Compare, by category of tool
What is already used to keep a product's file, sorted by category and not by vendor: the question each one answers, its unit, its continuity, Art. 14 and the EU declaration. Then where euvex stops. No commercial vendor named, no price.
Survey of
Five categories, five questions
In rows, what each category does. In columns, who answers what. The last row is euvex, on the same criteria.
| Category | The question it answers | The unitorganisation, software, product and version | ContinuityCRA, Art. 31 and 13(13) | Art. 14CRA · applicable from 11.09.2026 | The EU declaration of conformityCRA, Art. 28(3) · Machinery, Art. 21(3) |
|---|---|---|---|---|---|
| The file kept by hand | Whatever you ask it: it contains what you put in it, as of the date you put it there. | Whichever you choose, often one document per product, sometimes one per act. | As much as the person who keeps it. Every update is a step, and a vulnerability published after the last review is not in it until someone goes looking for it. | Possible by hand: learning that a component of the product carries an actively exploited vulnerability, then keeping three deadlines, the first at 24 hours. | Written by hand. One for every act that requires one, as the law provides, which means reconciling documents kept separately. |
| Open source SBOM generators | “What is this software made of today?” Some, like Trivy, also check the list against known vulnerabilities on the day they run. | The software, image or folder they are given, at the moment they run. | A snapshot. To follow a product over time, they have to be run again, in continuous integration for instance, and each result kept. | Outside their purpose. | Outside their purpose. |
| Open source SBOM analysis platforms | “Which components of my software portfolio are affected by a known vulnerability?” | The application and each of its versions, from the SBOM it is sent. | Yes, on the SBOMs it is sent: that is its purpose. The server has to be installed, fed and kept up to date by you. | Not its purpose: its documentation, as of the survey date, mentions neither a reporting file nor the Art. 14 deadlines. | Outside its purpose. |
| Organisation-level compliance platforms | “Is my company in order?” Policies, controls and evidence, for one entity. | The organisation: one entity, its teams, its systems. | Built to last, at the scale of the organisation: controls reviewed over time. | Art. 14 reporting starts from a component of a specific product. A platform whose unit is the organisation does not set out to track the bill of materials of each version. | Outside its purpose: an EU declaration concerns a product, not a company. |
| The test lab, the notified body, the consultant | “Does this product meet the requirements, with tests to show it?” and “Which acts apply, under which procedure?” | The product, for the length of an assignment: a test, an examination, an opinion. | Dated by nature: a test report, a certificate or an opinion carries the date of its assignment. Some procedures provide for periodic audits by the notified body, of the manufacturer's quality system. | A consultant can help qualify a case and draft the notification. Seeing, day after day, that a component of the product is being exploited is another job. | They do not sign it. When a notified body is involved, the declaration cites its certificate; it remains issued under the sole responsibility of the manufacturer. |
| euvex | “This product, in this version, what does its file say?” | The product line and each of its versions. | Every scan rechecked once a day, an email on a new vulnerability above the chosen threshold, and a dated history that is never rewritten. | Opens a case when a distributed component carries a vulnerability from the CISA KEV catalogue, keeps the three deadlines and prepares the content. Submits nothing. | Assembles it from the CRA, RED and Machinery parts, and flags what is missing. Does not sign it. |
How each one fits with euvex
Complementarity
None of these categories is a competitor to replace. Each answers its own question; here is what it keeps, and what euvex adds.
The file kept by hand
A spreadsheet, documents, a shared folder, and the person who keeps them up to date.
It does not go away: the tests, the risk assessment and the signed documents remain yours. euvex keeps the part that changes every day, the bill of materials and its vulnerabilities, and its printed documents join that file.
Open source SBOM generators
Free tools that read a piece of software, an image or a file system and write out its bill of materials.
For example: Syft (Apache-2.0), Trivy (Apache-2.0), cdxgen (Apache-2.0), cyclonedx-npm (Apache-2.0).
Keep them: their SBOM, exported as CycloneDX JSON, versions 1.2 to 1.6, imports into euvex as it is. They are the input of the file, not its competitor.
Open source SBOM analysis platforms
Free servers that receive SBOMs and follow the components of each application over time.
For example: OWASP Dependency-Track (Apache-2.0).
If you already use it, it covers part of what euvex does on software. euvex adds what belongs to the file: the declared CRA, RED and Machinery parts, Art. 14 and the EU declaration, kept per product.
Organisation-level compliance platforms
Services that track a company's policies, controls and evidence against information security frameworks.
One does not replace the other: an organisation's compliance does not stand in for a file for each of its products, and a product file says nothing about the organisation.
The test lab, the notified body, the consultant
People who test the product, assess its conformity when an act requires it, or say which acts apply.
euvex replaces none of them: it tests nothing, does not assess conformity and does not classify your product. It hands them a dated file that can be read without it.
Where euvex stops
As plainly as what it does
What euvex does not do
- It reads npm, pnpm and yarn lockfiles and CycloneDX JSON and SPDX SBOMs, nothing else: neither CycloneDX XML nor a code repository.
- It tests no device and does not measure the declared requirements, the CRA outside the SBOM, RED and Machinery: it collects your answers, requirement by requirement.
- It does not classify your product, does not say which acts apply, and is not a notified body.
- It submits no notification and signs no declaration.
- An account has one holder: team accounts are not built.
How this survey was made
Survey of 27.10.2026
A category is described by what defines it, not by examining each of its products: a given tool may do more, or less, than its row. Open source tools are named with their repository and licence, read on 27 October 2026. No commercial vendor is named: what it does changes without our knowing, and a dated claim about a third-party product ends up being wrong.
What the euvex row states is read from its code, and the acts cited are read in the Official Journal: the file and the declaration, the deadlines, our sources.
Does a row look wrong, or out of date? Write to contact@euvex.eu.
See a product file
A fictional product, its bill of materials, its RED and Machinery parts, its Art. 14 file and its EU declaration, as euvex prints them.