Comparison
A good consultant is worth it for setting up your CRA governance and interpreting how the law applies to you. But the CRA's Article 14 duties are continuous — a component you shipped can start being exploited on any random Tuesday, and the 24-hour clock starts then, not at your next audit. Here is how the two compare.
| For EU CRA Article 14 | Consultant | Cravault |
|---|---|---|
| What it watches | Point-in-time review when engaged | SBOMs of your released versions, continuously |
| Trigger | Scheduled audits or your prompt | Actively exploited (CISA KEV / ENISA EUVD) on a version you ship |
| Coverage between engagements | — | ✓ |
| Article 14 SLA timers (24h / 72h / 14d) | Tracked by hand | ✓ |
| Article 14 report drafts (with provenance) | Written per incident | ✓ |
| CSAF 2.0 + CycloneDX VEX export | Bespoke, if at all | ✓ |
| Sets up your governance & policy | ✓ | — |
| Legal interpretation & sign-off | ✓ | — |
| Scales across many products & versions | Linear with billed hours | ✓ |
| Cost model | Day rate or retainer | From €0, flat per product |
Use a consultant (and your lawyer) for the one-off work only a human can do: your CRA governance, risk assessment and legal interpretation. Use Cravault for the part that never stops — watching your released versions and having the report ready the moment something you ship is exploited. They are complementary, not either/or.
Start freeSee also: vs enterprise suites, vs Dependabot, vs Dependency-Track.
