NIS2, CRA and the AI Act in one clear record
Every week, Triconform shows you what needs doing. It tracks deadlines and turns the work you do into evidence for management, customers and inspections. It is built for companies where one or two people look after cybersecurity alongside their day job.
30-day trial access free of charge, with no commitment. We set up access on request – write to us and we will reply within 2 working days. Already have an account? Log in.
- Hosted in the EU
- Two-step verification for everyone
- No AI in the product
- No tracking on this website
What you will have done in the first week
You do not start with an empty spreadsheet. Triconform guides you step by step and shows straight away what is missing.
You know your obligations
The “What obligations do we have” guide goes through your situation: NIS2 essential or important regime, products under the CRA, AI tools.
You have a list of measures
A catalogue of measures under the decree, each with a place for evidence. You see what is done and what is not.
You monitor suppliers and software
Upload your suppliers and the software you use, for example from Excel. Triconform starts watching for vulnerabilities and end of support.
Deadlines are in your calendar
Export tasks, reminders and deadlines to your own calendar (.ics). Nothing slips through.
What to deal with this week
After logging in you see one screen: what needs doing now, this week and what can wait. No digging through spreadsheets and e-mails.
We alert you immediately only when a vulnerability is already being actively exploited. Everything else comes once a week in a summary.
Example of the “This week” screen (illustrative data)
- NowA component in a product has an actively exploited vulnerability. A recommended version is available and the reporting deadline is running.
- This weekThe contract with the cloud supplier has no security clauses.
- This weekThree employees have not yet confirmed they have read the policy.
- Within 60 daysSupport for the operating system on two servers is ending.
- Within 60 daysAnnual approval of the measures overview by management.
Three areas of obligations and your software in one place
One record, one audit trail, shared tasks and deadlines. You use only what applies to you.
NIS2 and DORA
Which obligations apply, a catalogue of measures with evidence and annual management approval, incidents and reports at 24 h / 72 h / 30 days, policies, suppliers, assets and risks.
Organisation areaCRA
Products and versions, SBOM, vulnerability monitoring with a recommended version, reports at 24 h / 72 h / 14 days, VEX, technical documentation inputs and a manufacturer security page.
Product areaAI Act
A register of the AI tools your company uses, an indicative classification guide, staff AI literacy, transparency and a PDF overview.
AI areaSoftware you use
Even a company that makes nothing monitors vulnerabilities and end of support in the software it runs on – even when you do not know the exact version.
Software you useEvidence for customers and inspections
A customer sends a security questionnaire? An inspection wants to see what you have done? Prepare the evidence from what is already in your record.
Customer evidence report
A PDF with the status of measures without sensitive details, products with their support period and a contact for reporting vulnerabilities. Marked with the recipient and a verification code.
Integrity and time
Every record goes into a chained log with a timestamp. A later change can be detected. Anyone can check a document on the verification page.
Offline verification package
For an inspection or audit you get a package that can be verified without access to Triconform.
Triconform keeps records, reminds you and prepares inputs. Your company decides whether a measure is sufficient. It does not issue declarations of conformity and does not submit reports for you.
Security you would expect from your own suppliers
- hosted in the EU (Hetzner, Germany), encrypted backups,
- sensitive data encrypted with your organisation’s key,
- two-step verification is mandatory for all users,
- organisations are separated in the database,
- in “Operator access” you see who from our side accessed your data and why,
- no AI in the product – your data does not go to any AI service.
What you need to do, and by when
| Regulation | Obligation | From |
|---|---|---|
| CRA – Regulation (EU) 2024/2847 | reporting actively exploited vulnerabilities and severe incidents (Art. 14) | 11 Sep 2026 (already applies) |
| CRA | other obligations of manufacturers of products with digital elements | 11 Dec 2027 |
| NIS2 in Czechia – Act No. 264/2025 Coll. | implementing security measures (Decree No. 409/2025 or 410/2025 Coll.) | within 1 year of the registration decision |
| NIS2 in Czechia | reporting cybersecurity incidents | from registration |
| AI Act – Regulation (EU) 2024/1689 | AI literacy of staff (Art. 4) | 2 Feb 2025 (already applies) |
| AI Act | high-risk AI under Annex III (e.g. recruitment and HR) | 2 Dec 2027 |
Legal status as of 30 October 2026. This overview is for information only and is not legal advice.
Frequently asked questions
Will Triconform mean our obligations are met?
Not automatically. Triconform shows what needs doing, tracks deadlines and keeps evidence of what you have done. You decide whether it is sufficient. It does not issue declarations of conformity – the manufacturer signs the EU declaration of conformity. For legal interpretation, ask a lawyer.
Do you submit reports for us?
No. Triconform tracks deadlines, helps you assess the significance of an incident and prepares the content of the report in the structure the authority requires. You submit it – for NIS2 on the authority’s portal, for the CRA via the ENISA platform. Your organisation is responsible for submitting on time.
We do not make any products. Is it still useful?
Yes. You do not have to use the Product area. A company without its own products uses the Organisation area and monitors the software it uses – vulnerabilities, end of support and a weekly summary.
One person handles cybersecurity for us. Can they manage it?
That is who Triconform is built for. The “This week” screen shows only what is needed now. Large companies have expensive in-house tools and teams – Triconform is for everyone else.
Where is our data and who can see it?
The application runs in the EU (Hetzner, Germany). Only your users see your data. The operator’s support can access it read-only, only with your consent, and you see every such access in “Operator access”. Details on the Security and data protection page.
Does Triconform use artificial intelligence?
No. Vulnerability matching, guides and texts are fixed rules and content prepared with cybersecurity experts. The results are explainable and repeatable, and your data stays where it is.
How much does it cost?
Annual subscription from CZK 9,900 excluding VAT. The price depends on the size of your company and how many areas you use – see pricing. The 30-day trial is free.
Can we leave and take our data with us?
Yes. You can export your data at any time. Documents you have issued remain verifiable without Triconform.
Try Triconform with your own data
30-day trial access free of charge, with no commitment. Write to us and we will set up your access within 2 working days – or book a short demo first.