Declarable’s free tools and other free CRA tools, compared
You may have tried a free scope checker or an open-source script before landing here. They do different jobs, and so do our free tools. Our free tools are web pages with no command-line tool; our paid product uploads from CI with a GitHub Action, a GitLab job or a shell script, and the table says which is which. Every competitor cell below links to the page we read and the date we read it; where a page does not say, the cell says we did not check.
Newest check: 11 October 2026
When another option is the better choice
Our judgement, not a finding from the sources below.
- CRA Bureau scope checker: You want a scope reading with a PDF and obligations cited to the provision, and you are happy to use their sign-in.
- starcaller.uk CRA Compliance Kit: You want a script that runs on your own machine, so nothing leaves it, and you are comfortable working from the command line.
- Ambolt cra-check: You want an SBOM check that runs in your own CI pipeline, as a published package and GitHub Action, and you do not need the Article 14 deadlines.
- CRA Evidence (free tools and platform): You want a hosted platform with a published command-line tool and a security page, you are happy to ask for a price, and you want the SBOM, HBOM and VEX kept per version.
- cyberresilienceact.eu toolbox: You want a wider set of free tools with no sign-up in one place, such as a cost calculator and a support-period planner, and you do not need the Article 14 deadlines worked out.
- SBOMReady (sbomready.eu): You have an SPDX tag-value file or a mobile app SBOM, or want a radio-equipment (RED-DA) reading, and a one-off report is enough: its page lists those inputs and mentions no sign-up.
| Criterion | Declarable free tools | CRA Bureau scope checker | starcaller.uk CRA Compliance Kit | Ambolt cra-check | CRA Evidence (free tools and platform) | cyberresilienceact.eu toolbox | SBOMReady (sbomready.eu) |
|---|---|---|---|---|---|---|---|
| Needs an account — Whether you must sign up or pay before you can use it | No. All five run without an account: the scope check, the Article 14 clock, the SBOM check, the declaration draft and the security.txt generator. | The page shows “Free to start · from €99/month” and sign-in options, and says “Nothing is stored against you until you ask for the PDF”. It does not say plainly whether an account is neededsource, 9 October 2026 | The page sends you to Stripe Checkout with a work email for the subscription tierssource, 9 October 2026 | MIT licence. The page describes a package and a GitHub Action and mentions no sign-up or pricesource, 10 October 2026 | The two free tools, an applicability checker and a role quiz, need no account. The platform is paid: every tier is priced “Custom”, with a 14-day free trialsource, 10 October 2026 | No: the page says “No sign-up” for every toolsource, 11 October 2026 | The page shows an upload box and a scan button and mentions no sign-up, account or price. Its structured data lists the offer at 0 EURsource, 11 October 2026 |
| Where it runs — In your browser tab, as a script on your own machine, or on the vendor’s server. It decides where your data goes | In your browser tab. The declaration draft and security.txt are made in the tab and nothing is sent. For the SBOM check, only component names, versions and identifiers (package URL, CPE) are sent, to look up known vulnerabilities. | Not checked* | Installed with pip on your own machinesource, 9 October 2026 | On the runner of your own CI job: “Nothing leaves the runner unless you enable `osv`”, which sends package names and versions to the public OSV databasesource, 10 October 2026 | The platform is “Hosted in the European Union (Dublin, Ireland)”. The page does not say where the free tools runsource, 10 October 2026 | Not mentioned on the pagesource, 11 October 2026 | On their server: “SBOM processing happens entirely in request memory. None of the uploaded or pasted files are stored on disk.” The page does not say where that server issource, 11 October 2026 |
| What it reads — The input it works from: answers to questions, or a file such as an SBOM (the list of software parts in your product) | Answers to questions (scope check), the time you became aware (clock), an SPDX or CycloneDX file (SBOM check), the Annex V points about your product (declaration draft), or your contact details (security.txt). | Eight questions about your product typesource, 9 October 2026 | Matches entries against your SBOM; it can also generate SBOMssource, 9 October 2026 | An SBOM; a repository check also looks at the repository’s security policy and contact, SBOM export and releasessource, 10 October 2026 | Free tools: an 11-question applicability wizard and a role quiz. Platform: CycloneDX or SPDX SBOMs, with HBOM and VEX per versionsource, 10 October 2026 | Eight tools. Inputs include an SBOM (Vulnerability Analyzer), product category (Classification Finder) and component end-of-life dates (Support-Period Planner)source, 11 October 2026 | An SBOM you upload or paste: “CycloneDX JSON, SPDX JSON or SPDX Tag-Value”, from tools such as esp-idf-sbom, west spdx, yocto, syft, cdxgen or trivy. Two tick boxes say whether the product has radio interfaces or is a companion mobile appsource, 11 October 2026 |
| Cites its legal source and date — Whether it names the law it follows and says when that was last checked | The scope check, the clock and the declaration draft show the legal-state version they follow. | Cites Regulation (EU) 2024/2847 with a link to EUR-Lex, and says each obligation is cited to its provision; no check date seensource, 9 October 2026 | Names Regulation 2024/2847, in force 10 December 2024, with reporting obligations from 11 September 2026; no check date seensource, 9 October 2026 | Not checked* | Not checked* | Cites Regulation (EU) 2024/2847; no check date seen on the pagesource, 11 October 2026 | Names Regulation (EU) 2024/2847 in a disclaimer that calls the result “a preliminary analysis” and not legal advice; no check date seensource, 11 October 2026 |
