Methodology & integrity
How Cybiq stays honest
Reviewed October 2026 against Regulation (EU) 2024/2847, OJ L, 20.11.2024.
Most compliance tools wrap a chatbot in a disclaimer. Cybiq is built the other way around: a deterministic engine whose every output is anchored word-for-word to the Official Journal, verified on a schedule, and sealed so you can prove what you relied on. This page explains each layer, because the method is the product.
The engine, not a chatbot
Your answers go through one pure function. The same inputs always produce the same verdict, the same obligations, and the same dates. No language model sits between you and the law, so the legal text cannot be paraphrased, guessed, or hallucinated. All user-facing strings live in one catalogue (questions.ts); all legal weight lives in one corpus of verbatim quotes (corpus.ts). The two never blur.
As a concrete anchor, here is the application clause the engine reads to place every deadline:
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
What does the automation cover, and what does it not?
The classifier is rule-based. It reads the answers you give in the wizard (one question for internal use only, five for a commercial product, six for free and open-source software) and applies rules written from the text of the Regulation. It answers two kinds of question: whether the Regulation reaches your product at all, and, if it does, which class your answers point to and which obligations to look at next. Every answer carries the quote it rests on.
It does not assess your product. It does not inspect your code, your design or your processes. It does not produce a conformity assessment, and it does not give legal advice. Where your answers fall in a grey zone, the engine says that something needs a closer look and names the next step, not a verdict it cannot support.
So the output is orientation and evidence, never compliance: a dated, cited record of what the Regulation says about the situation you described. Whether you have met an obligation is a judgement the tool does not make.
Every quote is verified weekly
The corpus is not a snapshot we forgot about. A scheduled check fetches the live Official Journal text from the Publications Office CELLAR endpoint and confirms every stored quote still appears verbatim. If a quote drifts, the check fails before any release ships. A blocked fetch (the EUR-Lex web firewall answers automation with an empty body) is reported as a tooling failure, never as legislation drift, so a network hiccup cannot fake a clean result.
No orphan quotes
The audit works in both directions. Every verbatim quote in the corpus must be cited by the engine or by a public page, or the build fails on an "orphan" quote. And every engine claim must itself cite at least one corpus entry. The result: every legal claim about the Regulation is anchored to a verbatim Official Journal quote, and nothing we store is unused. The corpus covers the CRA text itself, not national implementing measures: claims about national implementation, such as a Member State's designated authorities, are attributed to the named authority's own pages instead. You can read the source behind any line we print.
Three tiers of source
Sources come in three tiers, and a page never blurs them. The first is the Official Journal text of the Regulation, quoted verbatim and verified weekly. The second is the Commission's non-binding guidance C(2026) 5252, which we summarise in our own words with its section and paragraph so you can check it. The third is ENISA's field specification for the single reporting platform (its CRA SRP Glossary, version 1.5, retrieved 19 October 2026): a dated, versioned platform specification, not law, printed in its own column of the notification templates and watched by a script that fails when ENISA's page changes.
Which sources does Cybiq rely on, and how does it cite them?
The primary text comes from EUR-Lex and from the Publications Office CELLAR endpoint, which is the machine-readable copy we verify against. Every legal claim is cited by article, recital or annex point, and names the act and the Official Journal date of the text we read: for the Regulation, OJ L, 20.11.2024.
The three tiers above are kept apart. Official Journal text is quoted verbatim. Non-binding guidance and platform specifications are summarised in our own words, labelled as such, and given with their section, version and the date we retrieved them. A recital is cited as a recital, never as an article. We do not cite national implementing measures from memory: they are attributed to the named authority's own pages.
Documents you can prove
When you buy a pack or download a determination memo, the document is sealed with a SHA-256 hash. The hash travels with the file, so months later you can prove the exact wording you relied on at the time. That is what turns a generated PDF into evidence.
How often is the legal text re-checked?
The corpus is checked against CELEX 32024R2847 by an automated run every Monday, as described above; a run that finds a change opens a tracking issue. On top of that, every legal instrument behind the engine is re-verified against its primary text at least every 90 days, and sooner when the weekly run reports a change. A reported change opens a review; it never edits the engine by itself.
A page's review date moves only when that review has happened. It is not a build timestamp.
How do we handle corrections?
If you find a mistake, write to hello@cybiq.eu and name the page and the sentence. We check it against the primary text. If the page is wrong, we correct it, update its review date and add a line to the log below. We do not correct a legal statement silently.
Corrections log
- : Review cadence, sign-off and corrections sections added.
- : Sign-off section removed.
Fines under Art. 64
Honesty about method does not change the obligations. Art. 64 sets these fines:
“administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.”
“administrative fines of up to EUR 10 000 000 or, if the offender is an undertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.”
Why this is hard to copy
A competitor can add a disclaimer in an afternoon. Rebuilding a deterministic engine, a verbatim corpus, a weekly verification pipeline, an orphan-quote audit, and a hashing scheme is months of disciplined work with no shortcuts. That distance is the moat, and it is the reason we can show our workings instead of hiding behind them.
Orientation, not legal advice. This page describes how Cybiq is built; it does not assess whether the CRA applies to your product. Verify any figure against the current Official Journal text before relying on it.