Partner Academy and certification
The Partner Academy is free public training at /partners/academy. It needs no account, so consultants at existing partners, affiliates, and people still evaluating either program can all use it.
It is not an eligibility gate for anything. Neither the partner program nor the affiliate program requires it. It exists because both programs put people in front of manufacturers talking about the Cyber Resilience Act, and a wrong answer there is expensive for everyone.
Curriculum
Three tracks.
Platform mechanics covers the partner console, client provisioning, bulk intake, the review queue, consultant seats, billing, and co-branding.
CRA regulation covers scope and exclusions, product classification across the Annex III and Annex IV tiers, Annex I obligations, conformity assessment, Article 14 reporting, and penalties. Two of its modules work through the Commission guidance adopted in July 2026, covering what counts as a product with digital elements, when a copy is placed on the market, when open source becomes commercial, when a backend is a remote data processing solution, which repairs and updates are substantial modifications, how the support period moves, and how core functionality decides classification.
Sales enablement covers positioning, pricing, objection handling, and who to target.
The exam
Fifteen scenario questions, sampled from a larger pool with a fixed quota per module, so every attempt is different and every track is represented. Seventy-five percent or higher passes.
On a pass the candidate enters their name and work email and a certificate is issued instantly, with a public verification URL at /partners/academy/certificate/ that anyone can open to confirm it is genuine.
Every attempt ends with an answer review, on a pass and on a fail alike. It covers only the questions that attempt asked, and each one shows the correct answer, why it is correct, a link back to the module that teaches it, and, for CRA questions, a link to the article or annex explainer behind it. Questions resting on the Commission guidance carry a second link, to the page that reproduces the Commission's own worked examples.
Each reviewed question carries a "Disagree with this answer? Tell us" link, and the review ends with a general feedback box for the exam as a whole. Both go to the same place as in-app feedback elsewhere in the product. A candidate who is signed in has the report filed against their company; an anonymous candidate sends it straight to the team. Question challenges are checked against the regulation text, so send one whenever an answer looks wrong.
The credential
The credential is the Certified Partner Consultant — Foundational, issued by Porta Regulus B.V. (KvK 42062307, VAT NL869534208B01), the company that operates CVD Portal.
The certificate names the holder and carries the month and year of issue, the certificate number, the curriculum version, and the CPE credits earned. It does not publish the exam score, since a credential records that the holder passed rather than how narrowly. The score is kept on the internal record. The page is print-friendly and prints as a landscape credential with the site navigation removed.
A certificate always displays its standing: valid, superseded when a newer curriculum version has been published, or revoked when the issuer has withdrawn it. A revoked certificate keeps resolving at the same URL rather than disappearing, so anyone holding an old link learns it is no longer valid.
The credential does not expire. The issue date states which vintage of the curriculum it was assessed against, and a curriculum bump marks older certificates superseded without invalidating them.
Certification is person-level. It is keyed by the candidate's email and is independent of any company or partner tenancy, so it stays valid if the person changes employer. Retaking the exam with the same email keeps the same verification link and updates the issue date.
Machine-verifiable credentials
Every certificate is also published as a signed Open Badges 3.0 assertion, a W3C Verifiable Credential, at /partners/academy/certificate/<code>/assertion.json. The issuer is did:web:cvdportal.com and the public key is at /.well-known/did.json, so a verifier can check the signature without contacting us. The assertion carries no email address and no holder name: identity is a salted SHA-256 hash, and revocation is a hosted bitstring status list in which each credential owns one bit.
The certificate email carries a link that adds the credential to the holder's LinkedIn profile, pre-filled with the credential name, the issuer, the issue month and year, the certificate URL and the certificate number. The link is in the email rather than on the certificate page because that page has no way to tell the holder apart from anyone else holding the link, and offering the button to a visitor would add someone else's credential to their profile.
What it does and does not entitle you to
Passing the exam certifies a person, not an organization. It does not make you a partner, does not make you an affiliate, and does not create any commercial relationship. Both programs are joined by applying, and both are approved by hand.
For an affiliate application, supplying your certificate code is optional and helps us approve you faster. See what you may call yourself before describing the credential in your own marketing.