For more than 150 products, several sites or group companies, or requirements beyond the listed plans. Scope, price and contract terms are agreed before activation.
Business prices exclude applicable taxes · Billed monthly in advance. Taxes and the final total are shown before payment. Credit card · Apple Pay · Google Pay. There is no setup fee: the first invoice is one monthly fee. The workspace opens once the first invoice is paid. Full plan details and support terms (English)
Optional AI document drafts are currently enabled within the available budget. When AI is unavailable, a template draft is created. Your team reviews and approves every draft.
Not happy within 30 days of your first payment? Email us for a refund of that payment under our guarantee terms. Guarantee terms
Our 30-day money-back guarantee
If Attesly is not right for your team, the account owner emails [email protected] within 30 days of your first payment. We refund that first payment under our guarantee terms. A short email is enough; you don't need to give a reason. The guarantee applies once per business, to the first payment of its first subscription.
The refund goes back to the payment method you used, through Stripe; we confirm it personally by email. With the refund the subscription ends; you can export your data first. The binding wording is section 11a of the Terms of Service, a voluntary guarantee by Neithra Technologies, the company behind Attesly.
If your product carries software and your name, this is yours.
The Regulation binds everyone who brings a product with digital elements to the EU market. Most of the weight sits with the manufacturer; importers and distributors carry duties of their own, and the conformity route follows the product’s class.
Manufacturers — hardware with firmware, and software vendors
Anyone who develops or manufactures a product with digital elements, or has it designed, developed or manufactured, and markets it under their own name or trademark — whether for payment, for monetisation or free of charge (Art. 3(13)). That includes software vendors, and any importer or distributor that places a product on the market under its own name or trademark, or substantially modifies one already placed on the market (Art. 21).
They owe the essential requirements, the technical file, the EU declaration of conformity, the CE marking, the support period, vulnerability handling and the Article 14 reports.
Importers and authorised representatives
An importer checks that the manufacturer has carried out the conformity assessment and drawn up the technical documentation, indicates its own name and contact details, and keeps the declaration for ten years or the support period, whichever is longer (Art. 19).
A vulnerability it becomes aware of goes to the manufacturer without undue delay, and where the product presents a significant cybersecurity risk, immediately to the market surveillance authorities of the Member States where it has made the product available. A product it knows or has reason to believe is non-conforming calls for immediate corrective measures, and withdrawal or recall if appropriate (Art. 19(5)). An authorised representative holds the file at the authorities’ disposal on the manufacturer’s mandate (Art. 18).
Distributors
Before making a product available, a distributor verifies that it bears the CE marking and that the manufacturer and importer have met a closed list of duties: product identification, contact details, the user instructions, the stated end of the support period and the declaration of conformity supplied with the product (Art. 20(2)). The necessary documents must also have been provided to the distributor.
Where a distributor considers, or has reason to believe on the basis of information in its possession, that a product is not in conformity, it does not make that product available until it has been brought into conformity (Art. 20(3)). A vulnerability it becomes aware of goes to the manufacturer without undue delay, and where the product presents a significant cybersecurity risk, immediately to the market surveillance authorities of the Member States where it has made the product available (Art. 20(4)).
Not in scope: a cloud service that is not part of a product; products covered by their own Union rules — medical devices, motor vehicles and marine equipment; civil aviation products certified under Regulation (EU) 2018/1139; and products developed or modified exclusively for national security or defence, or specifically designed to process classified information (Art. 2(2)–(4) and (7); Art. 3(1) and (2)). For edge cases, check the Regulation’s scope with counsel.
The conformity route follows the product’s class.
Annex III lists the important products in two classes, Annex IV the critical ones; everything else is default. Article 32 sets the procedure for each and where a notified body comes in.
Default
Every product not listed in Annex III or IV. Internal control by the manufacturer (Module A), with no notified body involved.
Important, class I
Module A only where harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least ‘substantial’ are applied in full. Otherwise a notified body is involved (Art. 32(2)).
Important, class II
Assessed by a notified body — EU-type examination with conformity to type (Modules B and C), or full quality assurance (Module H). A European cybersecurity certificate at assurance level at least ‘substantial’ takes its place where a scheme the Commission has specified is available and applicable (Art. 32(3)).
Critical
A European cybersecurity certificate at assurance level at least ‘substantial’ — but only for the categories the Commission has made subject to one by delegated act (Art. 8(1)). Until such an act is adopted, the class II procedure applies (Art. 32(4)).
Regulation (EU) 2024/2847, Art. 7–8, Art. 32, Annexes III, IV, VIII — classification stays the manufacturer’s own assessment.
Questions
What counts as a product?
One product with digital elements that you place on the market under one name — a device family sharing firmware, an app, a software product. Variants that share one firmware and one technical file count as a single product; a variant with its own technical file counts as another.
Is there a per-seat price?
No. Engineering, compliance, legal and management use the same workspace; the plan is priced by the products it holds. Guests (a notified body’s reviewer, an importer) read trust pages and exported files, not the workspace.
Can I explore Attesly before buying?
Explore Attesly in the live demo and the product examples. For questions, start a chat or book a call. Your own workspace opens after payment confirmation.
What is the readiness score?
A completeness score out of 100, weighted by how much of the record each check covers. Which checks apply follows your role in the supply chain and the conformity assessment route your product takes; the weights are ours, not the Regulation’s — every Annex I requirement and Article 13 obligation applies whatever weight it carries here. An aid computed from your own inputs: nothing is verified against your product, and it is not a conformity assessment. Where a product was placed on the market before 11 December 2027 and has not since been substantially modified, the checks Art. 69(2) has not yet reached are marked as deferred and still counted — the record is either complete or it is not, and a deferred duty starts on the day of a modification with no grace period. Where an Art. 2 answer puts the product outside this Regulation altogether, there is no checklist and no percentage: the record states the excluding article instead. Typical checks: classification and conformity route, SBOM imported and scanned, no open critical or actively exploited findings, Annex I requirements addressed, support period, technical documentation, EU declaration of conformity, user information, CE marking, security contact, a published coordinated vulnerability disclosure policy and registration on the ENISA reporting platform.
How does Attesly support our conformity assessment?
Attesly computes deadlines, tracks evidence and drafts documents from your data. Your team reviews the results, performs the conformity assessment and makes the declaration. Where a notified body is involved, the record gives it a starting point: your drafted technical file, the declaration and your evidence notes. The design, test and quality-system evidence it examines beyond that is yours to produce.
Where is the data hosted?
Hosting provider: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data centre Nuremberg, Germany). Hosting region: EU (Germany). See the privacy notice and data processing agreement for processing locations and recipients.
How do I order and pay?
Choose your plan and pay securely with a credit card, Apple Pay or Google Pay. There is no setup fee. Plans are billed monthly in advance. Prices are for businesses and exclude applicable taxes. Your currency and final total are shown before payment. Your workspace opens after payment confirmation.
Is there a money-back guarantee?
If Attesly is not right for your team, the account owner emails [email protected] within 30 days of your first payment. We refund that first payment under our guarantee terms. A short email is enough; you don't need to give a reason. The guarantee applies once per business, to the first payment of its first subscription. The refund goes back to the payment method you used, through Stripe; we confirm it personally by email. With the refund the subscription ends; you can export your data first. The binding wording is section 11a of the Terms of Service, a voluntary guarantee by Neithra Technologies, the company behind Attesly.
