Features
What it does, duty by duty
Declara is built around Article 14: watch what you ship, decide when a match is real, and file the three reports on time. Around that core sit the Article 13 duties a manufacturer keeps for as long as a product is supported.
Every duty below cites the article it rests on, and every feature links to the page that shows how it works. The badge says which plan carries it. None of it makes you compliant: the manufacturer stays responsible, and the determinations stay yours.
ReportingArt. 14
The core of the product. It watches what you ship, asks you to decide when a match is real, and runs the three clocks from the moment you become aware.
Scope and class per product
A few questions per product give a scope verdict and an Annex III or IV class, each citing the article it rests on. The class never changes a reporting deadline.Art. 2
Every plan, including the trialHow it works: Scope and class per productExploitation watch
Every component is matched against OSV, GitHub's advisory database and NVD, then tiered by CISA KEV, ENISA's EUVD exploited list and EPSS, so only a likely-exploited match raises an alert.Art. 14(1)
Every plan, including the trialHow it works: Exploitation watchAssess-now triage
An alert opens an assessment with four questions, and only your answer starts a clock. A decision not to file is recorded as well.Art. 14(1)
Every plan, including the trialHow it works: Assess-now triageThe three clocks
The 24-hour early warning, the 72-hour notification and the final report are each computed from the moment you became aware, with reminders before each one falls due.Art. 14(2)
Every plan, including the trialHow it works: The three clocksFiling packets
Each stage is drafted field by field against ENISA's reporting platform glossary, for a named person to submit, because the platform has no interface for machines.Art. 16
Every plan, including the trialHow it works: Filing packetsReporting account and CSIRT
Records the steps ENISA requires before a first filing and the coordinating CSIRT the Regulation points you to, so nobody finds out at hour twenty that they cannot log in.Art. 14(7)
Every plan, including the trialHow it works: Reporting account and CSIRTFiling status
Records what the coordinating CSIRT does with each filing (valid, invalid or closed) and lets you correct one it found invalid.Art. 14
Every plan, including the trialHow it works: Filing statusNotice to users
Drafts the notice to the users affected by a case, with the measures they can take, for you to edit and send yourself. Record the channel and the day it went out as a separate act from the filings.Art. 14(8)
Every plan, including the trialHow it works: Notice to usersEvidence packs
A hash-chained record of what happened on your cases, verifiable by anyone with the code printed on it, without signing in.
Every plan, including the trialHow it works: Evidence packs
Vulnerability handlingAnnex I Part II
What Annex I asks of a manufacturer for as long as a product is supported: a way to be told about flaws, a way to tell others, and a record of what you decided.
Disclosure page and security.txt
A public coordinated-disclosure page with a contact address, and a security.txt that points to it.Annex I Part II(5)
Every plan, including the trialHow it works: Disclosure page and security.txtCSAF security advisories
Draft a CSAF 2.0 advisory from a vulnerability case, publish it as numbered revisions on your disclosure page, and list it where scanners collect it.Annex I Part II(4)
Every plan, including the trialHow it works: CSAF security advisoriesVEX import
An imported not_affected or fixed statement stops a match from becoming an alert. It never retracts an alert somebody is already assessing.
Every plan, including the trialHow it works: VEX importVEX export
Your triage decisions and imported statements become an OpenVEX or CycloneDX VEX document your customers' scanners can read.
Every plan, including the trialHow it works: VEX exportArticle 14 drills
Rehearse an early warning and a notification on the real clocks and forms, with nothing filed and nobody notified, and read the debrief.Art. 14
Every plan, including the trialHow it works: Article 14 drillsRelease gate
Each version shows whether it ships a known exploited vulnerability that no VEX, fix or triage decision clears. It is a signal, not a conformity verdict, and releasing anyway is recorded with a reason.Annex I Part I(2)(a)
Every plan, including the trialHow it works: Release gate
Product lifecycleArt. 13
The manufacturer duties that run alongside reporting. Declara keeps the record and drafts from it; the determinations, and any signature, stay yours.
