complycra.eu vs CVD Portal
Free CRA guides and tools from Codific, with the SAMMY compliance management tool behind them. How does complycra.eu compare to CVD Portal for an EU manufacturer subject to the Cyber Resilience Act?
- Headquarters
- Heverlee (Leuven), Belgium
- Category
- CRA resource site and compliance tool
- Pricing model
- Guides and the scope assessment tool are free. SAMMY has a free plan and a Premium plan, and Premium prices are not published (checked October 2026).
How they compare on CRA-critical features
Six rows comparing a free CRA resource site and its compliance tool with an operating compliance platform under Regulation (EU) 2024/2847.
Where complycra.eu is strong
- +Free CRA guides, podcasts, videos, news and an FAQ in one place.
- +A free scope assessment tool that tells a manufacturer in a few minutes whether a product is in scope.
- +SAMMY includes a Cyber Resilience Act framework and advertises CRA compliance management and the generation of legal documentation.
- +SAMMY has a free plan, limited to 3 maturity scopes and 1 product for product risk.
- +Codific runs OWASP SAMM assessments, threat modelling and training, so the tool has a consulting practice behind it.
Where the site stops
- !No hosted vulnerability disclosure portal or security.txt is advertised (checked October 2026).
- !No Article 14 reporting workflow is advertised. The guides explain the reporting duties, but no tool for them is named.
- !SBOM handling and vulnerability matching are not advertised on the SAMMY site.
- !Premium prices are not published, so the cost of the supply chain module cannot be compared.
The CRA gap
complycra.eu explains the CRA, and SAMMY tracks compliance work and drafts documents. The operating duties need more than that. Annex I Part II points (5) and (6) require a coordinated vulnerability disclosure policy and a contact address for vulnerability reports. Article 14 requires an early warning within 24 hours after the manufacturer becomes aware of an actively exploited vulnerability. Neither duty has an advertised tool on the site (checked October 2026).
Why teams pick CVD Portal for CRA
Five things a manufacturer needs after the guides, once the product is on the market.
- 1
A hosted disclosure portal and security.txt on the Free tier, so the contact address for vulnerability reports works on day one.
- 2
Article 14 runs on in-product 24-hour, 72-hour and final-report timers, with an SRP-ready submission package on Reporting and higher plans.
- 3
SBOM import in SPDX and CycloneDX from Pro, with a daily OSV.dev rescan and alerts on Enterprise.
- 4
Classification, Annex I applicability, the technical documentation and the EU Declaration of Conformity sit on one product record on Compliance.
- 5
Published prices for every self-service plan, with a €0 Free tier.
Frequently asked
What is complycra.eu?
Does complycra.eu host a vulnerability disclosure portal?
Does SAMMY handle Article 14 reporting?
Is SAMMY free?
Can a manufacturer use complycra.eu and CVD Portal together?
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- complycra.eu home page
- complycra.eu CRA tools page
- SAMMY home page
- Codific imprint
Vendor pages checked on 30 October 2026.
Put the duties you read about into operation
Start with the free disclosure portal and security.txt, then add Article 14 reporting and the technical documentation. The disclosure baseline is €0/month.