We enabled CDC and someone still wants the new service to update the KSDS

Dataset CDC is on. Does that mean the new service can also update the same VSAM file CICS updates?

No. CDC watches inserts, updates, and deletes, decodes them with the catalog layout, and publishes events to Kafka or HTTP. It does not take a lock that makes a second writer safe. If CICS is the writer, let the new service consume events or call an API that does not write the same KSDS. Concurrent writes still need RLS or DFSMStvs.