Standards & Compliance

The frameworks we file every audit against · Last updated: July 2026

Every audit RFI-IRFOS runs is filed against current EU and Austrian law. We track new standards as they enter force and keep our methodology up to date. This page lists what that actually means in practice — the specific frameworks, not just a claim that we "follow best practice."

NIS-2 · NISG 2026

The EU directive for a high common level of cybersecurity, transposed into Austrian law as NISG 2026. It mandates state-of-the-art risk management, strict incident reporting to national authorities, and personal liability for company management. In Austria it directly impacts roughly 4,000 essential and important entities, plus an estimated 50,000 supply-chain partners.

In practice this covers three things: risk management (cryptography, access control, supply-chain security), incident response (mandatory reporting within strict timeframes), and corporate accountability (management personally liable for non-compliance). Scope: ~4,000 entities directly, ~50,000 supply-chain partners — see nis.gv.at.

GDPR · EU 2016/679

Art. 6 lawful basis, Art. 9 special-category (health/biometric), Art. 8 children, Art. 33 breach notification. The backbone of every disclosure we file.

EU AI Act · EU 2024/1689

Risk-tiered obligations for AI systems: transparency, governance, prohibited-practice analysis for the models we audit and build.

EU DSA · EU 2022/2065

Digital Services Act. Systemic-risk and illegal-content obligations. Filed directly with the Irish Digital Services Coordinator (Coimisiún na Meán) on platform findings.

ISO/IEC 29147 · International

Vulnerability disclosure. Our coordinated framework follows the 90-day embargo + regulator-notification standard — see our Security Policy for the process itself.

ISO/IEC 30111 · International

Vulnerability handling processes. The internal triage, validation, and remediation-tracking workflow behind every coordinated disclosure we run.

ISO/IEC 27001 · International

Information security management. The control set behind our handling of evidence, NDAs, and client data.

COPPA · US · 15 U.S.C. §6501

Children's online privacy. Applied across our minor-protection audits of apps, games, and streaming platforms.

EU MDR · EU 2017/745

Medical Device Regulation. Class IIb scrutiny for health/wearable apps processing Internet-of-Bodies data.

eIDAS / Trust Services · EU 910/2014

Electronic identification + trust services. Relevant to the biometric + identity-verification SDKs under our magnification.

ePrivacy Directive · EU 2002/58/EC

Consent for tracking, access to terminal equipment, electronic communications confidentiality. Art. 5(3) is the legal backbone of every SDK-consent finding we publish.