- "May apply", never "applies". Each result names a framework that may apply, gives the reason in the framework's own scope wording, links the source and the framework page, and ends with "check with your adviser".
- The mapping rests on the primary texts, each checked on 7 Oct 2026: DORA Art. 2(1) and 2(3); NIS2 Art. 2(1), 2(2), 21(2)(c) and (d) and Annexes I and II; the SME definition in Recommendation 2003/361/EC; CRA Art. 2(1) and 3(13); AI Act Art. 2(1); PRA SS2/21 para 1.2; CPS 230 para 2; the FFIEC's own description of its role; ESMA's principles page; the Dutch Staatsblad for the Cbw. Sources are listed on the page and in the report.
- The result is on screen, with no email gate. If marketing wants the lead, add an optional "Email me this result" form under the result.
Which frameworks may apply to you?
Four questions about your organisation and what you sell. The scan points to the frameworks that may apply, with each one's scope in its own words. It's a starting point, not legal advice.
Free, and no email needed for your result. Start the scan
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Every scope rule linked to its source
- Mapping: EU financial entity → DORA (Art. 2(1)(a)–(t)); EU securities-markets firm → DORA and ESMA; ICT supplier to financial firms → DORA Art. 2(1)(u) and the customer's exit-plan duty (Art. 28(8)); UK PRA firm → SS2/21 (para 1.2); US bank or credit union → FFIEC; APRA-regulated entity → CPS 230 (para 2); NIS2 sector and size → NIS2 (Art. 2(1)); NIS2 sector but small → NIS2 Art. 2(2) cases; supplier to NIS2 sectors → Art. 21(2)(d); the Netherlands → Cbw; products with digital elements → CRA (Art. 2(1), 3(13)); AI provider or deployer → AI Act (Art. 2(1)(a), (b)); customer asks → ISO/IEC 27001, SOC 2, ISO 22301 (voluntary).
- Fact-check, 7 Oct: rechecked against the primary texts: DORA Art. 2(1) and 2(3) (EUR-Lex), NIS2 Art. 2(1), 2(2), 21(2)(c)–(d) (EUR-Lex), Recommendation 2003/361/EC Annex Art. 2, CRA Art. 2(1) and 3(13), PRA SS2/21 para 1.2 (PRA Rulebook), CPS 230 para 2 (APRA's clean PDF, May 2026), the FFIEC mission page and ESMA's principles page: all quotes match. Three paraphrases were tightened: the DORA result said Article 2(3) leaves out "some smaller entities" (it also excludes post office giro institutions and MiFID-exempt persons, so it now says "some entities"); the supplier result said customers need tested exit plans for every ICT service (Article 28(8) covers services supporting critical or important functions); the FFIEC row now includes the State Liaison Committee chair. The AI Act Art. 2(1) text and the Staatsblad article 35 couldn't be re-read from here (EUR-Lex page truncated; officielebekendmakingen.nl returned 403): legal to check both. The closing headline now says "may apply", like the results.
- The size rule paraphrases Article 2 of the Annex to Recommendation 2003/361/EC: a small enterprise has fewer than 50 staff and turnover and/or balance sheet of no more than €10 million, so "medium-sized or larger" means 50 or more staff, or turnover and balance sheet both above €10 million. Partner and linked enterprises also count; the result sends that question to the adviser.
- The sector lists are the Annex titles and sector names. Annex I and Annex II sectors 1 to 5 were read on EUR-Lex; the fetch tool cut the page off inside Annex II, so the names of sectors 5 (subsectors), 6 and 7 were checked on the Irish NCSC's NIS2 guide (ncsc.gov.ie) and need a check against the Official Journal.
Four questions
Find the frameworks worth checking.
Choose every answer that fits. If you're part of a group, answer for the company that runs the applications.
Your progress
- Financial services
- Critical sectors
- Products and AI
- Standards
- Your result
Are you a regulated financial firm, or a supplier to one?
Choose all that apply.
Do you work in a sector listed in NIS2?
Annex I: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Annex II: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
Do you make products or AI for the EU market?
Choose all that apply.
