CVD Portal - Every EU Cyber Resilience Act obligation in one place
by•
The EU Cyber Resilience Act starts to apply on 11 September 2026. CVD Portal gives a manufacturer a free vulnerability disclosure portal, and paid plans cover Article 14 reporting, risk assessment, Annex I evidence and the Declaration of Conformity.
Replies
Hello Product Hunt. We are Porta Regulus B.V., a Dutch company, and we make CVD Portal.
The EU Cyber Resilience Act (CRA) applies to each manufacturer that sells a product with digital elements in the EU. The location of the manufacturer does not change this. Reporting of actively exploited vulnerabilities started on 11 September 2026. All other obligations apply from 11 December 2027. The tools we found each covered one part of that list, so we built one place for all of it.
What is free. Each manufacturer gets a public vulnerability disclosure page on its own subdomain, with a security.txt file and tracking of the 48-hour acknowledgment target. The free plan has no time limit.
What the paid plans add. CVD Portal prepares the Article 14 early warning (24 hours), the notification (72 hours) and the final report, and a person at your company submits each one to ENISA. It classifies each product as default, important or critical. It guides the risk assessment and records evidence for each Annex I requirement. It drafts the technical documentation and the EU Declaration of Conformity from your data, and your team reviews each draft. It checks your SBOM against known vulnerabilities and publishes advisories in CSAF 2.0. Paid plans start at 99 euros per month and have a 14-day trial.
For builders. An MCP server lets an AI agent submit a vulnerability report, read the compliance status and draft a CSAF advisory. All AI processing runs in EU and EEA data centers. Our research data is open under CC BY 4.0 on GitHub.
If you make a connected product or software that you sell in the EU, tell us which part of the CRA is not clear. We answer here.