Law and standards
The European Accessibility Act and the Cyber Resilience Act bind the business that sells a product or service they cover. Hue Charts is built to meet the chart's part, and hands you what your audit asks for.
The dates
The dates that matter
In force ·
European Accessibility Act
Covered products and services sold in the EU, from sellers anywhere in the world.
Published ·
EN 301 549 V4.1.1
References WCAG 2.2 AA, the level Hue Charts already reports against.
In force ·
Cyber Resilience Act · reporting
Actively exploited vulnerabilities reported within 24 hours, 72 hours and 14 days of the fix.
Arriving ·
ADA Title II
WCAG 2.1 AA for US state and local government web content and apps serving 50,000 people or more; the rest follow on 26 April 2028.
Arriving ·
Cyber Resilience Act · in full
SBOMs, five years of security updates, and due diligence on every component.
Cyber Resilience Act
What the Act asks and Hue Charts gives
The EU's Cyber Resilience Act applies to software sold in the EU. Its reporting duties apply from 11 September 2026 and the whole Act from 11 December 2027.
| What it asks | How Hue Charts meets it |
|---|---|
| Report an actively exploited vulnerability: an early warning within 24 hours, a notification within 72, a final report within 14 days of the fix (from 11 September 2026) | The service level agreement's security clause, and the SECURITY file's private channel |
| Security updates free of charge for a support period of at least five years | Every major gets security fixes for five years from its first release: current, LTS, then maintenance |
| A machine-readable SBOM | A CycloneDX SBOM of every shipped file, built on every pack |
| Due diligence on third-party components | No runtime dependencies; the code, font, data and palettes it carries from others are each in the SBOM and the third-party notices, with their licences |
Accessibility law
Each law's bar, and Hue Charts' own
Contrast, non-text contrast and the use of colour are solved inside the library, whatever the reader sets; every criterion is in the accessibility report.
| Law | Bar |
|---|---|
| European Accessibility Act, through EN 301 549 | WCAG 2.1 AA |
| ADA Title II, United States | WCAG 2.1 AA |
| EN 301 549 V4.1.1 | WCAG 2.2 AA |
| Hue Charts reports against | WCAG 2.2 AA |
Standards
The standards it is built on
| Standard | What it gives |
|---|---|
| WCAG 2.2 AA · ISO/IEC 40500:2025 | A conformance report, its figures computed from the library |
| IEEE 754 · ISO/IEC 60559:2020 | Sine, cosine, exponential, logarithm and powers built from its exact operations |
| ISO 3166-1 and ISO 3166-2 | Countries by their two- and three-letter codes, and each country's regions by their ISO 3166-2 codes |
| UN M49 | The world's regions and sub-regions by their M49 codes and names |
| ISO 4217 | Every currency's code and minor units, as of 17 Sep 2026; an amount rounded once, to its currency's minor units · the money page |
| ISO 8601 | Dates, months and instants read in its extended form, and written in it where a time zone is asked with no locale; times of day and lengths of time, each time with its zone's offset |
| IANA time zone database · BCP 175 | Every zone by its name, never an abbreviation |
| SI Brochure, 9th edition | The units of time by their symbols, d, h, min and s, a space between the number and the unit |
| Intl · BCP 47 (ISO 639) | Numbers, dates, time zones and right-to-left, in the reader's locale by its language tag |
| Unicode · ISO/IEC 10646, ISO 15924 | Every word read as Unicode; a script the face cannot letter named by its code |
| JSON · ISO/IEC 21778, and JSON Schema | For every chart's spec and every recipe, with answers returned as data |
| OKLCH · sRGB (IEC 61966-2-1) · Display P3 | Every colour read out for the eye, in sRGB and on wide-gamut screens |
| PNG · ISO/IEC 15948 | Pictures written as PNG, a Display P3 picture tagged as one |
| Open Font Format · ISO/IEC 14496-22 | The face written as a font file, so a page sets its words in the glyphs the picture is measured in |
| PDF/UA · ISO 14289-1 | PDF files a screen reader reads: the chart a figure with its words, its data a table, its text searchable |
| PDF/X-4 · ISO 15930-7 | The print PDF: every colour separated by your printer's own ICC profile (ISO 15076-1), its black compensated (ISO 18619), the profile carried as its output intent |
| FNV-1a digest | Eight hex digits over the raster; a golden digest over 18,000 outputs of its maths |
| CycloneDX SBOM | Every shipped file with its SHA-256, built on every pack |
| SPDX · ISO/IEC 5962:2021 | The same bill of materials in the format ISO publishes: every shipped file with its checksums, and what it carries with its licence |
| security.txt · RFC 9116 | Where to report a vulnerability, at /.well-known/security.txt, answered on the clock the SLA sets |
| Power BI certification audit | Clean with the whole library bundled |
Map data
Where the maps' data comes from
Every map names its source in its own Data line. The borders show regions as they are administered: they are illustrative and take no side on any claim. Taiwan, which M49 does not list, is placed in Eastern Asia by geography. Each package carries every notice in full, in THIRD-PARTY-NOTICES.md.
| Data | Source | Terms |
|---|---|---|
| The world's countries | Natural Earth, 1:110m countries | Public domain |
| Every country's regions, and the world regions' outlines | Natural Earth, 1:10m states and provinces, version 5.1.1 | Public domain |
| The world's regions | United Nations Statistics Division, M49 | Cited |
| The US states | US Census Bureau, cartographic boundaries at 1:20,000,000, 2024 | Public domain |
| The UK's ITL1 regions | Office for National Statistics, ITL1 boundaries of January 2025 | Open Government Licence v3.0; contains OS data © Crown copyright and database right 2025 |
| Countries' codes and names | Unicode CLDR 48.2.3 | Unicode License v3 |
| Currencies | SIX, ISO 4217's maintenance agency, List One of 17 Sep 2026 | Cited |