Evidence packet — EU Cyber Resilience Act

One row of this record, assembled so it can be taken somewhere else: what the publisher published, where this record read it, what it hashed, and what changed between two readings it retained. Generated 2026-11-02. It carries no assessment of what the document requires and no reading of what any change means.

The packet, in three formats

JSON /packet/eu-cyber-resilience-act.json — every field
Markdown /packet/eu-cyber-resilience-act.md — the same content as plain text
ZIP archive /packet/eu-cyber-resilience-act.zip — an RO-Crate holding the files listed below

The archive holds the files listed here, in the order it holds them. The last is a metadata document that neither of the other two formats carries.

packet.json The packet object alone. The JSON address serves the same object under its packet key, beside fields of its own, so the object is served there and these bytes are not.
packet.md The bytes served at the Markdown address.
leaves-eu-cyber-resilience-act.txt This row’s lines of the published leaf file, each one a line of the file served at the leaf file’s address.
root.txt The bytes served at the root’s address.
ro-crate-metadata.json The metadata document, served only in this archive. It names this record as the archive’s author and describes each other file listed here. It names the row’s document at the answered address the packet gives for it, or at the row’s source address where the packet gives none, and each reading the packet lists at that reading’s answered address. For eur-lex.europa.eu, the host of those addresses, it states whether this record’s rulings file holds a reading of that host’s terms, whether every sentence that reading names is still in the bytes it was read from, and whether it records an attribution. Where the crate carries a credit for a host, it is the credit that reading records, found as whole words in those bytes, and each document at that host carries it.

Every file sits inside the archive’s one top-level directory, gxplex-packet-eu-cyber-resilience-act-2026-11-02/, which is the crate root. The metadata document is at the top of that directory, beside the files it describes, and not at the top of the archive.

The packet, in six parts

Contains: Source
Publisher
Type
Status, and the dates it is held with
Verification
Terms
Readings with retained text — 1 reading
Changes — no transitions
Integrity — 29 leaf lines
The conditions, in the order they are evaluated — 13 conditions
Generated: On 2026-11-02, packet version 1, against the root fixed on 2026-11-02 (Integrity).
Omitted: the_words_that_differ
this_records_own_prose
any_field_that_would_characterise_a_change
a_recomputed_root
Independently verifiable: This row’s 29 leaf lines, each a line of the published leaf file.

The root, which is the content of the published root file; the verification page carries the command that reduces the whole leaf file to a root.

Class, as the publisher states it, read from: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Derived: Computed by this record, not read from a publisher: 1 digest, each over the normalised text of a reading, which hashing a source as served does not reproduce (Readings), and the series state one-point.

No verdict: this row holds no transition (Changes).
Depends on external permission: The terms this record has read for this document (Terms): licence class open; a quotation appears in this record: yes.

The credit the archive’s metadata document carries for a host, where it carries one, is the one this record’s reading of that host’s terms records (the archive’s files, above).

Source

Identity as this record holds it for EU Cyber Resilience Act
Field	Value
Identifier	`eu-cyber-resilience-act`
Title	Regulation (EU) 2024/2847 — Cyber Resilience Act
Jurisdiction	EU
Address requested	https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Address answered	https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Observed cadence	weekly
Row	`/r/eu-cyber-resilience-act`

The address a request ANSWERED at is this record’s address for the row. The address it aimed at is testimony and is carried beside it, because a redirect is a publisher’s own statement about what supersedes what.

Publisher

The body, and the origin that answered
Field	Value
Authority	European Parliament and Council
Origin host	—
Origin read from	—
Standards body	—
Standards body read from	—

No origin host is recorded for this row. The authority named above is the body; the host is a fact about which origin answered, and this row does not carry one.

Type

The class the publisher states, and the kind of record this is
Field	Value
Class, as the publisher states it	legal act
Read from	https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Source kind, recorded here	`document`
Source type, recorded here	`document`
Record tier	`core`

The publisher’s own words for that class, and the passage they were read from, are on the row’s page. The packet carries the address rather than a second copy of the words, so there is one place the quotation is checked against what was recorded.

Status, and the dates it is held with

The status this record holds for this document, with its dates
Field	Value
Status	`in-force`
Stated as of	—
In effect from	—
Last changed	—
Status read from	—
Status withdrawn	—
Decay class	`live`

These are the dates this record holds for the document’s own status. They state nothing about which products or activities the document reaches; that is a judgment, and this record does not make one.

Verification

The act behind the status above, where one is recorded
Field	Value
State	verified (person-ratified)
What the state states	checked against the primary source by a person
Checked by	`human`
Check date	2026-08-08
Last verified	2026-08-08 (person-ratified: a key stands on the status this entry publishes)

Terms

What this record does with the text of this document
Field	Value
Licence class	`open`
Text retained here	yes
A quotation appears in this record	yes
Snapshot retained here	yes

Readings with retained text

Each distinct digest of the normalised text this record retained, addressed at the reading that first carried it
Reading	Days seen	Digest	Class	Answered at	Bytes
2026-07-31 #5	29 — last 2026-10-18	`9206a43954ebeb62…`	document	https://eur-lex.europa.eu/eli/reg/2024/2847/oj	351,206

Digests on this row: 1. With retained text: 1. Without: 0. Series state: one-point.

One reading with retained text. Nothing has been observed to differ from it, and a comparison needs two.

