- Tell you spreadsheets are unprofessional.
- Invent hours saved or a cost-of-manual-work figure. We publish no hour estimates, because we have no defensible basis for one.
- Suggest software makes anyone CRA compliant.
Comparison
Your spreadsheet is a real compliance system. Until it isn't.
Most CRA work today runs on a shared sheet, a folder of documents and one person who remembers everything. That is a legitimate starting point, and for some products it is genuinely enough. This page is about the specific point where it stops being enough - and about the parts no software takes off your hands.
Credit where it is dueNearly free, immediately Everybody already knows it Infinitely flexible Completely transparent
Why a spreadsheet is a perfectly rational starting point.
Start without procurement.
No procurement, no security review, no vendor. You can start on a Tuesday afternoon and have something by Wednesday.
One grid, no training.
Engineering, legal, sales and an external consultant can all read the same grid without training or a licence.
Add the column you need.
No product's data model constrains you. When your understanding of the regulation changes, you add a column.
Nothing is derived behind your back.
Every cell was typed by someone, and you can see all of it at once.
The boundary
A spreadsheet can carry a lot. It cannot carry everything forever.
For one small product with few releases, a slow dependency profile and one person genuinely accountable, a well-kept spreadsheet can carry CRA evidence work for a long time. The boundary is specific: a second product, a second person who has to answer for the record, or the first reviewer who asks where a claim came from and when it was last true.
One product
A narrow, stable scope is easy to keep visible.
One owner
One person can still explain every cell.
One release rhythm
Manual updates are still proportional.
Then the record needs lineage
Evidence, approvals and changes must survive the next release and the next reviewer. ConformOps offers an inspectable lineage view with release, run and artifact selection, bidirectional recorded links and visible missing or invalidated state. Older runs require retained Continuous history access.
Side by side
The same twelve jobs, done two ways.
Left column: a disciplined manual system, not a bad one. Right column: implemented ConformOps behaviour.
QuestionSpreadsheet and manual processConformOps
Cost
Software cost to start€0, or whatever your office suite already costs.€0 for a free preview product. €99 once for a full assessment; €79/month or €790/year per assignable slot to keep one product current.
Total operational costThe work itself: locating evidence, copying references, chasing owners, re-checking after every release. Free software does not make compliance free - but only you can price your own time, so we will not do it for you.Licence plus the human work that remains: decisions, approvals, the risk assessment, and writing the things that were never in the repository.
Requirements and evidence
CRA requirement trackingManually maintained rows and checklists. Accurate on the day someone updates them; ageing quietly after that.Versioned requirements with a controlled assessment state per release, each carrying its legal citation and its evidence or its gap.
Evidence collectionLinks, notes, attachments and references copied by hand from repositories, wikis and chat.Release and source evidence collected from a sanitized snapshot, with supplied SBOMs accepted as release evidence.
Evidence traceabilityEntirely a function of discipline. A link to a file on a branch that has since moved is the usual failure.Structured provenance: repository, ref, commit, release, run, path, line and code-point span, hashes, collector and redaction policy.
Release changesDuplicate the tab, rename it, diff by eye, hope nobody edits the old one.Point-in-time assessments with enriched deltas: what closed, with the evidence that closed it, what the change re-opened, what components and matches are new.
Components, vulnerabilities, reporting
SBOM and vulnerabilitiesExternal tools produce the data; somebody transcribes a summary into the sheet, usually less often than the data changes.Component inventory, OSV correlation, CISA KEV context and append-only affectedness decisions, all inside the same evidence chain as the requirements.
Article 14 reporting readinessManual timers, a named owner if you are organised, and a document nobody has rehearsed. The 24-hour clock is unforgiving of this.Case records with deadline state against a recorded awareness time, a named runbook per product, drills kept marked as drills, and a workspace register. The product readiness overview separates these operations from evidence, approvals, intelligence health and paid access.
