The organization is required to demonstrate their compliance with cybersecurity risk management obligations. After the registration, the organization must submit a self-declaration that lists all the implemented risk management measures.

This declaration must follow a structured format defined by the authority and be submitted within twelve months of becoming subject to the registration obligation. The purpose of the self-declaration is to provide transparency and assurance that the organization has taken appropriate technical, operational, and organizational measures to manage cybersecurity risks.