A digest is over the NORMALISED text of a reading, not over the bytes served: scripts, comments, navigation and page chrome are removed and tags are stripped before hashing. Hashing a source as served will not reproduce these digests. The full digest for every reading is in the packet; the column above is shortened for width.

Changes

One entry per consecutive pair of retained readings, in the order this record first saw each digest. Every entry carries a measured difference or the first condition that refused one. A refused entry was never tested against the conditions after it.

No transition. The sentence above says which absence this is.

A difference here is a difference between two readings this record retained. It is not a statement about what the document requires, about what changed in substance, or about whether anything follows from it.

Integrity

The root this packet was generated against
Field	Value
Root	`42337ae3567aae8138fcb45e977dd94f9c1ade6420a88033e9503203df3fec23`
Leaves the root covers	9,686
Algorithm	SHA-256 over sorted `id\|date\|content_hash` lines, pairwise; an odd final node is promoted, never doubled.
Fixed on	2026-11-02
Root published at	`/integrity/root.txt`
Leaves published at	`/integrity/leaves.txt`
The commands	the verification page
Leaf lines for this row	29

The root is over every leaf line the record holds, not over the lines below. Reducing it needs the published file, which is served whole at the address named here together with the command that reduces it. These lines are this row's own slice of that file, copied verbatim.

eu-cyber-resilience-act|2026-07-31|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-01|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-02|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-03|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-04|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-05|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-08|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-09|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-10|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-11|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-12|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-15|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-16|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-22|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-23|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-26|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-29|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-08-30|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-02|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-04|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-05|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-12|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-13|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-09-20|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-10-04|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-10-10|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-10-11|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-10-17|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f
eu-cyber-resilience-act|2026-10-18|9206a43954ebeb628d769b5e3d5078cc9f0c9b769ce41ec72128eb169c48ee8f

What this packet does not carry

the words that differ: A count of a difference is in this packet; the words are not. They are a publisher's text, and this record checks borrowed text only on the surfaces it enumerates — a packet carrying spans under a key those checks do not read would be borrowed text nothing verifies. Each change names the comparison entry for the same pair, and says which of three is at that address: the words, where a difference was measured and is inside the word ceiling; where it is above the ceiling, the condition and the positions at which the two readings differ, with no text of the document; otherwise the same condition this entry names, with no text.
this records own prose: The row's summary and its account of an unresolved address are this archive's own voice. They are leads and not evidence, however accurate, because a faithful paraphrase is indistinguishable from evidence while remaining ours. They are published on the row's page and are not here.
any field that would characterise a change: No score, no rank, no ordering by judgment, no reading of what a change means and no word for how much of it counts. A packet is evidence taken elsewhere, and a field characterising it would be an opinion with digests attached.
a recomputed root: The integrity block states the root this record published and the leaf lines for this row. It computes no root of its own: two numbers this record produced, compared with each other, check nothing.

The conditions, in the order they are evaluated

A change names the FIRST condition that fired and was never tested against the ones after it, so a condition reading a measured zero here is not a condition this row passed. Not measured is not zero; it is the packet’s own “not reached”, and the packet states why. This row holds fewer than two readings with retained text, so no pair was formed and no condition was evaluated at all. Every condition is unreached here, which is a different fact from a condition that was evaluated and did not fire.

Each condition, how many of this row’s 0 transition(s) it refused, and what it states
Condition	Changes	What it states
`licence-restricted`	not measured	No text from this document appears on this site, so no difference between two readings of it is shown either. The digests, the dates and the addresses are the record for this row.
`licence-unread`	not measured	No reading of the terms this source states is recorded for the row. That is an absent reading rather than an absent term, and the row is handled here exactly as a restricted one until a reading is recorded.
`date-not-observed`	not measured	No observation of this row on that day holds retained text.
`date-not-unique`	not measured	That day holds more than one distinct retained digest for this row, so a date alone does not name one observation. The addressed form — the day and the sequence within it — does.
`one-point`	not measured	Both dates resolve to the same observation.
`referent-unclassified`	not measured	The class of one of these observations could not be read, so neither was shown to be an observation of the document itself.
`referent-class`	not measured	One of these observations is not of the document. A listing page that names the document and the document are different subjects, and a difference between them is not a difference in the document.
`referent-normalisation`	not measured	These two digests were taken over different kinds of text — one over markup, one over prose extracted from a file — so the words they yield differ for a reason that is not the publisher’s.
`referent-address`	not measured	These two observations answered at different addresses. A difference between them is at least in part a difference between two pages.
`text-not-retained`	not measured	No normalised text is held here for one of these observations, so there is nothing on this side to compare.
`snapshot-unreadable`	not measured	Normalised text is recorded for one of these observations and could not be read from this record.
`span-unverified`	not measured	A span this comparison would have shown could not be found, word for word and in that order, in the retained text it was drawn from. The comparison is withheld rather than shown: a phrase assembled out of words a publisher did not write next to each other is a fabricated measurement of what the publisher wrote.
`over-ceiling`	not measured	A faithful difference is longer than the word ceiling this site publishes under. Its words are withheld whole rather than cut to fit: a shortened quote is a fabricated measurement of what a publisher wrote. The figures below measure the difference and quote none of it.

Word ceiling: 14. Where a faithful difference is longer than that, the verdict is withheld and no words are published for it: a shortened span is a fabricated measurement of what a publisher wrote, so it is withheld whole rather than cut to fit. How this record is built.

Last updated: 2 November 2026