is why it is missed.
18. Do you keep the logs your system generates, and can you hand them over?
keep the logs automatically generated by their high-risk AI systemsAI ACT 2024-1689
What counts as evidence The retention period, the format, and who can extract them.
What to produce A written retention rule: how long, in what format, and who can extract the logs without help from engineering.
19. Do you know that from 9 December 2026 your software is a product, and that liability no longer requires fault?
it includes electricity, digital manufacturing files, raw materials and softwareRESP PRODUITS 2024-2853
What counts as evidence Evidence that the question has been put to whoever signs your contracts.
What to produce Evidence that whoever signs your contracts has been told. From 9 December 2026 the question stops being technical.
20. If a claimant makes a plausible claim, can you disclose the evidence a court will order you to disclose?
the defendant is required to disclose relevant evidence that is at the defendant's disposalRESP PRODUITS 2024-2853
What counts as evidence Knowing where it is, and that it still exists. Disclosure is not optional.
What to produce An index of where the evidence is and how long it is kept. Disclosure is ordered, not requested.
21. Can you name the people who exercise human oversight, and show they had the authority to say no?
shall assign human oversight to natural persons who have the necessary competence, training and authorityAI ACT 2024-1689
What counts as evidence Names, the training they received, and the written delegation that lets them refuse. A job title is not authority.
What to produce A dated, named list, with the training record and the written delegation to refuse. Oversight assigned to a function rather than to people cannot be evidenced afterwards.
22. On one given file, can you show what the reviewer saw, and that they could have refused?
to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the outputAI ACT 2024-1689
What counts as evidence One file, reconstructed: system version, the output presented, who looked, what they changed. A procedure states what should happen. It does not evidence what did.
What to produce Record, per file, the system version, the output presented, the reviewer and the action taken, then measure how often the output is changed. An override rate at or near zero is the finding, not the reassurance.
These four are not oversights. Two texts ask for different things about the same object, on the same contract. No single-regulation tool can show you this, because it only holds one of the texts.
23. How deep does your supply chain map go, and does one map satisfy both texts?
supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providersNIS2 2022-2555
information on all subcontractors that effectively underpin ICT services supporting critical or important functions or material parts thereofITS REGISTRE 2024-2956
What counts as evidence One map, at the deeper of the two depths. A first-tier map fails the register.
What to produce A single supply chain map built to the register's depth, every subcontractor that would stop the service, with its LEI or EUID. NIS 2 stops at your direct suppliers. Build to the deeper standard once, and both are answered.
24. For how long do you owe security updates, and for how long do you answer for the defect?
the support period shall be at least five yearsCRA 2024-2847
an injured person is no longer entitled to compensation pursuant to this Directive upon the expiry of a period of 10 yearsRESP PRODUITS 2024-2853
What counts as evidence The two dates, side by side, for the same product.
What to produce Put both dates in the technical file. There is a gap of at least five years, and up to twenty in the latent injury case, during which you answer for a product you have stopped patching. Either the support period is extended, or the end-of-support notice states plainly what stops and what does not.
25. If you sell software as a service, which of the two texts holds you?
cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall within the scope of this RegulationCRA 2024-2847
it includes electricity, digital manufacturing files, raw materials and softwareRESP PRODUITS 2024-2853
What counts as evidence A written scope decision, per offering, naming both texts.
What to produce A one-page scope note per offering. Being outside the CRA is not being outside liability. The product liability regime names software-as-a-service in its recitals, and applies without fault from 9 December 2026.
26. Human review is your control. Which of the two texts is already asking you to prove it, and since when?
they can be effectively overseen by natural persons during the period in which they are in useAI ACT 2024-1689
at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decisionRGPD 2016-679
What counts as evidence One dated answer per system, to two separate questions: is it high-risk, and does it decide about a person. The answers differ, and so do the dates.
What to produce Answer both, per system, in writing. The AI Act duty reaches high-risk systems only, and for Annex III it applies from 2 December 2027. The data protection duty reaches any decision about a person, it has applied since 2018, and it never asks whether the system is high-risk. A system that escapes the first still owes provable human intervention under the second. Build the record once, to the earlier date.