Declarable and CRA template packs, compared
Template packs give you documents to fill in. Declarable is a tool that reads your firmware SBOM and prepares drafts for you to review. Every competitor cell below links to the page we read and the date we read it.
Newest check: 7 October 2026
When another option is the better choice
Our judgement, not a finding from the sources below.
- European Compliance Suite CRA pack: You want a fixed set of finished documents to edit yourself, and you have no use for a tool that reads your SBOM.
- cra-toolkit.com: You want a low monthly price and a general CRA assistant, and your product is not firmware-centred.
- zephyr-cra-starter: You are starting a new Zephyr project and want a free, open-source skeleton to build on.
| Criterion | Declarable | European Compliance Suite CRA pack | cra-toolkit.com | zephyr-cra-starter |
|---|---|---|---|---|
| Price as published — What the vendor’s own page says it costs. Declarable’s current prices are on /pricing | Free tier; Maker plan at €49 a month. Current prices are on /pricing. | €700, plus €300 a year for updates after the first 12 monthssource, 7 October 2026 | Free tier; Founding Member €29 a month, limited to the first 20 customerssource, 7 October 2026 | Free, Apache-2.0 licencesource, 7 October 2026 |
| What you get — Files you edit yourself, or a tool that works on your product data | A web tool and drafts of your documents, for you to review and sign. | Five documents, 58 pages (scope, reporting, technical file, vulnerability handling, declaration)source, 7 October 2026 | A web tool with a document generator and exports (paid tier)source, 7 October 2026 | A Zephyr starter project with CI, a secure-boot setup and CRA basics notessource, 7 October 2026 |
| Reads your firmware SBOM — An SBOM is the list of software parts in your product. This asks whether the offer reads yours | Yes, the free SBOM check reads an SPDX or CycloneDX file. | Not checked* | Lists “SBOM Analysis” in the paid tier; the page does not say which firmware formats it readssource, 7 October 2026 | Its build pipeline has an SBOM step; it is a project template, not a reader of your SBOMsource, 7 October 2026 |
| Keeps watch for new vulnerabilities — Checks your parts again over time and tells you when a new known weakness appears | Saved products are rescanned against known vulnerabilities every day, and an email goes out when a new match appears, following your alert preferences. | Not checked* | The page describes no continuous monitoringsource, 7 October 2026 | Not checked* |
| Article 14 deadline help — Article 14 of the Cyber Resilience Act sets the reporting steps: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report whose date depends on the case. For an actively exploited vulnerability it is due 14 days after a fix or mitigation is available; for a severe incident, one month after the notification is submitted | Works out the three deadlines and prepares the text. It does not file for you. | A reporting document covering the 24-hour, 72-hour and 14-day stepssource, 7 October 2026 | An assistant answers Article 14 questionssource, 7 October 2026 | A SECURITY.md template; no deadline help describedsource, 7 October 2026 |
| Updated when the legal state changes — Whether the offer says its content follows new standards and guidance | Templates and requirement texts carry a legal-state version, shown on the legal-state page. | Twelve months of updates as standards and guidance landsource, 7 October 2026 | Not checked* | No update mechanism describedsource, 7 October 2026 |
* We have not verified this; it does not mean the product lacks it.
How we checked
- A cell about another product is filled in only from a page we opened and read; it links to that page and shows the date we read it. Cells older than 90 days say so.
- Anything else reads “Not checked”. We have not verified it, and it does not mean the product lacks it.
- Declarable’s current prices are on the pricing page.
- If a cell about your product is wrong, tell us through the About page and we will correct it with a new date.
Want to see what your own SBOM is missing?
Check an SBOMKeep reading
- Firmware components: the identifiers we assign to Zephyr, Yocto and ESP-IDF parts
- Article 14, step by step: from "we became aware" to the final report
- Asking a supplier or an open-source project for CRA evidence: a request you can send
- The CRA and the Radio Equipment Directive side by side: EN 18031, the overlap and the dates
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.