Platform · Regulation and compliance
Regulation and compliance, built in.
Connected vehicles live under a growing list of rules, and the one that reaches deepest into your data is the EU Data Act: users, and the third parties they choose, must get access to the data their vehicle produces. c.technology provides that access out of the box, per organisation, per vehicle, revocable. Below: the Act in detail, how we secure and certify the platform, and who covers which rule. Compliance stays with you; most of the work does not have to.
Regulation (EU) 2023/2854
The EU Data Act
No other rule reaches as deep into your vehicles' data, and our platform answers it out of the box.
01EU Data Act · the dates
Three dates that matter.
Regulation (EU) 2023/2854. All three have passed.
-
Entry into force
Twenty days after publication in the Official Journal.
-
Application
Users may access the data and share it with a third party.
-
Access by design
For connected products placed on the market after this date.
Today ·
Article 3(1): product data has to be accessible to the user by default, free of charge, in a machine-readable format, and directly where that is technically feasible. The dates are set in Article 50 ↗
02EU Data Act · what it asks
| The Act asks for | On the platform |
|---|---|
| Access for the user | The owner or driver sees the vehicle's data in your app. |
| Access for a third party the user chooses | A workshop, fleet or insurer gets its own access, granted per vehicle. |
| Readable, structured, continuous | The same record your own systems read, over REST and streaming APIs. |
| Withdrawal | Access is resolved on every request, so revoking ends it at once. |
| Compensation between businesses | Entitlements and prices you set. Partners pay for connectivity through checkout; charging for data itself is coming. |
Out of the boxBuilding it yourself means creating a permission system, an access API for owners and the third parties they choose, and revocation that takes effect at once. With us, it is there on day one for every vehicle you connect.
Derived data stays yours. Predictive maintenance models, scores and other results of your own work are not raw vehicle data.
03EU Data Act · who it applies to
Not every manufacturer, not at once.
Article 7 spares the smallest makers and gives mid-sized ones a year per new product.
- Micro and small enterprises
- Exempt from the access duties, unless linked to a larger group
- Medium-sized enterprises
- In scope, with one year after each new product reaches the market
- Everyone larger
- In scope, with no grace period
It applies to every manufacturer selling into the EU, wherever it is based. Article 7 ↗
04Certifications
How we secure and certify the platform.
A certificate is named here when it exists, not before. Ask us for the current status and we answer in writing.
ISO 27001Preparing
The international standard for running information security as a managed system.
Our information security management system is in place, and we are preparing for certification.
SOC 2Preparing
An audit of a service provider's security controls, common with buyers in the United States.
We are preparing for it. If your procurement asks for it, tell us what it needs and we answer in writing.
GDPR and the Swiss data protection actApplies
The rules for personal data, in the EU and in Switzerland.
c.technology AG, Zurich, processes personal data under both, with a data processing agreement for every customer.
Penetration testsOn request
Independent attempts to break in.
Status and results on request, under NDA. The security pack has the rest.
05Regulation
Who covers what, regulation by regulation.
Connected vehicles sit under a growing list of rules. Some apply to us as the platform, most to you as the manufacturer. Here is the split as we see it today.
| Rule | What it is about | What we cover | What you cover |
|---|---|---|---|
| EU Cyber Resilience Act | Security of products with digital elements, through their life. Reporting from September 2026, the rest from December 2027. | The platform and the apps we build: secure development, vulnerability handling through security@ctechnology.io, security updates. Preparing for the obligations that apply from December 2027. | Your vehicle and its devices as products placed on the market, and their conformity. |
| UNECE R155 | A cybersecurity management system, for vehicle type approval in categories such as cars, vans, trucks and buses. | Supplier input to your CSMS: access control, logging, how the backend is run. In the security pack. | The CSMS and the type approval. |
| UNECE R156 | Software update management for type-approved vehicles. | The distribution layer: which firmware went to which vehicles, and which applied it. | The update management system, the firmware and its approval. |
| ISO/SAE 21434 | Cybersecurity engineering for road vehicles and their suppliers. | Our development practices, documented for your supplier assessment. Not certified. | The vehicle's cybersecurity engineering. |
| IEC 62443 | Security for industrial automation and control systems. | Not in our scope as a vehicle data platform. Ask us where a machine of yours falls under it. | The machine and its control system. |
| Radio Equipment Directive | Cybersecurity rules for radio equipment that connects to the internet, from August 2025. | The platform is software. No radio hardware is ours to certify. | The radio hardware in the vehicle, with its maker. |
| NIS2 | Security duties for entities in critical and important sectors, and for their supply chain. | Supply-chain answers for your NIS2 programme, from our ISMS. | Your own obligations, if your company is in scope. |
| SBOM | A bill of materials of the software components in a product. | Preparing, for the platform and the apps, in line with the CRA. | The SBOM of your vehicle software. |
Questions about any of this go to security@ctechnology.io.
06Questions
Asked about regulation.
Does c.technology make us compliant?
No, and nobody can say that for you. We provide the mechanism the Act describes: access for the user and for the third parties they choose, per organisation, per vehicle and revocable. Compliance stays with the manufacturer.
We are a small manufacturer. Does it apply to us?
Micro and small enterprises are exempt from the user-access duties, unless they belong to a larger group. A medium-sized manufacturer is in scope, with one year after each new product is placed on the market.
Can we charge a workshop or fleet for the data?
Between businesses the Act allows reasonable compensation. On the platform that is your own price for connectivity, set per vehicle, which the partner pays through checkout.
Do we have to share our own analysis?
The Act is about the data the vehicle produces. Your own derived results, such as predictive maintenance models or scores, are yours.
Are you ISO 27001 or SOC 2 certified?
Not yet. Our information security management system is in place and we are preparing for ISO 27001 certification. We are preparing for SOC 2 as well. Ask us for the current status and we answer in writing.
Where to go next