Output, audit, people
DocumentationWord and Excel templates assembled by hand, with the usual risk that the document and the sheet disagree.Controlled working artifacts generated from the current assessment - Annex V, Annex II, an Annex-VII-oriented record, registers and a workbook - hashed, versioned, and visibly marked where fields are still missing.
AuditabilityAchievable with excellent process and version history, and genuinely done by some teams. It is manual, and it fails silently when someone is busy.Append-only history and audit register: decisions are appended to the exact assessment they were made against, never overwritten, and exportable.
Collaboration and external reviewEmail, Drive or SharePoint. Access control is a link setting, and what the reviewer sees is whatever the file contains.Workspace roles with approvals limited to Owner or Admin, plus revocable reviewer shares that carry requirement states and cited locators rather than raw evidence.
Human judgmentYours. Scope, classification, risk, exploitability, the declaration.Also yours. Identical list, held as explicit gates with a named person and a date - but not removed, reduced or delegated to software.
On narrow screens each job becomes a card with both answers stacked beneath it. Nothing is hidden behind a horizontal scroll.
The actual decision
Two lists. Read them honestly and you will know.
The scope is small, stable and owned.
- You have one small product, in one CRA scope.
- Releases are infrequent, and dependencies barely move between them.
- One person owns compliance, knows the product, and is not about to leave.
- Nobody outside the company has yet asked to see the evidence.
- You are still mapping initial scope, and the shape of the work keeps changing.
- You do not need automation yet - you need to understand the obligation.
The record has to outlive a person and a release.
- There are several products, or several active releases of one.
- Evidence is scattered across repositories, CI systems and wikis.
- Vulnerability handling has become continuous rather than occasional.
- SBOMs and affectedness decisions change with every release.
- More than one person approves things, and you need to know who did.
- Customers or auditors have started requesting evidence directly.
- Article 14 operational readiness has to actually exist, not be a plan.
- You need to reproduce, months later, why a decision was made and on what basis.
What does not change
Software does not absorb your accountability. This is the part of the comparison a vendor is tempted to blur. Moving off a spreadsheet changes how evidence is collected and kept. It does not move a single legal responsibility.
Still you
Deciding final scope, classification and substantial modification
Performing and signing off the cybersecurity risk assessment
Judging whether a vulnerability affects your release
Still you
Deciding a report is due, and submitting it to a CSIRT or ENISA
Completing the technical documentation and issuing the declaration
Notified-body assessment, certification and CE marking are outside both.
Cost, stated plainly
Read the units before the numbers.
One side has a price. Both sides have a cost. You can compare the licence honestly. You cannot compare the labour honestly without knowing your own team, so we have left that arithmetic to you.
Spreadsheet and manual process
Software€0
€0
Where the cost actually sitsyour team's work
Finding evidence again each release · Transcribing SBOM and vulnerability data by hand · Chasing owners for status, then re-checking it · Reconstructing the reasoning when someone asks later · The cost of a gap nobody noticed had re-opened
ConformOps · published prices
Free Preview · 2 active preview products€0
Archiving releases the active Free allocation.
Full Assessment · one-time, per product€99
Continuous · per assignable slot€79 /mo · €790/yr
Portfolio · five active products€249 /mo · €2,490/yr
No seats, no scan credits. Releases are unlimited within a product. Cancelling never deletes evidence - the product becomes a read-only historical record.
The honest comparison
A manual system is still a system.
The page compares a disciplined spreadsheet process with implemented ConformOps behaviour. It does not claim a licence replaces the work only a manufacturer can do.
No invented savings
We do not publish hours saved or a cost-of-manual-work estimate. Your team is the only defensible source for that arithmetic.
No compliance shortcut
Software changes evidence operations. It does not decide scope, classification, risk, affectedness, reporting or declaration for you.
Use the smallest thing that works
If a well-kept sheet is enough for your product and your accountability model, keep it. Move when the record's demands change.
Readiness assistance, not legal certification. ConformOps does not give legal advice, issue declarations of conformity or remove manufacturer accountability.
Free preview · 2 products · no card
Assess a product