compliance-ownerauditor
Shared responsibility: Declara vs. you
Was this page helpful?
This page reflects our reading of Cyber Resilience Act, Article 14 and related guidance as of . It is not legal advice. Review process.
Declara automates the mechanical parts of Article 14 compliance. It doesn't remove the judgment calls — it makes them visible enough to make correctly.
| Area | Declara does | You remain responsible for |
|---|---|---|
| Deadline tracking | Computes 24h/72h/14d/1mo clocks from the moment you record awareness | Recording when you actually became aware — the clock starts there, not at upload |
| Report drafting | Assembles the SRP packet fields from your data | Filing it — Declara does not submit to the SRP; there is no SRP API today |
| Scope/triage | Surfaces the 4 fixed triage questions | Answering them correctly for your product and threat |
| Vulnerability matching | Tier A/B/C classification against NVD/OSV/GHSA/KEV/EUVD/EPSS | Confirming exploitability in your context — Tier is not a legal determination |
| VEX | Suppresses matches you've already assessed as not-affected/fixed, and exports your decisions as OpenVEX or CycloneDX | Issuing accurate VEX statements, and the triage decisions behind an export |
| Filing status | Records the platform status and the CSIRT's note you tell it, and shows the platform's own 72h display beside the legal deadline | Correcting a filing on the platform, and recording what changed |
| Security advisories | Drafts a CSAF 2.0 advisory from a case, checks it, and serves the published revision from your disclosure page | What it says, and deciding when to publish and list it |
| SBOM quality and cryptography | Scores each SBOM against BSI TR-03183-2 and classifies declared cryptography against NIST and BSI guidance | Producing SBOMs that carry the fields, and the cryptographic choices themselves |
| Annex I and the technical file | Holds your risk assessment and requirement answers, shows what it can see beside each, and drafts the technical file and declaration from them | The assessment, every answer, the conformity assessment, and signing the declaration |
| Substantial modification | Shows an indication from the Commission's factors, with citations | The decision and its reasoning |
| Support period | Keeps each determination with its factors, reasoning and author, shows it in the technical file, retires versions past their end, and drafts the end-of-support notice | The period itself and why it is that length, telling users, and keeping the support you promised |
| User information | Drafts the Annex II information in English from what it holds, marks what it could not fill, and exports JSON and CSV | Every statement in it, translation into the languages your users need, and keeping it available for the required time |
| Market-surveillance requests | Records each request and assembles the product's documents into one zip with a manifest and a verification code | Deciding what the authority is owed, adding what the pack does not hold (the declaration you signed, if you did not confirm it on the Trust Center, and any component due diligence kept outside Declara), sending it, and the reply deadline |
| Release gate | Reads a version's matches and answers pass, blocked or pending, in the app and over the API, and records each decision with its reason | Whether to ship, the reason for releasing anyway, and wiring the check into your pipeline. It is a known-exploitable-vulnerabilities signal, not a conformity verdict |
| Component due diligence | Gathers what the SBOMs and feeds show about each third-party package, keeps your review and its history, and flags reviews that have gone stale | The review itself: maintenance, licence, the decision, and the next review date |
| Upstream reports | Keeps the record of each report to a maintainer, checks the advisories it holds for a possible duplicate, and shows it in the technical file and authority pack | Sending the report through the maintainer's channel, sharing the fix, and what the maintainer has already been told |
| Trust Center | Serves the product pages, VEX and manifest you choose to publish under your disclosure page, shows only the fields you enabled, and records who confirmed a declaration and when | What is published and whether it is accurate, the declaration of conformity itself and confirming it is the one you signed, and whether public VEX should name your components |
| SBOM sharing | Issues an expiring, revocable link to the original SBOMs of supported versions, refuses every bad link the same way and logs each use | Who you give a link to, how you send it, revoking it when the need ends, and what the recipient may do with the files |
| Supplier attestation | Builds the six answers from your records, labels each one recorded, declared or still to complete, and issues a PDF and JSON with a verification code | Every statement in it, the answers you type yourself, and what you promise a customer. It is not a conformity assessment |
| Customer notices | Plans a contractual notice when a real case opens on a product a customer uses, drafts it, reminds your team and keeps the record | Agreeing the window, sending the notice from your own address, recording that you did, and the contract. Declara sends nothing to customers and these are not Article 14 deadlines |
| AI assistant access (MCP) | Lets an assistant with your API key read products, alerts, cases and their stored deadlines, advisories, VEX, release gates and support periods, with no tool that changes anything | Which assistants hold a key and with what scopes, revoking keys, what the assistant does with the answers, and not treating its summary as a legal determination |
| Dependency-Track import | Pulls each mapped project's CycloneDX BOM once a day into the product version it names, and reports the outcome per project | The mapping, the version set in Dependency-Track, a key with read access only, and a server reachable from the internet (or pushing the BOM yourself) |
| Supplier SBOM requests | Emails a supplier an expiring link, reminds it at 7 and 14 days, and stores and scores the SBOM it uploads | Choosing whom to ask, what you do with the answer, and reviewing the component. A supplier SBOM is not merged into your inventory or matched against advisories |
| Drills | Runs a practice case on the real clocks, kept out of reminders, integrations, the API and evidence | Taking part, and fixing what the debrief finds |
| Evidence | Produces a hash-chained, independently verifiable record | Deciding what else your auditor or regulator needs beyond that record |
| Legal interpretation | Surfaces regulation text and deadline math | All legal judgment calls — the underlying legal template content is explicitly unreviewed by counsel today |