Legal disclaimer and review process

Any page in the Compliance Hub, and any how-to or explanation page that states a legal deadline, obligation, or interpretation, carries a disclaimer directly under its heading. This page is what that disclaimer links to.

What the disclaimer means

It states three things: which primary source the page's claims rest on, the date that source was last checked, and that the page is not legal advice. It is placed at the top of the page, not in a footer, because a reader under deadline pressure should see it before anything else on the page.

What counsel review status actually is

Declara's underlying legal template content — the packet fields, the deadline interpretations, and the reporting-obligation framing throughout these docs and the product — is not yet reviewed by outside counsel. This is stated plainly here rather than softened: every regulatory claim on this site reflects an internal reading of the Cyber Resilience Act and ENISA guidance, checked against primary sources, but not yet signed off by a lawyer. Treat it as a well-researched starting point, not a legal opinion.

The same holds for the drafts and records built on Article 13 and its annexes, none of which counsel has reviewed:

• the Article 13 records: the support period determination (Art. 13(8)), component reviews (Art. 13(5)), the upstream report log (Art. 13(6)) and the market-surveillance pack (Art. 13(22));
• the Annex II user information draft;
• the Annex VII technical documentation draft, and the Annex V declaration of conformity drafted alongside it;
• the Annex VI simplified declaration shown on a Trust Center, which only points at the declaration you issued.

Each is a starting point for the manufacturer to complete and own. The paragraph references on them were checked against the EUR-Lex text on 2026-10-10; see the regulatory changelog.

How a regulatory page qualifies as reviewed

A page carrying the disclaimer is considered current when all three of the following hold:

1. It cites a primary source — EUR-Lex text or ENISA/EC guidance — with a checked-on date.
2. That check is recorded as an entry in the regulatory changelog.
3. It has been re-reviewed since the last time the SRP field glossary version bumped, or since ENISA last updated SRP guidance — whichever is more recent.

When a page gets re-reviewed

Automatically triggered by two things: a version bump to the SRP field glossary that the report packet fields are drawn from, and any update to ENISA's own SRP guidance. Outside of those triggers, regulatory pages are reviewed on the same cadence as the rest of the docs — at minimum every six months, or sooner if a feature they describe changes.

Related

• Regulatory changelog
• Shared responsibility: Declara vs. you