Methodology and editorial policy

What this is

A public explainer of European cybersecurity legislation, from Union instruments down to the 27 Member States. Authoritative legal content lives in the Markdown and JSON knowledge base under content/. The website only renders that corpus.

Where facts come from

Primary sources, in this order:

1. Legal texts on EUR-Lex (Official Journal).
2. Commission policy and transposition trackers (for example the NIS2 tracker ).
3. ENISA guidance and certification pages.
4. National gazettes and competent-authority sites listed on each country page.
5. European Supervisory Authorities for DORA (EBA, ESMA, EIOPA).

Secondary trackers (for example industry transposition tables) are labelled as such and never outrank a primary text.

Verification

• Each content file has a last_verified date. Treat a file older than about three months as possibly stale.
• Unconfirmed facts are marked inline with ⚠️ VERIFY. Those markers are surfaced in the UI; they are not settled.
• Identifiers (id, CELEX, ELI) must match across Markdown and content/_data/*.json.
• New regulatory facts require a primary source and a Sources section on the file.

Update cadence

There is no statutory update cycle. Fast-moving fields — national NIS2 transposition, the 2026 cybersecurity package, CRA milestones, CER identification, DORA CTPP designations — are re-checked first. The maintenance checklist is in the repository file content/MAINTENANCE.md.

Corrections

If you find an error, open an issue or pull request on the public repository, or write to the address on the legal notice . Please include the page URL, the statement you believe is wrong, and a primary source. Factual corrections are made in the knowledge base with an updated last_verified date.