Declarable and the priced CRA tools a small maker finds first, compared

If you are pricing tools for the Cyber Resilience Act you will meet these names early, and one of them costs less than our Maker plan. This page says what each one’s own public page says, with the address and the date we read it, and where our product differs. A cell that says “Not stated on the page we read” is silence on that page, not a claim that the tool lacks the feature.

Newest check: 13 October 2026

When another option is the better choice

Our judgement, not a finding from the sources below.

CRA Watch: You ship software from lockfiles and want the Article 14 clock, drafts and reminders at the lowest paid price here, and you need no firmware parsing, no VEX and no declaration draft.
Verimu: You want a permanent free tier with manual scans and SBOM export before you decide to pay, and a mid-priced plan after that.
CRAted: You want a higher-priced plan that covers several products under one subscription, and you want a vendor to run more of it for you; read their page for what that includes.
CRA Ready: You want a flat monthly price at a similar level to ours and its page covers the part of the work you need most.
sbomify: Your main job is publishing and sharing SBOMs with customers, you want a free community plan to start, and you are happy to pay more for a managed business plan.
CRACI: Your software is built in a CI system that is GitHub Actions and you want the build itself to record the SBOM, billed by build minute. Its pages do not mention firmware build files, Article 14 or a declaration, so read them for what you need.
Declarable: Your build is Zephyr, Yocto, ESP-IDF or Buildroot and you need the documents (VEX, declaration draft, technical documentation) as well as the Article 14 clock.

Declarable and the priced CRA tools a small maker finds first, compared
Criterion	Declarable	CRA Watch	Verimu	CRAted	CRA Ready	sbomify	CRACI
Lowest paid price and what it covers — The cheapest plan you pay for: what a month costs and how many products it covers	Maker at €49 a month for 1 product; Studio at €129 a month for 5 products. Prices are net of VAT.	Solo is €19 a month for 1 product; Studio is €49 a month for 5 products. A launch price of €14 a month for the first 100 was shownsource, 10 October 2026	Starter is €49 a month and Professional is €149 a month; paid billing began on 1 September 2026source, 10 October 2026	Pro is €600 a month for 4 products; Elite is €1,000 a month for 10 products. An early-adopter discount has endedsource, 10 October 2026	Starter is $49 a month, flat. A search-engine summary suggested a higher per-version figure; the vendor’s own page did not show it, so we do not report itsource, 10 October 2026	Business is $159 a month; Enterprise is priced on requestsource, 10 October 2026	Pro is $0.002 per vCPU-minute of build time (about $0.004 a minute on the default 2 vCPU), with no monthly fee and no per-SBOM charge. Enterprise is customsource, 13 October 2026
Free tier — Whether you can use something at no cost before you pay, and what it includes	Yes. The Free plan covers 1 product and the Article 14 clock, and the free tools need no account.	A free scan of up to 5,000 packages, checked against CISA KEV, with no accountsource, 10 October 2026	Yes: a permanent Free tier at €0 with manual scans, SBOM export and a weekly digestsource, 10 October 2026	Not checked^*	Not checked^*	Yes: a free Community plansource, 10 October 2026	No named free tier. The page says Pro needs no credit card and that eligible startups get at least 100k free build minutessource, 13 October 2026
Reads firmware build files — Whether it reads what a Zephyr, Yocto, ESP-IDF or Buildroot build writes, rather than only lockfiles of software packages	Yes: it reads the files a Zephyr, Yocto, ESP-IDF or Buildroot build writes and turns them into a list of software parts for you to check.	Not listed among its plan features; the pages we read describe lockfile and SBOM inputsource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not stated on the page we readsource, 10 October 2026	Not mentioned. The ecosystems listed are npm, PyPI, Cargo, Go and OCI registries, recorded during the buildsource, 13 October 2026
Known-vulnerability monitoring — Whether it keeps checking your software parts against lists of known vulnerabilities after the first scan	Yes, for the release you ship now and older releases you still support. Daily monitoring is a paid-plan feature.	Solo lists daily OSV checks and hourly CISA KEV checkssource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*
Article 14 deadlines and drafts — Article 14 of the Cyber Resilience Act sets reporting steps: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later. This asks whether the tool tracks them and drafts the reports	Yes: it works out the three deadlines from the moment you became aware and keeps the incident log and report drafts. It does not file with the authorities for you.	Lists drafts for the 24-hour, 72-hour and 14-day steps, with a countdown and reminderssource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not stated on the page we readsource, 10 October 2026	Not mentioned on its features or pricing page; both refer to the Cyber Resilience Act in general termssource, 13 October 2026
VEX — A VEX is a statement of which known vulnerabilities in your software parts actually affect your product, and which do not	Yes: it produces a VEX file for a product from your findings, for you to review.	Not listed among its plan featuressource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not checked^*	VEX supported; findings are triaged and sent to the team that owns the fixsource, 13 October 2026
Declaration of conformity draft — The EU declaration of conformity is the signed statement that a product meets the Cyber Resilience Act. A draft is a starting text for you to review, not the declaration itself	Yes: a declaration draft, ready for your review and signature. It is not the declaration until you check and sign it.	Not listed among its plan featuressource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not mentioned on the pages we readsource, 13 October 2026
Technical file (Annex VII) draft — Annex VII lists what the technical documentation for your product must contain. A draft is a starting text for you to review	Yes: technical documentation drafts, ready for your review. They are a starting text, not a finished file.	Not listed among its plan features; Solo lists a documents pack and a CycloneDX exportsource, 10 October 2026	Not checked^*	Not checked^*	Not checked^*	Not checked^*	Not checked^*
Whole price is public — Whether every plan shows a price on the page, or some need a quote or a call	Yes, for the plans on /pricing.	Yes for the two paid plans we readsource, 10 October 2026	Yes for the three plans we readsource, 10 October 2026	Yes for the two plans we readsource, 10 October 2026	The Starter price is shown; we did not record the other planssource, 10 October 2026	Business is public; Enterprise is customsource, 10 October 2026	Pro is public; Enterprise is custom, by talking to salessource, 13 October 2026

* We have not verified this; it does not mean the product lacks it.

How we checked

A cell about another product is filled in only from a page we opened and read; it links to that page and shows the date we read it. Cells older than 90 days say so.
Anything else reads “Not checked”. We have not verified it, and it does not mean the product lacks it.
Declarable’s current prices are on the pricing page.
If a cell about your product is wrong, tell us through the About page and we will correct it with a new date.

Want to see what your own SBOM is missing?

Check an SBOM

Keep reading

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.