Product updates
What changed in the platform, what you need to do about it, and what stayed the same. Written for the people who use CVD Portal, not for the changelog.
The Readiness page and the dashboard now show which CRA requirements apply today and which apply from 11 December 2027. Partners can link a client to one form, and a browser tab can no longer save into the wrong workspace.
Read the noteYou can now download the Annex I checklist of a product as a ReqIF file and import it into Jama Connect, Polarion, Codebeamer, DOORS Next or ReqView.
Read the noteThe Compliance plan now includes every MCP tool. Article 14 records the two severe-incident tests. The product page has one progress path, and SBOM pushes update findings at once.
Read the noteThe technical file now builds key sections from your records and states its status. Drafts are checked, gaps go to Jira or GitHub, and one search covers every product.
Read the noteThe SBOM validator now reads SPDX 3 tool information, SPDX 3 dependency relationships and nested CycloneDX components, so fewer correct SBOMs get a wrong verdict.
Read the noteYou can now record VEX statements on SBOM findings, share SBOM and HBOM files on the trust portal, choose your notifications, and switch off the hosted portal.
Read the noteYou can now record who files each Article 14 notification, declare which CRA roles your company holds, and follow a phased plan to December 2027.
Read the noteLink evidence across Annex I requirements, track the ENISA secure-by-design playbooks per product, complete your declaration, and keep your SBOM current from GitHub.
Read the noteAssess each product against the CRA, track every control in one register, give researchers a private status link, and score with CVSS 4.0.
Read the noteYou can now publish security advisories from a resolved report, set your own response targets, draft Article 14 fields per stage, and see real SBOM exposure.
Read the noteOne form now writes your vulnerability handling procedure. You can show your readiness on a public page, build an SBOM from a manifest, and pre-fill your ENISA report.
Read the noteCVD Portal is live. You get a public portal where researchers report vulnerabilities, a published disclosure policy, and a dashboard to triage, score and record each report.
Read the note