Regulations and compliance¶
Four EU regulations shape how a hardware company is expected to handle security and AI. This page says what each one means when you use Colleag, and what Colleag provides so you can meet your side of it. It is written for whoever answers the security questionnaire — not for lawyers.
For where your data lives and who holds the keys, see Deployment and data security.
NIS2 — in Sweden the Cybersecurity Act, since January 2026¶
Medium and large companies in essential sectors — including manufacturing of machinery, vehicles and electronics — must work systematically with security, report serious incidents within 24 hours, and put requirements on their suppliers. If that is you, Colleag is one of those suppliers.
What Colleag provides: a documented incident routine with a commitment to inform affected customers within 24 hours of a confirmed incident involving their data — so your own reporting clock can be met. Our security posture (tenant isolation, access control, logging) is documented and can be referenced in your supplier assessment.
GDPR¶
Names in documents and conversations are personal data, so GDPR applies as soon as your team uses Colleag. You are the controller; Colleag is a processor.
What Colleag provides: a data processing agreement (PUB-avtal) as part of the customer agreement, a list of sub-processors (such as Microsoft Azure and Anthropic), and incident reporting without undue delay so you can notify the authority within your 72-hour deadline. At contract end, your content is exported or deleted — every document is a plain file in a Git repository you control (see Deployment and data security).
EU AI Act¶
Obligations depend on risk class. Colleag drafts documents that a person reviews and publishes — human review is the working model, not an add-on — so use of Colleag falls in the lowest class for you as a user organisation. What remains is transparency (it must be clear that you are interacting with AI — it is, and it says so) and basic AI literacy for staff: knowing what the colleagues can and cannot do. This manual is part of meeting that. Obligations on the language model itself rest with Anthropic.
Cyber Resilience Act (CRA)¶
Applies to products with digital elements sold in the EU — software and connected hardware. Manufacturers must build in security, manage vulnerabilities across the lifecycle, produce a software bill of materials (SBOM), and report actively exploited vulnerabilities. Reporting applies since September 2026; the remaining obligations from December 2027.
What Colleag provides: this mostly concerns your products — and the CRA monitoring module exists for exactly that: SBOM upload, a daily vulnerability check against the NVD, and early-warning drafts for your connected products. Ask your admin whether the module is enabled for your organisation.
Questions a questionnaire asks that this page does not answer: ask your Colleag contact — the answer usually exists in written form.