01 · 4 min
Answer six questions about the product
What it does, who ships it, how it is distributed, how long you support it. These become the legal facts the rest of the file hangs off - and you can change them later.
Your CRA technical file, built from the code you already ship.
Point ConformOps at a repository. It reads your manifests, lockfiles, CI, SBOMs and security docs, maps what it finds to the regulation, and hands back the evidence package - with every conclusion linked to the exact file and line it came from.
- Read-only repository access
- Secrets redacted before storage
- Your code is never executed
- annex-v-declaration-draft.mdneeds approval
- annex-ii-information.mdworking draft
- technical-documentation.mdAnnex VII oriented
- cyclonedx-sbom.json218 components
- evidence-traceability.csvline-level
- compliance-gaps.csv7 open
- conformops-evidence-workbook.xlsxfor reviewers
Drafts stay marked as drafts. Nothing here is a declaration of conformity until you approve it - and the approval is recorded against the exact assessment it was based on.
Reporting obligations applyin force since 11 Sep 2026 · what to report now
439until the main obligations · 11 Dec 2027
Commission source A real assessment, not a screenshot
Look inside before you sign up.
This is the output for an example .NET desktop product. Click through the tabs - the numbers, paths and line ranges are the shape of what you get.
aurora-desktop · commit 9f4c1ab · ruleset cra-rules@2026.07
Evidence coverage
64%
18 of 32 requirements have source-backed evidence. Coverage is not compliance - it tells you how much of the file writes itself.
4 approval gates open
Do this first
Write down who decides in the first 24 hours
Your SECURITY.md covers intake, but nothing records who decides an early warning is due, or how the 72-hour notification gets filed.
CRA Art. 14writing, not engineeringunblocks the declaration gate
Three steps, then it maintains itself
How a first assessment actually goes.
02 · minutes
Connect the repo or drop the files in
Read-only GitHub App, a ZIP, or just the files that matter: manifests, lockfiles, CI, SECURITY.md, SBOMs. Secrets are redacted first. Nothing is run.
03 · ongoing
Work the gap list, keep the file current
Each gap reads like a ticket. When you ship again, ConformOps re-runs, tells you what changed, and invalidates only the conclusions the change touched.
The honest comparison
Choose the evidence path that fits how you ship.
Consultants add valuable judgement and spreadsheets offer a familiar starting point. ConformOps connects source evidence, actions, and release history so the record keeps moving with the product.
ConformOpsConsultantSpreadsheet
Starts fromyour repositoryinterviewsa blank template
First evidence in handthe same afternoonweekswhenever someone fills it in
Traceabilityfile, line, commit, hashprose referencescopy-paste
When you ship a releasere-runs, shows the deltanew engagementmanual re-edit
Cost€99 once, €79/mo to keepday ratesyour team's weeks
Who signs the declarationyou, on the recordyouyou
What we do with your code
The boring answer is the reassuring one.
You are handing a compliance tool your source. Here is exactly how far it goes, in the same words we use in the codebase.
- Read-only, repository-scoped, short-lived
The GitHub App asks for repository contents, read. Tokens are encrypted, expiring, and minted per import for the one repository you picked.
- Secrets are redacted before anything is stored
Redaction happens before persistence, before indexing, and before any model call. Paths and line numbers stay so the evidence remains checkable.
- Your code is never executed
No builds, no scripts, no hooks. Only a bounded text subset - docs, manifests, build files, common source extensions - is read.
- Raw uploads do not survive ingestion
ZIPs are streamed, not kept. Temporary objects are deleted once the sanitized snapshot exists, and abandoned ones expire within 24 hours.
- AI can suggest. It cannot conclude
Optional model proposals are stored with their prompt and snapshot version. They cannot mark a requirement met, approve a risk, choose a route, or sign a declaration.
Pricing in one line
See the full pricing page One price per product. No seats, no scan credits.
A product can hold several repositories and components inside one CRA scope · Portfolio is €249/mo for five active products
Free, no card, 2 products
Start the free assessment