Roadmap

Six waves. They overlap in part, but their dependencies are strict: a wave whose prerequisite is unmet produces unusable work.

Wave 0 — Scoping

Objective: know what you are talking about and who decides.

Deliverable	Owner
Portfolio PDE qualification register	Legal
Criticality classification register	Legal + CISO
Choice of assessment routes	Legal
Named RACI matrix approved	Sponsor
Governance bodies established	Sponsor
Choice of pivot format and toolchain	CISO
Licence policy v1	Legal

Do not proceed without: the classification. Without it you do not know which products need a notified body — that is, what the critical path is.

Wave 1 — Respond

Placed second deliberately: the reporting deadline is the nearest, and it applies to the legacy portfolio.

Deliverable	Owner
Technical and legal on-call rota, with written delegation	Sponsor
Live accounts on the reporting platform, tested	PSIRT
Reporting templates	PSIRT + Legal
Decision register	Legal
CVD policy published, security.txt online	PSIRT
First timed exercise	PSIRT
List of Member States where each product is made available	Product

Wave 2 — Generate

Deliverable	Owner
Automated SBOM on priority chains	DevSecOps
Quality validation and blocking thresholds	CISO
Signing and provenance attestation	DevSecOps
Tooling sheets per product family	CISO

Prerequisite: the pivot format is chosen (wave 0).

Wave 3 — Steer

Deliverable	Owner
Steering platform in production	CISO
Automatic ingestion from every chain	DevSecOps
Vulnerability sources connected	CISO
Continuous monitoring active on shipped versions	CISO
Policies in warning mode, then blocking	CISO + Legal
Alert routing to owning teams	PSIRT

Prerequisite: generation produces quality SBOMs (wave 2). Deploying the platform earlier is possible and even advisable, but activating it on poor SBOMs discredits the tool.

Wave 4 — Prove

Deliverable	Owner
Pilot technical documentation for two representative products	Legal + CISO
Notified bodies engaged and assessments launched	Legal
Annex II user notices	Product + Legal
Support periods determined and communicated	Product + Legal
EU declarations and CE marking	Legal
Evidence vault with ten-year archiving	Legal + DevSecOps
First successful retrieval exercise	Legal

Prerequisite: waves 0, 2 and 3. Technical documentation is assembled from existing artefacts; writing it before they exist produces a declaratory document with no evidence behind it.

Wave 5 — Sustain

Deliverable	Owner
Structured regulatory watch, with impact assessed	Legal
Periodic reviews: classification, licences, support	Legal
Six-monthly exercises: reporting, retrieval	PSIRT
Continuous improvement of the actionable-alert ratio	CISO
Extension of scope to new products, by default	Everyone

This is the wave with no end, and the one that gets left out of the budget. An unmaintained compliance arrangement degrades within eighteen months.

The dependencies, in one diagram

Wave 0 — Scoping
   │
   ├──► Wave 1 — Respond      (independent, nearest deadline)
   │
   └──► Wave 2 — Generate
             │
             └──► Wave 3 — Steer
                       │
                       └──► Wave 4 — Prove
                                 │
                                 └──► Wave 5 — Sustain

What to decide now

Three actions cannot wait, because their lead time is not yours to control:

1. Contract notified bodies for class II and Critical products.
2. Arm the reporting on-call rota, if that is not done.
3. Classify the portfolio, without which point 1 is impossible.

The rest can be sequenced. Those three cannot.