It appears often below. It means Regulus's public material does not describe that capability - not that Regulus cannot do it. Regulus also publishes good educational content on SBOMs and vulnerability handling; we deliberately do not count an explainer as a platform feature, in either direction.
Comparison · last verified 24 August 2026
Guided CRA planning, or release evidence operations.
These two products are less alike than the category name suggests. Regulus's published material is about helping a team understand and structure CRA work: applicability, classification, role, a requirements matrix, a roadmap, documentation templates. ConformOps assumes you already know you are in scope, and works on the evidence behind each requirement.
The short answerRegulus may fit better when ConformOps may fit better when
Which problem do you have first?
You need to work out what the CRA asks of you at all.
Nobody has yet established whether the regulation applies, which class the product falls in, or whether you are the manufacturer, importer or distributor. You want a tailored requirements matrix, a roadmap, documentation templates, an evidence structure to fill in, and guidance on what a CRA technical file has to contain. That is a real and separate piece of work, and it usually comes first.
You know the shape of the work and now need the evidence.
You are a software manufacturer with real repositories and releases. The problem is collecting the material that supports each requirement, keeping exact source and legal provenance, tracking what is still missing, operating SBOM, vulnerability and affectedness decisions, holding Article 14 case records, and keeping all of it current across releases.
Two starting points
Where each product begins.
Regulus lane: capabilities its own public material emphasises. ConformOps lane: implemented behaviour. Plenty of teams do both in sequence: establish scope and classification with guidance, then run the evidence and documentation operations against actual releases.
ApplicabilityIs the product in CRA scope, and in what capacity?
Scope wizard and guidance-led starting point.
Classification and roleProduct class and manufacturer, importer or distributor duties.
A structured regulatory planning question.
Requirements matrixA tailored set of obligations and a compliance roadmap.
The sequence of work is made explicit.
Templates and trackingDocumentation templates, evidence structure, technical-file guidance and readiness tracking.
A guided record to work into.
Release evidenceBounded repository material and supplied SBOMs, sanitized and pinned to a commit.
The source snapshot stays tied to its release.
Cited requirement stateEvidenced, partial, gap or not applicable, with the source span behind it.
Versioned rules keep the legal basis visible.
Gap or human decisionRemediation register, risk register and approval gates held for an accountable person.
Software proposes; a person decides.
Controlled outputAnnex-oriented drafts, registers, workbook and reviewer share, each hashed and versioned.
The output remains visibly a working record.
Side by side
20 buyer questions.
Regulus column: publicly documented material as of 24 Aug 2026. Educational content is not counted as a platform capability.
QuestionConformOpsRegulus
Scope, classification, planning
Primary approachEvidence operations: collect release and source evidence, map it to cited requirements, record decisions, produce controlled documents.Guided CRA structuring: understand the obligation, plan the work, document it.
Applicability guidanceNot offered as advice. You record the product facts; ConformOps does not tell you whether the CRA applies.CRA applicability checking, including a scope wizard.Regulus stronger
Classification and role workflowCategory and market role are recorded facts; a route is derived for default, Important Class I and II and critical products, and a classification gate is held open for a human.Product classification and manufacturer, importer or distributor role determination.Regulus stronger
Requirements mappingRequirement register per release with a state and the evidence or missing work behind each line.Tailored CRA requirements matrix and a compliance roadmap.
Evidence and provenance
Repository / source ingestionRead-only GitHub App import, whole-repository upload, or focused files. A bounded text subset, sanitized before storage, never executed.Not publicly documented
Source-level provenanceSource path with 1-based lines and code-point columns, plus commit, release, snapshot, run, hashes, collector and redaction policy.Not publicly documented
Legal provenanceVersioned rules with authority kind, legal effect, publisher, citation, URL, locator, retrieval date and content fingerprint; binding law separated from guidance.Publishes CRA technical-documentation and scope material. Rule-level versioned citation records are not publicly documented.
Release-bound evidenceAssessments, SBOMs, findings, decisions, artifacts and deltas are all tied to the release they describe.Not publicly documented
SBOM, vulnerabilities, reporting
SBOM handlingSupplied CycloneDX JSON or SPDX JSON becomes the release inventory, retained with its own hash; a derived inventory is read from recognised dependency documents when none is supplied.Publishes educational SBOM material. Product ingestion and normalisation as an operational feature is not publicly documented.
Vulnerability intelligenceOSV matching across eleven ecosystems, with non-correlatable components named rather than dropped, and outages shown as degraded.Publishes vulnerability-management guidance. Specific live intelligence sources are not publicly documented.
Known exploitation (KEV)CISA KEV context refreshed hourly, three-valued per CVE, with a visible degraded state.Not publicly documented
Affectedness / VEX lifecycleUnder investigation, affected, not affected, fixed - append-only per release, component and vulnerability, with justification and evidence.Not publicly documented
Article 14 operationsCase records on a recorded awareness time, 24-hour, 72-hour and final-report clocks, named runbook, marked drills, workspace register. ConformOps never submits.Case and awareness-clock machinery is not publicly documented.
