Partner programme for law firms
You advise on the law. We build the evidence that proves conformity.
The Comply.Land partner programme for law firms advising on the Cyber Resilience Act.
We deliver the technical evidence, and your firm keeps the client relationship.
Thank you
We have your question and will be in touch within two working days.
The Cyber Resilience Act is a market access regime. Without a Declaration of Conformity backed by engineering evidence, your client's product cannot stay on the EU market.
We deliver that evidence, and your firm keeps the client relationship.
Refer, subcontract or co-deliver
Technical referral
Refer. You scope the legal work. We contract directly with your client for classification, documentation and testing.
Under your engagement
Subcontract. We work under your instruction. This can be structured so technical findings sit within your privileged file, subject to your jurisdiction.
Joint workshops
Co-deliver. Co-branded CRA sessions for your clients' legal, product and engineering teams together.
Choose a model per client or as a standing arrangement.
Who leads each CRA workstream
A typical split between your firm and Comply.Land, and what you get out of each step.
| CRA workstream | Your firm | Comply.Land | Joint outcome |
|---|---|---|---|
| Role and scope analysis | Leads | Supports | Opinion by counsel on a product boundary verified by engineers |
| Product classification | Supports | Leads | Class set by people working on the vertical standards |
| Risk assessment, Annex I | Refers | Leads | Counsel reviews residual risk acceptance |
| Harmonised standards mapping | Refers | Leads | Product mapped to the standards that give presumption of conformity once cited in the OJ |
| Technical documentation | Supports | Leads | Annex VII file built by us, reviewed by counsel |
| Vulnerability handling, 24h reports | Supports | Leads | Fleet evidence feeds counsel on regulator contact |
| Declaration of Conformity | Supports | Leads | Signatory knows exactly what the signature states |
| EU Authorised Representative | Refers | Leads | Mandate drafted with the client's counsel |
| Supply chain contracts | Leads | Supports | Clauses naming a real SBOM, support period and patch terms |
| PLD exposure and litigation | Leads | Supports | Defence built on a retained, dated conformity record |
Leads: owns the deliverable. Supports: contributes input. Refers: typically outside practice scope.
Insurance is not a conformity strategy
Cover pays for losses after the fact. It cannot file a 24 hour early warning with ENISA, produce an SBOM, or put a withdrawn product back on the EU market.
Insurers increasingly exclude losses that arise from non-compliance with mandatory regulation. A dated, retained conformity record is what makes a manufacturer insurable in the first place.
No one should sign blindly
The Declaration of Conformity is signed on behalf of the manufacturer, often by the head of legal or the CEO. The signature states a technical fact: the product meets Annex I. Counsel confirms the client may make that statement. We make sure it is true.
Before anyone signs, send us the file. Our experts return a pass or fail determination within 2 working days, free of charge.
Key CRA dates
- 11 Jun 2026Notified body framework applies
- 11 Sep 2026Vulnerability and incident reporting applies
- 11 Dec 2027Full application, non-compliant products lose market access
How we start working together
- Step 01
Introductory call
We walk through your CRA practice and where clients are getting stuck.
- Step 02
Choose a model
Referral, subcontract or co-delivery, per client or as a standing arrangement.
- Step 03
First client file
We scope the technical work alongside your advice and agree the handover points.
Take the partner programme to your partners
A two page PDF with the three models, the workstream table and the key dates. Enter your details and the download starts straight away.
Your PDF is ready
Thank you. Your download should start by itself. If it does not, use the button below.
Download the PDFWhy Comply.Land
ETSI TC CYBER rapporteurs on the CRA vertical standards, translating the Regulation into the standards products will be assessed against.
CRA consultancy, training, evidence tooling and EU Authorised Representation under one roof.
EU Authorised Representative office in Malta, an English-speaking EU member state.
Fleet runs on your own infrastructure: signed SBOMs, dependency monitoring and the evidence behind vulnerability reports.
ITSEF laboratory accreditation under way for the CRA's third-party assessment routes.
Members of the Open Regulatory Compliance Working Group tracking the CRA and PLD.
Meet the Comply.Land teamRelated
Where law firms usually look next.
- The EU Product Liability Directive, and what a retained conformity record means for exposure
- CRA consultancy for your clients' products
- The EU Authorised Representative service
Frequently asked questions for law firms
Do we keep the client relationship?
Yes. In the referral model you scope the legal work and we contract directly with your client for the technical work. In the subcontract model we work under your instruction.
Can technical findings sit inside our privileged file?
The subcontract model can be structured so technical findings sit within your privileged file, subject to your jurisdiction. Whether privilege applies is a matter for your firm and the law that governs the engagement.
Which model should we choose?
That depends on the client. You can choose referral, subcontract or co-delivery per client, or agree a standing arrangement. We discuss it in the introductory call.
What do co-delivered workshops look like?
Co-branded CRA sessions for your clients' legal, product and engineering teams together.
Can you check a client's existing CRA documents?
Yes. Send us the file. Our experts return a pass or fail determination within 2 working days, free of charge.
Advising clients on the CRA?
Arrange an introductory call. We will walk through your CRA practice and where your clients are getting stuck.