About
What this is, and what it refuses to do
Declara does one job. When something you ship turns out to contain a component that is being actively exploited, it runs the three clocks Article 14 puts on you and drafts the three filings. That is the whole product.
Why it is this narrow
The reporting duty is unusual among compliance obligations in that it is measured in hours. Almost everything else the Cyber Resilience Act asks of a manufacturer can be done over a quarter with a consultant. The early warning cannot: twenty-four hours from becoming aware, including at night and at the weekend. A deadline that short is not a documentation problem, it is an operations problem, and it is the one part of the Act that software is actually good at.
So the bet is that a small manufacturer does not need a platform. They need something watching the components they already ship, and a way to go from “this is real” to a filed early warning without reading the Regulation at two in the morning.
What it will not do
It does not scan. Trivy and syft are free, they are better at it, and this takes the SBOM they produce. It does not do conformity assessment or CE marking, and it never signs anything: those are the December 2027 obligations and they are a different kind of work, done by people with liability for the answer.
The line runs between drafting and deciding. It does draft the documents Article 13 expects you to have — a vulnerability handling process, a coordinated disclosure policy, an SBOM policy, the Annex VII technical documentation structure, an Annex V declaration of conformity — built from the answers you give it, with every unfilled placeholder left visible and counted. What it will not do is finish them, or sign one. Signing a declaration of conformity is a legal act taken under your sole responsibility, and a document that quietly invented a support period or a reporting owner would be worse than an obviously unfinished one.
It will not tell you that a component appearing in an exploitation catalogue is a reportable event, because it is not one. Article 14 turns on exploitation of your product, not on a dependency showing up on a list. A tool that conflates the two either buries you in false alarms or pushes you into filings you never owed, and the second failure is the expensive one. So a match opens an assessment with four questions, and only your answer starts a clock. The decision is recorded either way, including the decision not to file.
What it cannot do
It cannot make you compliant, and it does not claim to. You are the manufacturer; that responsibility is yours and stays yours. It cannot submit a report for you either — the single reporting platform has no interface for machines, so the last step is a person pasting a prepared filing in and recording the reference it returns.
The deadlines and scope verdicts here are read from the article text, and every one of them is cited next to where it is stated so you can check it rather than trust it. They have not been through a lawyer. Advisory data comes from public feeds, which are themselves incomplete: a component absent from them is not proof that it is safe.
How it is sold
Prices are on the pricing page, starting at €59 per product per month. There is no contact-sales tier and no call, because the answer to what something costs should not be a meeting. The trial is fourteen days and does not start until you upload an SBOM, so you do not burn a week of it working out what to upload.
Where this stands
The product is built and running. The company behind it is not registered yet, so there is no imprint and no company number to give you — and you will find that stated here rather than find a placeholder standing in for it. Until it exists there is no counterparty to contract with, which is worth knowing before you put a product inventory into anything. When it does, the details appear here, in the footer and on an imprint page, and this paragraph says so instead.
The quickest way to judge any of this is to use it on something you actually ship. Both checks are free, need no account, and store nothing.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.