Consultants and representatives

Keeping one Cyber Resilience Act record for every client

You act for several makers. Each one needs a dated Cyber Resilience Act record that has to be kept for ten years, and today that record lives in email threads, shared drives and a chat window that scrolls away. With thirty clients, nobody can say which version of which document went to whom.

You are also asked questions a tool should not answer for you: whether a client is covered, whether a document is good enough. Those stay your judgement. What you need is the record underneath them, one per client, that shows who did what and when.

Check an SBOM, free

What the Cyber Resilience Act asks of you

Authorised representative tasks — if a maker outside the EU appoints you by written mandate, you keep its declaration of conformity and technical documentation available to the authorities, give them information on a reasoned request, and cooperate on action to remove risks (, source)
Keeping the record — the maker keeps its declaration of conformity and technical documentation for at least 10 years after the product is placed on the market, or for the support period if that is longer (, source)
Reporting to ENISA — telling the EU cybersecurity agency about an actively exploited flaw or a severe incident, in three steps, which you may be asked to help a client with (, source)

“A manufacturer may, by a written mandate, appoint an authorised representative.”
Regulation (EU) 2024/2847, Article 18(1), checked on 2026-10-09, as recorded in legal state 2026.10.13-1.

What Declarable does about it

Keeps one organisation per client, with you as a member of each, and lets you switch between them in one click.
Exports each client's document bundle with a cover sheet and a SHA-256 manifest of every file.
Hands a bundle over by a link that expires, with an access log showing who opened or downloaded it.
Counts the Article 14 deadlines from the moment your client became aware, and keeps the incident record.

What it does not do

It does not sign anything for your client. The declaration is the maker’s to sign.
It does not say a client is compliant or certified. It prepares drafts and keeps records for you to review.
It does not replace a notified body where a product needs one.
It does not give legal advice, and it does not file reports for you. You submit them yourself on the ENISA platform.

Questions

Is there a consultant price?: Not yet. Tell us how many clients you act for and we will talk.
Can my client see what I did?: Yes. The record names who did what, so a client who is a member of its own organisation can read it.
Where is the data held?: The security page says where the data is held and who processes it: /security.
Can I talk to someone about how I would use it?: Yes. We are talking to the first ten firms this month. Write to saddam@declarable.com with the subject "Consultants".

Check an SBOM, free

What Declarable is, and what it is not

A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
Not legal advice. For a legal question about your product, ask a lawyer.
Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
Not an assessment body. Some products need an outside assessment body: an An important product, class I. Self-assessment (module A) is open only if its maker applies in full a harmonised standard, a common specification or a European cybersecurity certification scheme at assurance level “substantial” or higher; otherwise a notified body takes part: modules B and C, or module H (Article 32(2)). Open-source software whose technical documentation is public may self-assess (Article 32(5)). product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Keeping one Cyber Resilience Act record for every client