Five changes are live. You can reuse evidence across Annex I requirements, track the ENISA secure-by-design playbooks per product, complete more of your EU Declaration of Conformity, refresh your SBOM from GitHub, and publish a shared security inbox.
Reuse your evidence across Annex I requirements
Before this change, the Annex I checklist did not know about the evidence you had already attached to a product. You had to describe the same work again in each row.
Evidence attached to a product now shows under each requirement it can support. Tick it to link it. One control often supports several requirements, so the checklist now offers to link it to all of them in one step. It names each requirement before it changes anything.
You can also select several requirements and sign them off together. You type the name of the person who accepts them, and each row keeps its own signature and time. Nothing is selected for you, and rows that are already signed stay as they are.
Where to find it: Products, then your product, then the Requirements tab.
Track the ENISA secure-by-design playbooks per product
Each product now has a tracker for the ENISA Secure by Design and Default playbooks. Every playbook shows its principle, objective, checklist, minimum evidence and release gate. You tick the release gate items for each product. A playbook can be signed off only when all of its gate items are ticked.
The playbooks are agency guidance. They do not change your export readiness. This tracker is in beta, so send us a note from the Feedback page if something looks wrong.
Where to find it: Products, then your product, then the Secure by design tab.
Complete more of your EU Declaration of Conformity
Two fields that the declaration requires had no place in the portal.
- Registered postal address. Annex V asks for the manufacturer's name and address. You can now set the address once for your company, or set it per product when you prepare a product for a client.
- Notified body. Products whose conformity route needs a notified body now ask for its name, its four-digit identification number and the certificate number. The export review now blocks a file that needs a notified body but has no name or number.
Empty fields still print as a visible placeholder in the declaration, so a gap is never hidden.
Where to find it: Products, then your product, then the Conformity tab. The company address is in Settings, then General.
Keep your SBOM current from GitHub
An SBOM that nobody updates causes false findings against versions you no longer ship. You can now connect a GitHub repository. The portal reads the repository's dependency graph, replaces the stored component list and scans it again, without a manual upload. You can point the repository at one product or at your account-wide SBOM.
GitHub does not mark development dependencies, so the list includes them. If your pipeline can build an SBOM from the production tree, that file stays more precise.
This connector is available on the Enterprise plan. Only company administrators can configure it.
Where to find it: Settings, then Integrations.
Publish a shared security inbox
Your security.txt and policy page used the email address you log in with. You can now publish a different address, such as a shared security inbox, without changing your login. The address also appears in the emails that researchers receive when they submit a report.
Where to find it: Settings, then General, then Public Security Contact.
What has not changed
If you do not set a public security contact, the portal keeps using your company email, as before. Evidence links and sign-offs are never made for you.
The checklists and declaration fields help you prepare your technical documentation. They are not a conformity assessment, and this note is not legal advice.