Compliance tools · Cybersecurity and data protection

Cyber Solidarity Act compliance tool

Regulation (EU) 2025/38 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Cyber Solidarity Act documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Cyber Solidarity Act is Regulation (EU) 2025/38, a binding instrument in the European Union. EU-level cyber incident detection, preparedness and response structures.

The Cyber Solidarity Act binds institutions and the largest operators. The free assessment states in ten minutes whether it binds you.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Cyber Solidarity Act: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Cyber Solidarity Act applies to your business, free →

Does Cyber Solidarity Act apply to my business?

The Cyber Solidarity Act applies to you only if you are a Member State, an EU institution, a National Cyber Hub, a Hosting Consortium, a Cross-Border Cyber Hub, a trusted managed security service provider, or a DEP-associated third country. It places no obligation on an ordinary business. This Regulation places no obligation on an ordinary business.

Who does Cyber Solidarity Act apply to?

It applies to Member States, Union institutions, bodies, offices and agencies, National Cyber Hubs, Hosting Consortia, Cross-Border Cyber Hubs, trusted managed security service providers selected under Article 17(2), and DEP-associated third countries under Article 19. Entities in NIS 2 Annex I and Annex II sectors are indirect beneficiaries only.

Does Cyber Solidarity Act apply to a small business?

The instrument has no size threshold and no size exemption. It expressly pursues reinforcement of the competitive position of small and medium-sized enterprises and start-ups, and SMEs acting as managed security service providers may seek selection as trusted providers under Article 17(2).

When does Cyber Solidarity Act apply from, and what are the deadlines?

The Regulation entered into force on 5 February 2025. Key dates are the ENISA interoperability guidelines due by 5 February 2026 under Article 6(4), the two-month summary report after support ends under Article 16(9), and the Commission evaluation by 5 February 2027 under Article 25(1).

What does Cyber Solidarity Act require me to do?

If you are a Hosting Consortium member you must enter a consortium agreement under Article 5(3). If you are a Cross-Border Cyber Hub you must conclude cooperation agreements under Article 6(3). If you are a trusted managed security service provider you must handle information in accordance with Union and national law under Article 16(2).

What records or documents does Cyber Solidarity Act require me to keep or produce?

Users of Reserve support must provide a summary report to the contracting authority, ENISA and EU-CyCLONe within two months after the support ends, covering the incident, the support received and the outcomes achieved, under Article 16(9). Requestors must also provide incident information during and after support under Article 16(8).

What happens if I do not comply with Cyber Solidarity Act?

The Regulation contains no direct penalty regime and specifies no monetary fines or administrative sanctions. A Member State whose National Cyber Hub does not join a Cross-Border Cyber Hub within two years of the grant award loses eligibility for additional Union financial support under Article 9(2), and trusted providers face deselection under Article 17(2).

How do I start complying with Cyber Solidarity Act?

The first practical step depends on your role. A Member State designates or establishes a National Cyber Hub under Article 4(1), and National Cyber Hubs from at least three Member States form a Hosting Consortium under Article 5(1), which then enters a consortium agreement under Article 5(3).

Which ComplianceSME account includes the Cyber Solidarity Act toolkit?

The Cyber Solidarity Act agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive