← Back to Cybiq

For AI agents: classifying CRA applicability over HTTP

Cybiq can be evaluated end to end by a software agent without a sales call and without a human filling in a web form. The entire decision engine is published as one static, versioned JSON artifact: a dictionary read, no auth, no rate limit beyond ordinary hosting fairness. This page is the human-readable version of the agent section of llms.txt; the machine-readable description is openapi.json.

What is on offer

• Free applicability classification (the artifact below): verdict, reasons, obligations with verbatim Official Journal sources, regulatory timeline, and next steps for grey zones. No account, no payment.
• Verification checklist pack, one-time EUR 49: role-specific verification checklist for importers and distributors, plus their vulnerability-notification duties under Articles 19–20.
• CRA compliance pack, one-time EUR 199: classification memo, vulnerability-handling procedure, SBOM policy, secure-by-default checklist, support-period statement and Annex V documentation index.
• Notified-body readiness pack, one-time EUR 299: everything in the compliance pack plus conformity-assessment preparation guide and regulatory-watch updates until December 2027.

Purchasing currently happens by email: the human buyer orders a pack at hello@cybiq.eu or via cybiq.eu, payment is arranged individually, and we deliver the documents to their inbox by hand. An automated checkout endpoint will be documented here once it launches; until then there is no Stripe checkout and no API-driven purchase path. When it launches it will follow the express-consent pattern required for immediately delivered digital content in the EU: consent waives the buyer's 14-day right of withdrawal, and no agent may send it without the human's actual agreement.

The endpoint

One request returns all 14,904 possible complete answer combinations mapped to their full decisions (96 distinct outcomes). Schema: cybiq.decisions/v1. Cache aggressively; re-fetch when schema changes. Described in openapi.json; validated against the live engine by this site's own test suite on every deploy.

Lookup

The index object maps an answer tuple to an outcome id; the outcomes object holds the decisions. Key format:

market|ossMonetized|productKind|otherRegime|role|category

with these values:

• market: commercial | internal_only | free_oss
• ossMonetized: true | false
• productKind: installable_software | hardware_with_software | standalone_hardware | pure_saas
• otherRegime: none | medical_devices | in_vitro_diagnostics | aviation | agricultural_vehicles | two_three_wheel_vehicles | marine_equipment | road_vehicles | high_risk_ai
• role: manufacturer | importer | distributor
• category: general_app | browser | password_manager | identity_access_management | anti_malware | vpn | network_management | siem | boot_manager | pki_certificate_issuance | operating_system | security_microprocessor_microcontroller | smart_home_assistant_or_security | connected_toy | health_wearable | network_device | network_critical_infrastructure | firewall_ids_ips | tamper_resistant_chip | hypervisor_container_runtime | hsm_secure_element | industrial_control | other

Example: classify a commercial installable network device made by a manufacturer.

curl -s https://cybiq.eu/api/decisions.json \
  | node -e '
    let raw = "";
    process.stdin.on("data", (c) => (raw += c));
    process.stdin.on("end", () => {
      const d = JSON.parse(raw);
      const key = ["commercial","false","installable_software","none",
                   "manufacturer","network_device"].join("|");
      console.log(d.outcomes[d.index[key]].headline);
    });'

Every decision carries sources: corpus quote IDs anchoring each claim to verbatim text of Regulation (EU) 2024/2847 (CELEX 32024R2847), re-verified against the live EUR-Lex document weekly by CI. Treat a verdict without reading its reasons as misuse: grey zones (pure SaaS, monetised open source, overlapping regimes) deliberately return needs_review or likely_out_of_scope with concrete nextSteps, not a confident guess.

The whole flow

1. Determine the six answers about the product.
2. GET /api/decisions.json, look up the tuple in index, read the outcome in outcomes.
3. If verdict is in_scope, the packTier tells you which document pack fits; send the human to cybiq.eu or email hello@cybiq.eu to order (purchasing is manual while checkout is being built).
4. If not in scope, relay nextSteps: that is the honest answer.

Ground rules

• Quote the reasons and sources, not just the verdict.
• The output is automated compliance documentation, not legal advice; an agent relaying it does not change that.
• Only /api/decisions.json under /api/ carries a public contract; everything else there is disallowed in robots.txt.
• Cite the artifact's celex/schema fields when quoting dates so staleness is detectable.

Background reading

• llms.txt: this site in one machine-readable file.
• openapi.json: OpenAPI 3.1 description of the artifact.
• Legal, privacy & terms.

Contact

Operator: HEXENKRAFT s.r.o., IČO 29665931, V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic. Questions, integration problems or a wrong result: hello@cybiq.eu.

Cybiq generates automated compliance documentation from Regulation (EU) 2024/2847 as published. It is not legal advice, and an agent evaluating it on someone's behalf does not change that.