Which standards do customers or auditors ask you for?
Choose all that apply.
Frameworks that may apply
Based on your answers, these frameworks may apply to your organisation. Each one shows why, in the framework's own words, and links to the source.
Nothing in your answers points to a specific framework. Customers may still ask you for continuity evidence, and the frameworks on our solutions page show what they usually look for.
Article 2(1) lists the financial entities it applies to, from credit institutions and payment institutions to investment firms and insurers; Article 2(3) lists some entities it doesn't apply to. Exit plans for ICT services supporting critical or important functions “shall be sufficiently tested and reviewed periodically” (Article 28(8)). DORA and Codekeeper
DORA's list in Article 2(1) ends with “ICT third-party service providers.” Your financial-entity customers need exit plans, sufficiently tested, for ICT services that support critical or important functions (Article 28(8)), so they may ask you for evidence. UK customers under PRA SS2/21 may ask the same. DORA and Codekeeper
Written for supervisors: they “provide a common supervisory basis to National Competent Authorities (NCAs) and ESMA”. They may shape what your supervisor asks about your suppliers. ESMA and Codekeeper
Paragraph 1.2: the statement is relevant to UK banks, building societies and PRA-designated investment firms, insurance and reinsurance firms and groups in scope of Solvency II, and UK branches of overseas banks and insurers. PRA SS2/21 and Codekeeper
The FFIEC prescribes “uniform principles, standards, and report forms for the federal examination of financial institutions” for its member agencies. Its guidance may shape what examiners ask about your technology suppliers. FFIEC and Codekeeper
Paragraph 2: “This Prudential Standard applies to all APRA-regulated entities”: authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees. CPS 230 and Codekeeper
Article 2(1): it applies to entities of a type in Annex I or II that are medium-sized or larger and provide their services or carry out their activities in the EU. Article 21(2)(c) names “business continuity, such as backup management and disaster recovery, and crisis management”. NIS2 and Codekeeper
Article 2(2) covers some entities “regardless of their size”, such as providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, the sole provider of an essential service in a Member State, and some public administration entities. NIS2 and Codekeeper
Article 21(2)(d) asks entities to manage “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Customers in those sectors may ask you for evidence. NIS2 and Codekeeper
The Dutch law that implements NIS2. It entered into force on 15 August 2026 (Staatsblad 2026, 189, article 35). If NIS2 may apply to you in the Netherlands, this is the law to check. The Cbw and Codekeeper
Article 2(1): it “applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.” Most obligations sit with the manufacturer (Article 3(13)); Article 2(2) leaves out products covered by certain other EU rules. The CRA and Codekeeper
Article 2(1) covers, among others, “providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union” and “deployers of AI systems that have their place of establishment or are located within the Union”. What it asks depends on your role and the AI system. The AI Act and Codekeeper
An international standard for information security management. It isn't required by law; customers and auditors ask for it. Codekeeper is itself ISO/IEC 27001:2022 certified. ISO 27001 and Codekeeper
An AICPA examination of controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy. Not a law; customers ask for the report. SOC 2 and Codekeeper
The international standard for business continuity management systems. Not required by law. ISO 22301 and Codekeeper
This is not legal advice. Whether a framework applies depends on details the scan doesn't ask, such as your group structure, how you're supervised and national law. Check with your adviser. Codekeeper's evidence supports your assessment; whether it meets a specific requirement is for you and your assessor to decide.
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
How the scan decides
Each framework, in its own words.
The scan matches your answers to the scope each framework sets for itself. Here's every rule it uses, with the source.
