Step 1 · The product
What exactly will be supplied, and to whom.
Four services. The first one happens before anybody writes code.
This is twenty minutes of work that occasionally saves years of it. A client who commissions software and then sells it under their own brand becomes its manufacturer, and the duties attach to them: conformity, CE marking, a bill of materials, a disclosure policy, updates across a support period, and a vulnerability report within twenty-four hours. Whether a particular deliverable is a product on the market or a bespoke item for one client is not answered the same way in every case, so we do not pretend to a general ruling. We settle it for your project, in writing, and price the consequences.
What exactly will be supplied, and to whom.
Whose name goes on it when it ships.
Allocated in writing, party by party.
Support period scoped and priced.
What it does, and what it will not.
In increments you can see running.
Every component and its licence.
Code, documentation and instructions.
Two things are produced alongside the code rather than after it, because both become obligations the moment a product reaches a market. The first is documentation good enough for a developer who has never met us. The second is an accurate inventory of every third-party and open source component and its licence, which is what a software bill of materials actually is. Assembling that list at the end, from memory, is how projects discover a licence nobody can live with.
The most useful answer a technology adviser gives is often that nothing should be built. Existing software frequently covers a need better and far more cheaply than something written from scratch, and the new obligations change that calculation again: buying a compliant product moves the manufacturer's duties to its vendor, while building your own keeps them. That trade-off deserves to be on the table before a budget is approved, not after.
What actually turns on this.
Build, buy, or leave it alone.
Which option puts duties where.
In writing, including the risks.
How long, agreed and written down.
Which updates, on what timescale.
Where a researcher reports, and to whom.
Within the periods the rules require.
A support period is a commercial commitment with a cost, and the Regulation expects it to run for years rather than months. The honest consequence is that it has to be budgeted at the quotation stage, by whoever carries it. Where we carry it, the period, what it covers and what it costs are written down. Where we do not, we say so plainly, because a client who assumes maintenance that nobody agreed to is the most common way a secure system quietly stops being one.
A free first conversation, with no obligation. We will tell you where the duties land before you commit a budget.