Continuous monitoringDaily dependency and OSV monitoring on Continuous, plus enriched release deltas and run comparison.Readiness tracking is documented; automated release monitoring comparable to this is not publicly documented.
Documentation, decisions, commercial
Technical documentationWorking artifacts generated from the current assessment: Annex V declaration draft, Annex II draft, Annex-VII-oriented record, registers and workbook - hashed, versioned, and visibly incomplete where evidence is missing.Documentation templates, evidence structure and CRA technical-file guidance.Stronger on structure and templates
Human decision modelScope, classification, risk, affectedness, documentation and declaration gates need Owner or Admin authority; decisions are appended to the assessment they were made against.Guidance positions the manufacturer as the decision-maker; in-product gates are not publicly documented.
Audit and historyAppend-only audit register with CSV export, assessment history, point-in-time affectedness history, comparison of any two completed runs.Not publicly documented
AvailabilitySelf-service sign-up, free preview product, published prices.Resource pages refer to an Early Access programme while the homepage carries “Start Now” pricing calls to action. We draw no conclusion from that - ask Regulus what is generally available today.
Pricing€0 free preview · €99 one-time per product · €79/month or €790/year per assignable coverage slot · €249/month or €2,490/year for five slots.Basic €2,500/year · Pro €15,000/year · Enterprise custom.
Best fitA software manufacturer with real releases that needs collected evidence, provenance, ongoing operations and controlled outputs.A team that needs a guided regulatory starting point: applicability, classification, requirements structure, roadmap and documentation templates.
On narrow screens each capability becomes a card with both answers stacked beneath it. Nothing is hidden behind a horizontal scroll.
Two honest cautions
Read this before you treat the table as a scoreboard. A page full of “not publicly documented” can look like a page full of gaps. It is not. It reflects two products written up for different buyers, and one comparison we deliberately refuse to make.
Guidance is not a lesser product, it is a different purchase
Calling Regulus “just templates” would be both rude and wrong. Structuring CRA work - deciding what applies, in which class, with which obligations, in which order - is genuinely difficult, and getting it wrong makes every downstream artifact worthless. If that is your open question, a guided product is the right first spend, and ConformOps will not answer it for you: we hold a classification gate open and wait for a human.
Published explainers are not platform features
Regulus publishes educational material on SBOMs and vulnerability handling. That tells you the team understands the subject; it does not tell you that the platform ingests a CycloneDX document, correlates it against a feed, or records an affectedness decision. We have not counted it as either. If those operations matter to you, ask for a demonstration of the running feature - and apply exactly the same test to us.
Published prices, 24 August 2026
Read the units before the numbers.
Annual programme, or assignable product coverage. Regulus prices an annual engagement per organisation tier. ConformOps prices per Organization-owned coverage slot. What is inside each is not the same work, so treat the numbers as context rather than a like-for-like quote.
ConformOps per product
Free Preview€0
2 active preview products, deliberately partial. Archiving releases the active Free allocation.
Full Assessment€99
One-time per product, with a 14-day remediation verification window.
Continuous€79 /mo · €790/yr
One assignable slot: releases, monitoring, history, refreshed artifacts.
Portfolio€249 /mo · €2,490/yr
Five active products included; €49/month or €490/year each thereafter.
Regulus annual
Basic€2,500 /yr
“CRA applicability, classification and exportable report.”
Pro€15,000 /yr
“Full compliance roadmap, documentation and updates.”
EnterpriseCustom
“Multi-product support and dedicated compliance workspace.”
Quoted from Regulus's published pricing on 24 Aug 2026. Tier contents are their wording, not our summary. One annual guidance engagement and one per-product evidence subscription are not substitutes, and dividing one by the other produces a number that means nothing. If you need both kinds of work, budget for both.
Decide
Buy for the question you cannot answer today.
You ship software and the evidence is in repositories, CI and release material.
You need each conclusion traceable to a source span and a legal citation. SBOMs, vulnerabilities and affectedness decisions change with every release. You want Article 14 case records in place before 11 September 2026. Someone will eventually ask you to reproduce why a decision was made months ago.
“Does the CRA even apply to us, and as what?” is still open.
You need a tailored requirements matrix and a sequenced roadmap before anyone collects evidence. You want documentation templates and an evidence structure to work into. Your product is not software-repository-shaped, so source evidence is not where your proof lives.
Methodology and sources
A dated comparison with a clear boundary.
Last verified 24 August 2026. Regulus statements come from its own homepage and pricing, CRA scope wizard, technical-documentation material and vulnerability-handling pages on that date.
Silence is not absence
“Not publicly documented” means their material does not describe it. It is not a claim that a capability is missing, and it should not be read as one.
Education is not capability
Published explainers about SBOMs or vulnerability handling are not counted as platform features on either side of the table.
Availability unresolved
Their material carries both Early Access language and live pricing calls to action. We state the ambiguity rather than resolving it in our own favour.
Corrections welcome
If a row is materially wrong, tell us and we will fix it. Write to help@conformops.eu .
Regulus and other product and company names are trademarks of their respective owners. This comparison is published for information only and is not affiliated with or endorsed by any other vendor. Nothing here is legal advice.
Free preview · 2 products · no card
Assess a product