Requirements that apply to Xertified
Laws and standards that apply to us
This page shows which laws and standards apply to Xertified as a company and to XoT as a product. We separate what is certified from what applies to us.
At a glance
Status in October 2026
Certified means that an independent body has assessed us or the product. A rule that applies to us places obligations on us, and we meet them.
XoT-S1 is CE-marked, and we report under the Cyber Resilience Act. We hold no other third-party certification today.
| Framework | Xertified (company) | XoT (product) | Status |
|---|---|---|---|
| NIS2 and the Swedish Cybersecurity Act | Not in scope, below the size threshold | – | Supplier requirements from covered customers met by contract |
| Cyber Resilience Act | Applies, as manufacturer | Applies. XoT-Lock and XMS are Class I | Reporting since 11 September 2026. All requirements from 11 December 2027 |
| CE marking | Applies | XoT-S1 | CE-marked. EMC tested to EN 55032 Class B and EN 55035 |
| Machinery Regulation | Does not apply | XoT is not machinery | – |
| GDPR | Applies | XMS processes identities and access logs | XMS hosted in Sweden by default |
| ISO/IEC 27001 | Not certified | Does not apply to products | Certification planned |
| IEC 62443 | Part 4-1 is our reference for development | Not certified | No level claimed |
| FIPS 140 | – | WireGuard is not validated | Not validated |
| EU GMP Annex 11 and 21 CFR Part 11 | Do not apply | Not a GMP system. Qualified as infrastructure | Supplier assessment material on request |
NIS2
NIS2 and the Swedish Cybersecurity Act
In Sweden, NIS2 applies through the Cybersecurity Act (2025:1506) and the Cybersecurity Ordinance (2025:1507). Both have applied since 15 January 2026.
Is Xertified in scope?
No. Manufacturing of electronic products is one of the sectors covered. But it only applies to companies with at least 50 employees or a turnover above EUR 10 million. Xertified is below that threshold.
We still apply the measures in Article 21 to our own operations. Our customers depend on them.
What you get from us as a supplier
Point (d) of Article 21(2) covers supply-chain security. As your supplier, we provide:
- our description of quality work, a software bill of materials (SBOM) and penetration-test reports
- coordinated vulnerability disclosure and reporting under the Cyber Resilience Act
- notice of vulnerabilities and incidents in our products that affect you
- contract terms on security requirements, incident notification and audit rights, if you want them
Cyber Resilience Act
Cyber Resilience Act
The regulation applies to us as the manufacturer of XoT. Our reporting obligations have applied since 11 September 2026, and we meet them. The other requirements apply from 11 December 2027. We are working towards them.
| Date | What applies |
|---|---|
| 10 December 2024 | Regulation (EU) 2024/2847 enters into force. |
| 11 June 2026 | Rules for the bodies that assess products. |
| 11 September 2026 | Manufacturers report actively exploited vulnerabilities and severe incidents. This also covers products already on the market. |
| 11 December 2027 | All other requirements, such as CE marking under the regulation and the EU declaration of conformity. |
XoT-Lock and XMS are Class I
The regulation lists important products in an annex. A product is classified by its core functionality. Implementing Regulation (EU) 2025/2392 describes the products in more detail.
Our assessment is that XoT-Lock and XMS fall under Annex III, Class I. XoT-Lock has a VPN function. XMS manages identities and access and manages networks.
As of October 2026, no harmonised standard for the regulation has been published. Without one, Class I products must be assessed by a notified body. A notified body is an independent organisation that assesses products. We will state our conformity route in our EU declaration of conformity by 11 December 2027.
What we commit to
- Security by design and secure default settings.
- A five-year support period with free security updates.
- A free move to a patched long-term release, for every customer.
- A software bill of materials (SBOM) for each release. It covers at least the top-level dependencies.
- A coordinated vulnerability disclosure policy and a single point of contact: security@xertified.com.
- Reporting to ENISA within 24 hours, and informing affected users.
- Technical documentation and an EU declaration of conformity by 11 December 2027.
Read about updates and support
How we report
We report through ENISA's single reporting platform. ENISA is the EU agency for cybersecurity. The process is documented, and our staff are trained on it every year. Our CTO is the single point of contact.
| Event | Early warning | Notification | Final report |
|---|---|---|---|
| Actively exploited vulnerability | 24 hours | 72 hours | 14 days after a fix is available |
| Severe incident affecting product security | 24 hours | 72 hours | 1 month |
We also inform affected customers and partners. We tell them how to limit the impact.
CE marking
CE marking and other regulations
| Regulation | Status |
|---|---|
| EMC Directive 2014/30/EU | XoT-S1 passed EN 55032:2015 (Class B), EN 55035:2017, EN 61000-3-2:2014 and EN 61000-3-3:2013. Testing was done in December 2020 at a DAkkS-accredited laboratory. Class B means it suits residential as well as industrial environments. XoT-S1 is CE-marked. |
| Low Voltage Directive | Does not apply to XoT-S1, which runs at 5 V DC. |
| Radio Equipment Directive | Does not apply, as XoT-S1 has no radio. When XoT-Lock runs on Teltonika hardware, Teltonika is the hardware manufacturer. |
| Machinery Regulation | Does not apply, as XoT is not machinery. Machine builders who integrate XoT get a product description for their technical file on request. |
| Cyber Resilience Act | From 11 December 2027, CE marking also covers the regulation. |
| GDPR | XMS processes user identities and access logs. When we host the XMS for you, we act as processor. Data stays in Sweden by default. |
| EUCC | The EU Common Criteria scheme is voluntary. XoT is not EUCC-certified. |
| FIPS 140 | WireGuard's algorithms are not FIPS 140-validated. If you require FIPS, contact us before choosing XoT. |
Certifications
ISO 27001 and IEC 62443
ISO/IEC 27001
Xertified is not ISO/IEC 27001 certified today. We plan to certify our information security management system. The standard certifies organisations, not products.
IEC 62443
XoT is not certified to IEC 62443. Our development follows the practices in part 4-1, which covers secure product development. We claim no maturity level and no security level.
Life science
Supplier to life science
XoT creates and stores no GMP data and no FDA-regulated records. So XoT is neither a GMP system nor a 21 CFR Part 11 system. You qualify XoT as part of your infrastructure. You do not validate it as a computerised GMP system.
For your supplier assessment you get Quality at Xertified, an SBOM and penetration-test reports. You also get a description of logging and telemetry in XMS.
One long-term release a year makes it easier to plan changes and requalification. XMS keeps the connection log and the audit log for up to 36 months. For longer retention, send the logs to your SIEM or archive.
We follow new and changing regulation that may affect us. This page is updated when our status changes. It is our reading of the regulations, not legal advice.
Need documentation?
We are happy to send what you need to assess us as a supplier.