A new standard for compliance you can cryptographically verify.
The Machine-Readable Compliance Certificate (MRCC) compresses weeks of auditor back-and-forth into a hash check. Issued once, verified everywhere.
From regulation to verifiable artifact
Cryptographic integrity
Hybrid signature scheme — Ed25519 (RFC 8032) + ML-DSA-65 (NIST FIPS 204 Category 3) — anchored by a SHA-256 manifest hash. Both signatures verified ; failure of either rejects the artefact.
Sources fully traceable
Every claim links back to regulation article, control reference, evidence file.
Machine-readable JSON/XML
Procurement systems can validate automatically — no human in the loop.
Multi-jurisdiction
One artifact covers CRA, NIS2, AI Act, RED, DORA. One source of truth.
Sample MRCC payload
A real MRCC is a signed JSON document. Here's what auditors and procurement systems consume :
{
"mrcc_id": "MRCC-2026-001-CRA",
"version": "1.0",
"product": {
"name": "IoT Security Hub v3.1",
"organization": "Acme Electronics GmbH"
},
"regulations": ["CRA", "NIS2", "RED"],
"readiness": 0.84,
"evidence": { "provided": 23, "required": 27 },
"sbom": { "verified": true, "components": 412 },
"integrity": {
"manifest_hash_algo": "sha-256",
"manifest_hash": "e3b0c44298fc1c14...c91d",
"signatures": {
"ed25519": "...a3f8e2",
"ml_dsa_65": "...18:4f:c9:7e..."
}
},
"issued_at": "2026-03-20T14:30:00Z",
"verify_url": "https://verify.nexcyber.eu/MRCC-2026-001-CRA"
}PDFs and screenshots never scaled with EU regulation.
The EU rolled out five overlapping cyber regulations (CRA, NIS2, AI Act, DORA, RED) in three years. Each demands proofs at procurement, audit, supply chain, board level, and on incident. The current playbook — assemble a 60-page PDF, email it, hope nobody asks for the underlying evidence — collapses under that load. Auditors re-read PDFs they already reviewed. Procurement teams chase claims they cannot verify. Vendors restate the same evidence to every customer. There has to be a primitive that compresses all of it.
Manual evidence collection, screenshot dumps, redacted PDFs — repeated for every regulation.
A traditional self-attestation = trust me. No tamper-proofing. Re-signing requires re-reading.
MRCC carries CRA, NIS2, AI Act, RED, DORA claims in a single signed payload.
Built for the people who keep being asked the same question.
MRCC works because each audience reads it differently — and each gets the answer they need without a meeting.
Compliance & Security Officers
Issue once, satisfy CRA, NIS2, AI Act, DORA, RED in one artifact. Track exactly which evidence backs which claim. Re-issue on every assessment cycle.
Procurement & Vendor Risk
Verify a vendor's claim in seconds. Reject expired MRCCs. Plug verify-url into vendor management — no manual review queue.
Auditors & Notified Bodies
Read claims, follow links to evidence, check signature. Spend audit hours on the genuinely complex cases — not on chasing whether a fact is current.
Boards & Executive Teams
A single number you can stand behind. Cryptographic proof your security posture matches what the company says publicly, when it says it.
MRCC vs the traditional compliance PDF.
Same intent. Different physics.
| Dimension | Traditional PDF self-attestation | MRCC |
|---|---|---|
| Tamper detection | None — anyone can rewrite a PDF | Ed25519 signature, payload hash |
| Machine verification | Manual reading required | Procurement systems verify in milliseconds |
| Evidence traceability | Claims without sources | Every claim links back to article + control + file |
| Multi-regulation scope | One PDF per regulation | One MRCC covers CRA / NIS2 / AI Act / DORA / RED |
| Expiry & revocation | No expiry field, no revocation mechanism | Embedded validity window, public revocation registry |
| Time to verify | Days (read, request follow-ups, re-read) | Seconds (signature + hash check) |
Live verification in 3 steps
Anyone can verify an MRCC. No account, no API key, no friction.
Vendor sends you the signed JSON file or QR code.
Drag-drop on /verify or scan the QR.
Signature valid · Hash matches · Sources traced.
Frequently asked
What auditors, procurement teams and engineers ask before they trust a new format.
Is the MRCC legally recognised under the CRA?
The MRCC is a deterministic compliance attestation, not a legal certification. It is the layer between your evidence and a formal Notified Body conformity assessment where one is required (e.g. CRA Important Class II). Auditors use the MRCC to pre-stage their work, dramatically shortening the engagement.
What stops someone forging an MRCC?
Each MRCC is signed with NexCyber's Ed25519 private key over the canonical JSON payload. Anyone holding the public key (published at /trust) can verify the signature offline. Modify even a comma and the signature breaks. A QR or signed JSON forwarded to a verifier triggers the check in milliseconds.
Does it expire?
Yes. Every MRCC embeds an issued_at and an expires_at — by default 90 days from issuance, aligned with how fast regulatory and evidence states move. Re-issue on every assessment cycle. Past MRCCs remain verifiable but flagged as expired.
Can my procurement system consume it automatically?
Yes. The MRCC is a versioned JSON document — schema published at /trust. Pipe the verify endpoint into your vendor management system; reject vendors whose signature fails, whose certificate has expired, or whose stated regulations do not cover your procurement scope.
How is this different from a SOC 2 report?
SOC 2 is a comprehensive third-party audit on internal controls, valid for a year. The MRCC is a machine-readable, EU-regulation-specific attestation that can be re-issued continuously. Both have legitimate uses ; the MRCC is what you hand to a CRA notified body or a NIS2 essential-entity procurement officer, not what you put on your trust page in lieu of SOC 2.
Can free or paid users issue an MRCC?
Every paid plan (Starter and above) can issue an MRCC. Free accounts can preview the MRCC structure on their assessment but the issuable artifact carries a watermark until upgrade. The Trust Passport bundles MRCC + verification page + revocation registry.
Issue your first MRCC today.
Free assessment → first MRCC in 5 minutes.
Run free assessment