| Framework | Who it covers, from the source |
|---|---|
| DORA Regulation (EU) 2022/2554 | Article 2(1): “Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:”, a list that runs from “credit institutions;” and “payment institutions” to “insurance and reinsurance undertakings;” and ends with “ICT third-party service providers.” Article 2(3) lists entities it does not apply to.DORA page |
| NIS2 Directive (EU) 2022/2555 | Article 2(1): “This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.” Article 2(2): “Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where:” six sets of conditions follow.NIS2 page |
| EU size test Recommendation 2003/361/EC | Annex, Article 2(2): “Within the SME category, a small enterprise is defined as an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million.”Used for the NIS2 size question |
| Cbw Staatsblad 2026, 189 | Article 35: “De Cyberbeveiligingswet en dit besluit treden in werking met ingang van 15 augustus 2026.” (The Cyberbeveiligingswet and this decree enter into force on 15 August 2026.)Cbw page |
| Cyber Resilience Act Regulation (EU) 2024/2847 | Article 2(1): “This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.” Article 3(13): “‘manufacturer’ means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;”CRA page |
| EU AI Act Regulation (EU) 2024/1689 | Article 2(1)(a): “providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;” Article 2(1)(b): “deployers of AI systems that have their place of establishment or are located within the Union;” Points (c) to (g) cover more roles.EU AI Act page |
| PRA SS2/21 PRA Rulebook | Paragraph 1.2: “This SS is relevant to all: UK banks, building societies, and PRA-designated investment firms (hereafter banks); insurance and reinsurance firms and groups in scope of Solvency II … UK branches of overseas banks and insurers (hereafter third-country branches).”PRA SS2/21 page |
| APRA CPS 230 APRA | Paragraph 2: “This Prudential Standard applies to all APRA-regulated entities defined as:” authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees (points (a) to (e)).CPS 230 page |
| FFIEC ffiec.gov | The Council prescribes “uniform principles, standards, and report forms for the federal examination of financial institutions”. Its members are the Federal Reserve Board, the FDIC, the NCUA, the OCC and the CFPB, with the chair of the State Liaison Committee.FFIEC page |
| ESMA esma.europa.eu | The principles on third-party risks supervision “provide a common supervisory basis to National Competent Authorities (NCAs) and ESMA”.ESMA page |
| ISO/IEC 27001, ISO 22301, SOC 2 | Voluntary standards and reports, not laws. The scan shows them only when you say customers or auditors ask for them.ISO 27001 · ISO 22301 · SOC 2 |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Sources checked on 7 October 2026.
The evidence
What you can put on file.
Every protection comes with evidence. The higher you go, the more it proves.
Software Resilience Certificate
The deposit is held, and an automated check confirms what's in it, with a vault report.
Proves: it's there.
Recoverability Certificate
AI agents rebuild the deposit in the Codekeeper AI Verification Lab, with no help from the vendor, in hours. With a run report, an SBOM and an Exit workbook.
Proves: it builds. Agentic Verification
Tested Exit Report
Our specialists rebuild by hand in a clean room and test the business functions you nominate, with an annex mapped to your framework.
Proves: you could exit and keep working. Exit Exercise
See the evidence by framework on the solutions page.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
About the compliance scan.
Is this legal advice?
No. The scan points to frameworks that may apply, using each one's own scope wording. Whether one applies depends on details it doesn't ask, such as group structure, supervision and national law. Check with your adviser.
Why does it say "may apply"?
Because scope rules have exceptions. DORA leaves some entities out (Article 2(3)), NIS2 covers some small entities regardless of size (Article 2(2)), and national laws add their own detail. The scan shows where to look, and your adviser confirms it.
Why isn't GDPR in the results?
GDPR applies to almost every organisation that handles personal data, so it wouldn't tell you anything new. This scan focuses on the frameworks that ask about your suppliers, your continuity and your exit plans.
We're a supplier, not a regulated firm. Why do these frameworks matter?
Because your customers have to show they could leave you and keep working. DORA lists ICT third-party service providers in Article 2(1), and NIS2 Article 21(2)(d) asks entities to manage supply chain security. Evidence that your software can be recovered helps their file, and your deal.
Do you store my answers?
No. The scan runs in your browser and sends nothing to us. Your result is gone when you leave the page.
Will Codekeeper make us compliant?
Codekeeper gives you evidence for your file: certificates, run reports, SBOMs and Tested Exit Reports. Whether it meets a specific requirement is for you and your assessor to decide.
See which rules may apply. Have the evidence ready.
Book a demo and we'll map the frameworks on your list to the evidence each application can produce.