FAQ
Does Declara file to the SRP automatically?
No. There is no API for the CRA Single Reporting Platform today — filing is a manual step where you copy Declara's generated packet into the SRP's own web form yourself. See Cyber Resilience Act, Article 14, checked 2026-09-13, and the ENISA CRA Single Reporting Platform FAQ, checked 2026-09-13.
What happens if I miss a deadline?
Declara doesn't apply a penalty or escalate anything automatically — there's no
penalty logic in the product. The case's stage simply shows overdue instead of a
countdown. File as soon as you can; the regulation's actual standard is "without
undue delay," not a hard cutoff that voids a late filing. See
What to do if you're already overdue.
Can I edit a report I already submitted?
Not in Declara: a filed stage stays exactly as it was filed, because it is evidence. Correct it on the reporting platform, where a notification stays editable until the final report is submitted, then record the correction against the stage. See Track a filing.
Is Tier a legal determination?
No. Tier A/B/C is Declara's own classification of exploitation signal, not a legal determination that a vulnerability is "actively exploited" or an incident is "severe." Whether an alert actually triggers your reporting obligation is decided in triage, by you. See Understand your first alert.
Does a passing release gate mean the product meets Annex I?
No. The gate is a signal, not a conformity verdict. It answers one question from Annex I
Part I(2)(a): does a component in this version's SBOM match an advisory that is known to
be exploited, or a Tier A match, that nothing clears? A pass says nothing about the
other essential requirements, and a blocked is not a reportable event. See
Gate a release in CI.
Does Declara send notices to my business customers?
No. Declara plans each contractual notice, drafts the text and reminds your own team before it is due. You send it from your own address and record that you did. These notices come from your supply agreements; they are not Article 14 deadlines. See Notify business customers.
Is the Trust Center my declaration of conformity?
No. The Trust Center shows what you chose to publish about a product. It shows the simplified declaration of conformity (Annex VI) only after you upload or link the declaration you issued and confirm it. That declaration, and the conformity assessment behind it, are yours; Declara does not check the document and makes no claim of conformity. See Publish a product's Trust Center.
Are the SBOMs my suppliers upload matched against advisories?
No. A supplier's SBOM is stored and scored for completeness, and it is not added to any product version's inventory or matched, so it raises no alert. To have a component watched, it has to appear in your own product's SBOM. See Request SBOMs from your suppliers.
Can an AI assistant connected over MCP change anything?
No. The MCP server has no tool that creates, changes or files anything, whatever scopes the key carries. An assistant can read deadlines, alerts, the release gate and support periods, and cannot submit a report, record a triage decision or acknowledge a gate. See Connect an AI assistant.