About
What this is, and what it refuses to do
Declara is built around one job. When something you ship turns out to contain a component that is being actively exploited, it runs the three clocks Article 14 puts on you and drafts the three filings. Around that core it keeps the record for the Article 13 duties that sit closest to it: the support period, the information users get, the declaration, due diligence on the components you ship, and what customers and authorities ask of you.
Why the clock comes first
The reporting duty is unusual among compliance obligations in that it is measured in hours. Almost everything else the Cyber Resilience Act asks of a manufacturer can be done over a quarter with a consultant. The early warning cannot: twenty-four hours from becoming aware, including at night and at the weekend. A deadline that short is not a documentation problem, it is an operations problem, and it is the one part of the Act that software is actually good at.
So the bet was never that a small manufacturer needs a platform. They need something watching the components they already ship, and a way to go from “this is real” to a filed early warning without reading the Regulation at two in the morning. That is still the core, and everything else is judged by whether it serves it.
What sits around it
The same inventory that feeds the clock is most of what Article 13 asks you to keep, so it would be odd to make you keep it twice. Per product, Declara records the support period and the reasoning behind it, the risk assessment and your answer to each Annex I requirement, and your review of the third-party components you ship. It drafts the user information Annex II requires, and answers the questions that arrive from outside: a customer’s supplier questionnaire, an OEM asking for your SBOMs, a market-surveillance authority’s reasoned request. Each of those is on the features page, with the article it rests on.
What it will not do
It does not scan. Trivy and syft are free, they are better at it, and this takes the SBOM they produce. It does not do conformity assessment or CE marking, and it never signs anything: those are the December 2027 obligations and they are a different kind of work, done by people with liability for the answer.
The line runs between drafting and deciding. It does draft the documents Article 13 expects you to have — a vulnerability handling process, a coordinated disclosure policy, an SBOM policy, and per product the Annex II information and instructions for users, the Annex VII technical documentation and an Annex V declaration of conformity — built from the answers you give it and the risk assessment and Annex I record you keep for that product, with every unfilled placeholder left visible and counted. What it will not do is finish them, or sign one. Signing a declaration of conformity is a legal act taken under your sole responsibility, and a document that quietly invented a support period or a reporting owner would be worse than an obviously unfinished one.
It will not tell you that a component appearing in an exploitation catalogue is a reportable event, because it is not one. Article 14 turns on exploitation of your product, not on a dependency showing up on a list. A tool that conflates the two either buries you in false alarms or pushes you into filings you never owed, and the second failure is the expensive one. So a match opens an assessment with four questions, and only your answer starts a clock. The decision is recorded either way, including the decision not to file.
What it cannot do
It cannot make you compliant, and it does not claim to. You are the manufacturer; that responsibility is yours and stays yours. It cannot submit a report for you either — the single reporting platform has no interface for machines, so the last step is a person pasting a prepared filing in and recording the reference it returns.
The deadlines and scope verdicts here are read from the article text, and every one of them is cited next to where it is stated so you can check it rather than trust it. They have not been through a lawyer. Advisory data comes from public feeds, which are themselves incomplete: a component absent from them is not proof that it is safe.
How it is sold
Prices are on the pricing page, starting at €59 per product per month. There is no contact-sales tier and no call, because the answer to what something costs should not be a meeting. The trial is fourteen days and does not start until you upload an SBOM, so you do not burn a week of it working out what to upload.
Where this stands
The product is built and running. The company behind it is not registered yet, so there is no imprint and no company number to give you — and you will find that stated here rather than find a placeholder standing in for it. Until it exists there is no counterparty to contract with, which is worth knowing before you put a product inventory into anything. When it does, the details appear here, in the footer and on an imprint page, and this paragraph says so instead.
Questions, including the awkward ones, go to kiril.u@gmail.com.
The quickest way to judge any of this is to use it on something you actually ship. Both checks are free, need no account, and store nothing.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.