Asking an AI chat or using Declarable: what each does for the Cyber Resilience Act
A general AI chat explains an SBOM as well as we do. Paste a file, ask what it means and what is missing, and you get a good plain-English answer in a minute, for little or nothing. It is also a fair way to draft a first security policy. If you want to understand one file once, use the chat. What a chat does not do is run when nobody is asking. It does not watch your product for the years you must support it, tell you when a new vulnerability matches, start the Article 14 clock from the moment you became aware, or keep a dated record with the legal-state version it was written under. It can also be wrong about a CVE number or a version range with nothing in the answer to check it against. Those are the jobs of a running service with a record, and that is the only reason to pay for one. It is not either/or: if you already work with an AI agent, it can call Declarable, read a product’s open vulnerabilities and Article 14 deadlines, and leave its decisions in the record (see /docs/agents).
Newest check: 13 October 2026
When another option is the better choice
Our judgement, not a finding from the sources below.
- A general AI chat (ChatGPT, Claude, Gemini): You want a one-off answer to “what does this file mean?”, or a first draft of a policy to edit, and you are content that the answer comes from the model and not from a source you can open.
- Declarable: You ship releases, must keep watching them for the support period, and need the record of what you knew and decided to still exist in 2036, with the legal-state version on it.
| Criterion | Declarable | A general AI chat (ChatGPT, Claude, Gemini) |
|---|---|---|
| Explains an SBOM file and its gaps — An SBOM is the list of software parts inside your product. A gap is something missing from that list that a regulator or customer would expect | Yes. Each gap names the rule behind it and where the rule comes from. It does not replace your own review. | Yes, and well, for one file at a time. This is our own reading of what a chat does; the vendors’ privacy pages do not describe it. What it tells you comes from the model, not from a rule with a sourcesource, 13 October 2026 |
| Checks the parts against vulnerability lists, with a source — Whether each match to a known vulnerability comes with the list and record it came from, so you can check it yourself | Yes. Components are matched to published advisories, and each match links the advisory it came from so you can read it. | From the model’s memory unless the chat has a live lookup tool switched on. With memory alone you cannot see which list an id or version range came from. Whether a given chat has such a tool depends on the plan and settings; we did not test anysource, 13 October 2026 |
| Keeps watching after you close the tab — Whether anything runs on its own while nobody is asking, since new vulnerabilities are published every day | Yes. The vulnerability lists are synced and your products are rescanned on a schedule, with nobody at the keyboard. Daily monitoring is a paid-plan feature. | Nothing runs unless you ask. That is how a chat works: a reply is made when you send a messagesource, 13 October 2026 |
| Tells you when something new matches — Whether you are told, by email or to another system, instead of having to ask again | Yes. A new match is sent as an email, and to a webhook address if you set one. Alerts are a paid-plan feature. | No. You would have to paste the file again and ask again. We did not look at scheduled-task features that some chats offersource, 13 October 2026 |
| Starts the Article 14 clock and reminds you — Article 14 of the Cyber Resilience Act sets reporting deadlines of 24 hours and 72 hours, counted from the moment you became aware of an actively exploited vulnerability | Yes. You say when you became aware, the 24-hour and 72-hour deadlines are counted from it, and reminders are sent before each one. We do not file anything for you. | You can ask a chat to work out 24 and 72 hours from a time you give it. It does not hold the time you became aware or remind you. Our reading, not a vendor statementsource, 13 October 2026 |
| Keeps a dated record of who decided what — The proof, years later, of what you knew, what you decided and when. The legal-state version is the version of the law and standards the record was written under | Yes. An audit log of who did what, the record of how each finding was handled, and document history. The Record tab on each product shows it. Documents carry the legal-state version they were prepared under. | A transcript. Anthropic’s page gives no general retention period for chats, only that a conversation sent with thumbs up or down feedback is stored for up to 5 years. Google’s page says the default auto-delete for Gemini Apps activity is 18 months and can be set to 3 months, 36 months or indefinite. We could not read OpenAI’s page for ChatGPT on this date (it refused our request), so nothing is stated for it here.source, 13 October 2026 |
| Your AI agent can use it — An agent is an AI assistant that can call other services on your behalf. MCP, the Model Context Protocol, is the common way it does that | Yes, through an MCP endpoint with a Declarable API key. An agent can read your products, open vulnerabilities, Article 14 deadlines and document status, and record a decision under the key’s name for a person to review. API keys are part of the plans with API and CI upload. | Not checked* |
| Where your SBOM goes — Who stores the file you paste or upload, for how long, and whether it can be used to improve their product | On our server, in the region and with the encryption our security page states. An uploaded SBOM or config file is deleted 90 days after upload. | Claude: chats are used to improve Claude when you choose to allow it, when flagged for safety review, or when you opt in to training; the page says content from connectors is excluded and that data may be included “if it’s directly copied into your conversation”. Gemini: “Google uses your activity to provide, develop, and improve its services (including training generative AI models)” with Keep Activity on; with it off, chats are not used to train models unless you send feedback, but are stored for a short period (https://support.google.com/gemini/answer/13594961). We could not read OpenAI’s page for ChatGPT on this date (it refused our request), so nothing is stated for it here.source, 13 October 2026 |
| Says when the law moves — Whether you are told when a rule, deadline or standard you depend on changes | Our legal-state page lists each version of the law and standards we use and what changed. A document keeps the version it was prepared under, so you can see when it is out of date. | Not checked* |
| Cost — What you pay. We give no figure here because prices change; the linked page is the source | See the pricing page. There is a free plan. | Not checked* |
* We have not verified this; it does not mean the product lacks it.
How we checked
- A cell about another product is filled in only from a page we opened and read; it links to that page and shows the date we read it. Cells older than 90 days say so.
- Anything else reads “Not checked”. We have not verified it, and it does not mean the product lacks it.
- Declarable’s current prices are on the pricing page.
- If a cell about your product is wrong, tell us through the About page and we will correct it with a new date.
Want to see what your own SBOM is missing?
Check an SBOMKeep reading
- Firmware components: the identifiers we assign to Zephyr, Yocto and ESP-IDF parts
- Article 14, step by step: from "we became aware" to the final report
- Asking a supplier or an open-source project for CRA evidence: a request you can send
- The CRA and the Radio Equipment Directive side by side: EN 18031, the overlap and the dates
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.