Support period
Record the end date and your reasoning; under five years needs the reasoning. An end-of-support notice is drafted, with reminders at 90, 30 and 7 days and on the day.Art. 13(8)
Every plan, including the trialHow it works: Support periodAnnex I record and risk assessment
Per product, the risk assessment and your answer to each essential requirement, with what Declara can already see beside each one.Annex I
Every plan, including the trialHow it works: Annex I record and risk assessmentAnnex II user information
Draft the information and instructions for users from what is recorded about the product, edit each item, and export it as PDF, JSON or CSV. Anything unfilled stays visible.Annex II
Readiness Pack, included in PartnerHow it works: Annex II user informationTechnical file and declaration drafts
The Annex VII technical documentation and the Annex V declaration of conformity, drafted from the product's own record with every gap left as a placeholder. Signing stays yours.Annex VII
Readiness Pack, included in PartnerHow it works: Technical file and declaration draftsSubstantial-modification log
Weigh whether a change makes the product a new one on the market, using the Commission's non-binding guidance, and record your decision and reasoning.Art. 3(30)
Every plan, including the trialHow it works: Substantial-modification log
Supply chainArt. 13(5)
You answer for the components you ship, including the ones other people wrote. This is the record of what is in each version and what you did about it.
SBOM inventory
Upload CycloneDX or SPDX from a file or from your build, and every component of every version becomes the inventory the watch runs on.Annex I Part II(1)
Every plan, including the trialHow it works: SBOM inventorySBOM quality score
Each SBOM is scored against the fields BSI TR-03183-2 asks for, so a gap is found before a customer finds it. The score is not a conformance verdict.Annex I Part II(1)
Every plan, including the trialHow it works: SBOM quality scoreCryptography inventory
The cryptographic assets a CycloneDX SBOM declares are read against NIST SP 800-131A and BSI TR-02102 when it arrives.Annex I Part I(2)(e)
Every plan, including the trialHow it works: Cryptography inventoryPost-quantum readiness view
Shows which of the declared algorithms a quantum computer would break, for planning a migration.Annex I Part I(2)(e)
Growth and PartnerHow it works: Post-quantum readiness viewComponent due diligence
Record your review of each third-party package your supported versions ship, beside its licences, suppliers and advisories, and see which reviews have gone stale.Art. 13(5)
Every plan, including the trialHow it works: Component due diligenceUpstream report log
A record of the vulnerabilities you reported to a component's maintainers and when you shared a fix. Declara sends nothing itself.Art. 13(6)
Every plan, including the trialHow it works: Upstream report logSupplier SBOM requests
Email a supplier an expiring upload link, with reminders, and get its component's SBOM back stored and scored.Art. 13(5)
Growth and PartnerHow it works: Supplier SBOM requestsDependency-Track import
Map each Dependency-Track project to a product, and its current CycloneDX BOM is imported once a day. Nothing is ever sent to Dependency-Track.Annex I Part II(1)
Growth and PartnerHow it works: Dependency-Track import
Integrations
Where the work already happens: your pipeline, your chat, your tracker. Every key is scoped. The AI assistant only reads, and the API writes nothing but SBOM uploads.
SBOM upload from CI
Push the SBOM your build produces to a product version on every release, with a scoped API key.Annex I Part II(1)
Growth and PartnerHow it works: SBOM upload from CICI release gate
Your pipeline asks the gate after each push and fails the job on blocked. The gate stays a signal, not a conformity verdict.Annex I Part I(2)(a)
Growth and PartnerHow it works: CI release gateREST API
Products, versions, alerts, cases, advisories and VEX over a scoped, metered API, described by an OpenAPI document.
Growth and PartnerHow it works: REST APIAI assistant (MCP)
A read-only MCP server lets an assistant answer from your workspace, such as which deadlines fall this week. It cannot file or change anything.
Growth and PartnerHow it works: AI assistant (MCP)Slack and Teams
Alerts and case events arrive in a channel as a title, a sentence and a link back, never as your inventory.
Growth and PartnerHow it works: Slack and TeamsJira Cloud
An issue for each new alert and case, with every filed stage and overdue deadline added as a comment.
Growth and PartnerHow it works: Jira CloudSigned webhooks
Every event delivered to your endpoint, signed so you can check it came from Declara, and retried for about ten hours.
Growth and PartnerHow it works: Signed webhooksSingle sign-on
Your team signs in through your own identity provider over OIDC instead of an emailed link.
Every plan, including the trialHow it works: Single sign-on
Prices for each plan are public, and the trial carries every feature marked for every plan. The quickest way to judge it is on an SBOM you already ship.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.