Skip to content
Complia

How Complia works

Requirements, work and decisions.
One chain that holds.

Start with the product's requirement sources. Link the requirements to the people who own them, gather evidence and let the right person review it. The next step becomes visible without confusing work with approval.

How a team works in Complia

One requirement. An owner. Evidence to review.

Simplified product example

Connected product

Working version · verification

Requirement → owner → evidence
STEP 5 OF 5 · 0 LEFT

Use the arrow keys to step through the chain.

Active step 5 of 5: Next step. Independent reviewer

PRODUCT CONTEXT
Schematic product · not customer dataSECURE UPDATE
STEP 5 OF 5 · Next step

Review the test evidence

WORK THAT REMAINSGRK-UPD-01

Review the test evidence and assess the proposed evidence link.

Independent reviewer

FOLLOW-UP IN THE EXAMPLE3 open reviews with a named reviewer and a clear next step.

An independent reviewer assesses the proposed evidence link. No requirement or decision is approved automatically.

Illustrative before-and-after comparison

EXAMPLE DATA · NOT CUSTOMER RESULTS
Time to gather evidence before an audit
3 weeks2 days
Lead time for an evidence review
11 days2 days
Requirements fully traceable to a source
40 %100 %
Method note · how to read the example

The figures come from a built example, not from a customer study. They show how the work connects – not a guaranteed outcome.

  • Before is the same work when requirements, ownership and evidence are spread across documents, email and meeting notes.
  • After is the same work when everything sits in the product's own dossier.
  • Time and lead time assume a team of five with clear roles and one active rulebook.
  • Traceability means a requirement has a documented link to its source – not that the requirement is met or approved.

The work becomes visible. The decisions stay human.

Evidence is not an approval.

Phase by phase

Five phases. What you do, what Complia holds.

Each phase has a checklist built from the same rules the platform enforces, so progress is shown – never assumed.

  1. 01Define

    Agree what applies.

    You Choose the rulebooks, add requirement sources, judge applicability and analyse the threats against your architecture.

    Complia holds

    • Requirements traced to source and version
    • Applicability decisions with a rationale
    • Architecture, threats and traceability

    GateG1 Scope agreed · G2 Design baselined

  2. 02Implement

    Turn requirements into work.

    You Register components from an SBOM or by hand, profile your suppliers, triage vulnerabilities and connect the pipeline.

    Complia holds

    • Components with versions
    • Supplier profiles and commitments
    • Vulnerabilities per component

    GateChecklist: components, suppliers, no unreviewed vulnerability

  3. 03Verify

    Show that it holds.

    You Attach evidence to the requirement it supports and let an independent person review it. Request waivers where needed.

    Complia holds

    • Evidence with a fingerprint
    • Independent review with a rationale
    • Waivers with a decision and an expiry

    GateG3 Verification complete – signed by someone independent of the evidence

  4. 04Certify

    Prepare the assessment.

    You Pass the release gate, gather the audit package and issue the declaration and dossier for a qualified assessment.

    Complia holds

    • Controlled, numbered document versions
    • Signature by someone other than the preparer
    • Handover to the buyer with a time-limited link

    GateG4 Release approved

  5. 05Monitor

    Keep it true after release.

    You Follow vulnerabilities, publish VEX statements, track field incidents and assess every change.

    Complia holds

    • VEX statements per vulnerability
    • CRA reporting deadlines per case
    • Change impact on earlier decisions

    GateChecklist: every vulnerability has a VEX statement

Kept apart on purpose

Four things that are never the same thing.

  • Doing the workis notapproving it

    Who carries out a task and who reviews or signs it are different people.

  • A file existingis nota requirement verified

    Evidence supports a requirement only after someone has reviewed the link.

  • An AI suggestionis notan evidence link

    A link exists only when a person proposes it – and another person reviews it.

  • The certify phaseis nota certificate

    Complia gathers evidence for a qualified assessment. It does not issue certificates.

Start from your product.

We go through your requirements, ownership and next steps together.

Book a walkthrough