Changelog

Every tool the ENISA SME CRA Survey 2026 asked for is now live. Five new free tools, one for each of the top support items SMEs identified, all cross-linked from the survey hub and the free-tools grid.

• Declaration of Conformity Generator at /doc-generator — eight-section wizard for the EU DoC (identifiers, product, manufacturer, regulatory basis, standards, signature, additional info) with live Markdown preview, copy, download, and print-to-PDF. Signed-in editors can save the DoC to a dossier; a Markdown copy is filed as an asset (category "declaration_of_conformity") so notified-body reviewers find it in Documents.
• CRA Role Check at /cra-role-check — a six-question wizard grounded in Article 3 that tells you which economic-operator roles apply to your organisation (manufacturer, importer, distributor, authorised representative, OSS steward). Multi-role verdict with the Article 3 definition and key obligations for each; signed-in workspaces can save declared roles from the wizard.
• Lifecycle Policy Generator at /lifecycle-policy-generator — scope, support-period slider (1–15 y), update channel, patch response window, EOL notice days and channels, ownership; live Markdown preview with Art. 10(2) / 10(6) / Annex I Part II §1 §8 anchors. Registered users can save it as a "Lifecycle" global-policy type that propagates to every product dossier, just like CVD and SDL.
• Technical Documentation Generator at /technical-documentation-generator — an eight-section wizard (general, design, risk, standards, testing, SBOM, vulnerability, user info) that produces the CRA Annex VII technical file. Cross-links to Threat Modeling, SBOM Scanner, and CVD Generator. Signed-in editors get a "Technical Documentation" tab on each dossier with per-section progress and a launcher that preloads the saved draft byte-for-byte.
• ISO 27001 → CRA coverage mapper at /iso-27001-cra-mapper — score all 93 ISO/IEC 27001:2022 Annex A controls, see your live CRA coverage percent, per-requirement gap breakdown, Markdown download. Signed-in flow at /organisation/iso-27001 tracks assessments over time with a coverage sparkline and delta vs. the previous run.
• Refreshed the ENISA SME-CRA Survey 2026 hub — every "SMEs asked for…" row and every free-tool tile now routes to the tool built to close that gap.

The June 2026 ENISA SME CRA Survey Report turned into a research hub with headline numbers, a microcompany focus, a maturity scorecard, and a "what SMEs asked for → tool that solves it" table — plus four focused pages that explore the biggest gaps in detail.

• New hub at /enisa-sme-cra-survey-2026 — key survey numbers, gap teasers, microcompany focus, maturity scorecard table, support-needs → tools mapping, and links into every relevant free tool.
• Four gap deep-dive pages: /cra-threat-modelling-gap, /cra-sbom-gap, /cra-incident-response-gap, /cra-product-classification-guide — each links back to the hub and forward to the matching free tool.
• Existing tool pages get a small callout linking to the matching deep-dive, so anyone landing on a tool page can jump straight to the survey context and vice-versa.

A new free public tool built directly on the ENISA SME Cyber Resilience Maturity Assessment Model (June 2025). Score your product security in five domains, spot the biggest gaps, and jump straight into the CRA tools that close them.

• New free tool at /enisa-maturity — 25 questions across five ENISA domains, live scoring, band + gap analysis, prioritised action list per band. Everything stays in your browser.
• Import the official ENISA Excel workbook in one click — SheetJS loads on demand so the first paint stays fast.
• Downloadable Markdown or JSON report with the exact methodology version and an ENISA citation footer, ready for internal circulation.
• Deep-links to matching CRA tools when a domain scores below 3 (SBOM Scanner, CVD Generator, Threat Modeler, security.txt Generator, Article 14 Readiness).
• Corrected two ENISA / Article 14 references in the requirements seed data: dropped the misleading "Register with ENISA" note on ANNEX_I_2_2, and refined ART_10_10 to the actual 24h / 72h / 14d Article 14 cascade.

A brand-new free tool, open to everyone. Upload a Software Bill of Materials and find out in seconds whether any of your components carry known vulnerabilities — no account and no email required.

• Drag-and-drop an SPDX 2.x JSON SBOM and scan every component against the OSV.dev open-source vulnerability database.
• Findings are grouped by severity with an overall risk score, advisory links, and component versions.
• Files are validated and scanned entirely in memory and are never stored.

Two major capabilities to help you stay on top of your compliance posture: continuous vulnerability monitoring and in-app notifications.

• Automatic SBOM vulnerability scanning — CycloneDX and SPDX files are parsed and matched against the OSV.dev database, with findings shown in a dedicated report panel on each asset.
• Weekly re-scans surface newly disclosed CVEs so your dossiers stay current.
• A new Notification Centre keeps you informed about task assignments, status changes, and deadlines — in-app and by email, with per-user preferences.

The platform now speaks eight languages, making CRA compliance more accessible to teams across Europe and beyond.

• Full interface translations added for Spanish, French, Italian, Japanese, Chinese, and Portuguese.
• These join the existing English and German translations across login, products, dashboard, tasks, and settings.

Manufacturers can now discover compliance experts directly from the landing page, and service partners can showcase their expertise.

• Compliance consultancies and service partners can opt into a public directory with their logo, description, and details.
• Filterable partner cards with a detail overlay help manufacturers find the right help.

Bringing your existing evidence into a dossier is now far easier, and administrators get a much clearer view of activity.

• Import compliance documents directly from Google Drive, OneDrive, and SharePoint when adding assets.
• Tenant overviews now show live product and user counts plus per-product compliance progress.
• A new Products tab and member details give administrators a complete picture of each workspace.

A full set of legal pages went live, together with a simpler, more transparent pricing structure.

• Added Privacy Policy, Terms of Service, Imprint, and Refund Policy pages.
• A public language switcher makes the legal pages available in multiple languages.
• Introduced a clearer pricing model with a free €0 tier and an affordable Starter plan.

Behind-the-scenes improvements to keep the app stable and smooth in everyday use.

• Smoother experience when the app is open in several browser tabs at once.
• Assorted interface fixes for a cleaner, more consistent layout.

The first wave of full localisation landed, replacing hard-coded text across the application.

• Every major page — login, sign-up, products, dashboard, tasks, and settings — is now fully translated into English and German.