Many engineering teams keep their requirements in a requirements management tool such as Jama Connect, Siemens Polarion, PTC Codebeamer, IBM DOORS Next, Visure or ReqView. Until now the CRA Annex I requirements stayed in CVD Portal, and teams copied them across by hand. You can now download them as a ReqIF file and import that file into your tool.
What the file holds
The file uses ReqIF 1.2, the exchange format that these tools read. It holds one requirement for each of the 22 rows of the Annex I checklist, under the headings Part I(1), Part I(2) and Part II.
Each requirement carries:
- the regulation text and the Annex I reference, for example Annex I Part II(5)
- the EN 40000 clauses that evidence it
- the applicability, and the justification when a requirement does not apply
- the sign-off, with the name, the function and the date
- the evidence, the owner, the due date and the remaining risk
A requirement that you have not yet decided exports as "Review required", not as "Applicable".
Import it again after a change
Each requirement has an identifier made from the product and the requirement. It stays the same in every export. When you change the checklist and import the new file, your tool can update the requirements it already holds instead of creating copies. Each tool maps ReqIF attributes in its own way, so try the first import in a test project.
The requirements tool then traces each requirement to your design and test records. The operational work stays in CVD Portal: report intake, triage, advisories, SBOM monitoring and Article 14 reporting. Read what a requirements tool covers and what it does not.
Where to find it: Products, then a product, then the Requirements tab, then Download (ReqIF) next to Download (Markdown) on the Annex I checklist. This feature is available on the Compliance plan and higher.
The export records your own assessment. It is not a conformity assessment. This note is not legal advice.