These changes come from the feedback of a partner who onboarded their first client. Thank you for it.
See what applies now
Under Article 71(2) of the Cyber Resilience Act, the Article 14 reporting obligations apply from 11 September 2026. The rules on notified bodies in Chapter IV, Articles 35 to 51, apply from 11 June 2026. Most other requirements apply from 11 December 2027. This includes all the other requirements that the Readiness page tracks.
The CRA Requirements Map on the Readiness page now shows the date from which each requirement applies. The requirements that apply now come first. A requirement that applies later and is not complete shows the grey status "Applies 11 Dec 2027", not a red "Action required". The header shows two groups, "Applies now" and "From 11 Dec 2027".
The obligation cards on the dashboard work the same way. Before 11 December 2027, only "04 Reporting" can show red. The other four cards show "Applies 11 Dec 2027" until they are ready.
For a new client, the work to do now is the September 2026 section of the Readiness page. That is the CSIRT and the security contact in Settings, the Vulnerability Handling Procedure, and the reporting channel.
Link a client to one form
Each part of the Readiness page has a "Copy link" button. Send the link to a client, for example with "please fill this in". The link opens the Readiness page at that part. It works for a client who is signed out, because the sign-in page now returns to the link. Sign-in with Google, GitHub or Microsoft also returns to the link.
One workspace per tab
A browser keeps one session for all its tabs. Before this change, a tab could show client A while its saves went to client B, after a switch in another tab. Now a tab locks when the session changes in another tab, and it asks you to reload. If an out-of-date tab tries to save before you see the notice, CVD Portal refuses the save. Nothing goes into the other client.
Settings that say what is wrong
- The Settings form shows the designated CSIRT for the values you enter, with "Not saved yet" until you save. Before, it showed the result of the last save, so a valid Member State could read as not accepted.
- A refused save now gives the reason. For example, a client opened with "Look" is read-only, and the form tells you to use "Work in".
- The Article 14 procedure field for the role review is now "Date the roles were last reviewed", with help text. For a new procedure, it shows today's date.
Your name on the status badge
An administrator can now change the last line of the status badge in Settings, under "Compliance Badge". For a client of a partner, the default is "Powered by" and the name of the partner. The badge now contains its own font, so it looks the same on all devices. The badge cannot carry words such as "certified" or "compliant", because the badge does not prove them.
A steadier partner console
When a page in the partner console fails, the console header and navigation now stay on screen, with "Try again" and "Reload".
This note is not legal advice.