This note groups the changes since 12 October into nine sections. The Compliance plan now includes every MCP tool. Article 14 reporting now follows the tests in the law. The product page is easier to follow. SBOM findings update when you push an SBOM, and a technical file can now reach "Complete as recorded".
The full MCP tool set on the Compliance plan
Before, most MCP tools needed the Enterprise plan, and a Compliance company could create only a read-only key. A Compliance company can now create an API key with MCP scopes only and use every MCP tool. The scopes cover reports, triage, researcher messages, products, Article 14 drafts, advisory drafts and conformity work. A company in its free trial gets the same tools, because the trial runs at the Compliance level. The REST API under /api/v1 still needs the Enterprise plan.
Find it in Settings, then API Keys. The MCP server guide shows how to connect an AI assistant.
Article 14 follows the severe-incident tests in the law
The report page now records the two tests in Article 14(5) of Regulation (EU) 2024/2847. You answer each test as Yes, No or Not yet assessed. The answers set when Article 14 reporting applies in CVD Portal.
- Either test is Yes. Article 14 reporting applies at any severity.
- Both tests are No. Reporting does not apply, even for a critical rating.
- Not both answered. A high or critical rating still counts as severe, so no 24-hour deadline is missed while you assess.
- Actively exploited vulnerability. Reporting always applies. The incident tests never switch it off.
The report page also records an intermediate report under Article 14(6). It holds the date the CSIRT asked, the date you sent it and the reference. A manufacturer outside the EU with no authorised representative can now choose the Article 14(7) route in Settings. The route is the importer, the distributor or the users, with their Member State.
Find the tests and the intermediate report in Submissions, then the report. Find the route in Settings.
One progress path on the product page
The product page showed three progress devices before the first tab, and the stage names did not match the tab names. Now the stage bar sits in the header and names the current stage. The tabs carry the stage names. They are Classify, Context and risk, Requirements, Evidence, Conformity, Keep compliant and Secure by design.
Threat modelling and the risk assessment moved from Assess to their own tab, Context and risk. Old links to the product page still open the right tab. A future stage shows a grey lock with its reason, because it waits for an earlier stage. The lock is the normal state of every future stage.
Find it in Products, then the product.
A technical file can now read complete
Before this change, the declaration of conformity always printed placeholders at Annex V points 1, 4 and 8, so no technical file could reach "Complete as recorded". A new "Declaration of conformity facts" form holds the model identifier, the traceability details, the place and date of issue, and the signatory.
Annex VII item 1 now checks its four sub-points. Record the software version placed on the market, and say whether the product has hardware. Until you record both, item 1 shows as missing, and the gap line names the missing sub-point.
Find both forms in Products, then the product, then the Conformity tab.
Record scan findings, review items and tabletop runs for one product
SARIF findings, items in the security test and review plan, and tabletop runs can now belong to one product. Each one keeps its account-wide default. The technical file for a product reads its own records and the account-wide records, and never another product's records.
Find the picker in Settings, then Security Test & Review Plan, and on the AI tabletop page. Pipelines send productId to /api/v1/scan/sarif.
SBOM pushes update findings at once
When a pipeline pushes an SBOM to POST /api/v1/sbom, CVD Portal now scans it and updates the findings in the same request. Before, the findings changed only at the next daily scan. The response now holds the counts of new and resolved findings. If the scan fails, the SBOM stays stored and the daily scan checks it again.
VEX statements in a CycloneDX SBOM now stay on each finding. A not_affected statement appears as "known not affected" in your CSAF VEX document, and a resolved statement appears as "fixed". Before, a not_affected finding could appear as fixed. A VEX status that a person set by hand always wins over the SBOM.
The SBOM scan also lists components with no version whose package has known advisories. These components stay out of the findings list and send no alerts. Add the version, or check each advisory by hand.
Find it in Supply Chain Intel, then the SBOM panel. The API needs the Enterprise plan.
NIS2 and NIST SSDF references in the control register
The control register now shows, for each control, the CRA requirements it gives evidence for, with their NIS2 and NIST SSDF references. A new "NIS2 or SSDF" filter and the search find controls by reference. No control status or readiness figure changes. The mapping is our own judgement, because no authority has published an official crosswalk. The full dataset is free under CC BY 4.0 at cradata.eu/crosswalk.
Find it in Controls.
Guides for hiring outside experts
Seven public guides tell you how to hire a penetration tester, an SBOM analyst, a security architecture reviewer, a data protection reviewer, a legal reviewer, a notified body or an EUCC evaluation lab. Each guide lists the Annex I requirements the service gives evidence for, the credentials to check and the warning signs. A conformity gap that an outside service can help close now links to the matching guide.
Each Annex I reference on the public guides now opens the exact text of the requirement in a pop-up.
Find the guides at Hire CRA experts.
Fixes
- Trial billing. During a Compliance trial, you can now keep Compliance. Before, the only offer was Enterprise. Your remaining trial days carry over, and the first charge occurs on the trial end date.
- Trust portal link. The Trust portal link now shows on every page of your public portal. Before, it showed on the home page only.
- Two-factor sign-in. An authenticator code now works once only. A used backup code can never sign in again. On a phone, the backup code field now opens the full keyboard, because backup codes contain letters.
- Security. We closed the findings from our security review of 17 October 2026.
What has not changed
A hand-set VEX status and a hand-edited record are never replaced by the platform. Generated documents are still drafts. The manufacturer alone is responsible for conformity. This note is not legal advice.