| Article 14 deadlines — Article 14 of the Cyber Resilience Act sets reporting steps: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later | The Article 14 clock works out the three deadlines from the moment you became aware. It does not file for you. | Not on the page; it links a separate deadline calendar guide that we did not readsource, 9 October 2026 | Describes the 24-hour, 72-hour and 14-day steps, and a 24-hour clock started by a matchsource, 9 October 2026 | Not mentioned on the pagesource, 10 October 2026 | Describes an early warning within 24 hours, a notification within 72 hours and a final report; the page does not name Article 14. The free tools cover applicability and role, not the clocksource, 10 October 2026 | Not mentioned on the pagesource, 11 October 2026 | Not mentioned on the page we read, its home page. Its blog has posts we did not readsource, 11 October 2026 |
| Final report for a severe incident — For a severe incident, Article 14 asks for a final report one month after the notification is submitted. That is a different clock from the 14 days after a fix for an exploited vulnerability | The clock works out both final-report dates: 14 days after a fix is available for an exploited vulnerability, and one month after the notification is submitted for a severe incident. It works out a date; it files nothing. | Not checked* | Not checked* | Not mentioned on the pagesource, 10 October 2026 | Yes: “one month after the incident notification for incidents”, against “14 days after a corrective measure is available for vulnerabilities”source, 10 October 2026 | Not mentioned on the pagesource, 11 October 2026 | Not mentioned on the pagesource, 11 October 2026 |
| Command-line tool or CI action — Whether you can run it from a terminal or a build pipeline, not only in a web page | The free tools: no, they are web pages. The paid product: yes, to upload. We publish a GitHub Action, a GitLab CI job and a shell upload script that send your SBOM from a build, and the upload exits non-zero if your gap threshold is crossed. They upload; they do not scan or show status from the terminal. | Not checked* | Yes: it is installed with pip and run on your own machine, which our free tools are notsource, 9 October 2026 | Yes: a published package (@ambolt/cra) and a GitHub Action for CI. We also publish a GitHub Action, for uploading an SBOM to the paid product; it is not a check like theirssource, 10 October 2026 | Yes: a published command-line tool (upload-sbom) to upload, scan and check status from the terminal. We publish CI upload files (a GitHub Action, a GitLab job and a shell script) but they only upload; scan and status from the terminal are theirssource, 10 October 2026 | Not mentioned on the pagesource, 11 October 2026 | The page describes a web upload form only; it does not mention a command-line tool or CI actionsource, 11 October 2026 |
| What you get at the end — What you can take away when you finish | Readings on screen for the scope check and the clock, for you to check. Files you can download without an account: a CycloneDX 1.6 SBOM draft, the declaration draft (print or download), the security.txt file and a draft disclosure policy. All are drafts for your review, not a ruling. | Whether the product is in scope, your role, the Annex III class, the assessment route and the obligations that follow; a PDF is offeredsource, 9 October 2026 | CycloneDX or SPDX SBOMs, VEX statements and matching reports, depending on tier; MIT licence for core modules, paid tiers from £500 a yearsource, 9 October 2026 | Checks against 9 SBOM minimum elements, known vulnerabilities, licence risks and the repository, written to the job summary; the page says “Information only”source, 10 October 2026 | Free tools give a reading. The platform keeps SBOM, HBOM and VEX per version. Its security page states TLS 1.2 or higher, AES-256 at rest and “Acknowledged within 3 business days” for vulnerability reportssource, 10 October 2026 | Exportable checklists, cost estimates, vulnerability assessments (the analyzer cross-references an SBOM against NVD and EUVD) and an EU Declaration of Conformity documentsource, 11 October 2026 | “An instant detailed report of vulnerabilities (CVEs), alignment with EU regulation (CRA / RED-DA) and dependency quality metrics”, for one upload. The page does not say whether it keeps watching the SBOM afterwards, and does not mention a downloadsource, 11 October 2026 |
* We have not verified this; it does not mean the product lacks it.
How we checked
- A cell about another product is filled in only from a page we opened and read; it links to that page and shows the date we read it. Cells older than 90 days say so.
- Anything else reads “Not checked”. We have not verified it, and it does not mean the product lacks it.
- Declarable’s current prices are on the pricing page.
- If a cell about your product is wrong, tell us through the About page and we will correct it with a new date.
Want to see what your own SBOM is missing?
Check an SBOMKeep reading
- Firmware components: the identifiers we assign to Zephyr, Yocto and ESP-IDF parts
- Article 14, step by step: from "we became aware" to the final report
- Asking a supplier or an open-source project for CRA evidence: a request you can send
- The CRA and the Radio Equipment Directive side by side: EN 18031, the overlap and the dates
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.