Six changes are live in the Products workspace. The technical file now builds key sections from your records and states its status. AI drafts are checked against your product facts, and you can send open gaps to Jira or GitHub.
A technical file that reads from your records
The exported technical file now opens with "Status of this file". The status is "Incomplete" or "Complete as recorded", never a percentage. An incomplete file lists every open gap with its provisions. The export gate is only a floor, so this status tells you how far past the floor your file goes. CVD Portal computes the status from your records. It does not assess, test or certify the product.
Some sections of the file were AI drafts that described a process. They now come from data the platform holds.
- Log of cybersecurity issues. Built from the vulnerability reports for the product, with counts, median days to acknowledge and resolve, and Article 14 decisions. It holds metadata only, never report content.
- Evidence of monitoring. Lists each monitoring source with its schedule, last check and state, plus the last SBOM check.
- Annex VII item 2(b). One row each for the SBOM, the disclosure policy, the contact address, update distribution and approved policies.
Where to find it: Products, then the product, then the Conformity tab.
Checks on AI drafts
Each draft now states your support period and your vulnerability reporting channel as recorded facts. If a manufacturer runs its own reporting programme, record it under "Vulnerability reports go to".
Rules, not AI, then check the text. A draft that names the wrong manufacturer or cites the wrong CRA article blocks the export. A draft written before you changed a product fact shows "out of date". "Mark reviewed" records who read the exact text and when. Any later edit voids it.
Where to find it: Products, then the product, then the Requirements tab.
Close review triggers with a recorded outcome
The platform opens review triggers from SBOM findings and triaged reports. Before, resolving one left no record. Now "Add as threat" adds a linked threat to the threat model. "No change needed" asks for a reason and keeps it. The file lists each closed trigger with its outcome.
Where to find it: Products, then the product, then the Monitoring tab.
Prove that evidence files did not change, and compare versions
Every evidence file now records its SHA-256 hash when you upload it. "Verify" hashes the stored file again and compares the two. The technical file prints an evidence register with the full hashes.
"Compare versions" shows what changed between two snapshots, or between a snapshot and the current assessment. Changes that need a decision come first, for example removed sign-off or a changed interface.
Where to find it: Products, then the product, then the Evidence tab for hashes and the Monitoring tab for Compare versions.
Send open gaps to Jira or GitHub
"Open gaps as tickets" lists every open CRA gap for the product, most urgent first. Download the list as a CSV or Markdown, or send it to a connected Jira or GitHub. "Check first" shows the result and creates nothing. A gap is never sent twice. A closed ticket does not close a gap. The gap closes when CVD Portal sees the fix.
Where to find it: Products, then the product, then the Conformity tab.
Search every product for one vulnerability
Enter a CVE, GHSA or OSV identifier. You get one result per product: affected, not affected, not in SBOM, or unknown with a reason. A product the search cannot check never shows as clean. For an affected product, an admin can start an Article 14 report. The search never records the Article 14 decision for you. Exposure Search is on the Compliance plan.
Where to find it: Exposure Search, under CRA compliance in the sidebar.
What has not changed
If you edited the issue log or the monitoring record by hand, the platform does not replace your text. Generated documents are still drafts. The manufacturer alone is responsible for conformity. This note is not legal advice.