How to Register on the ENISA Single Reporting Platform for CRA Reporting
Since September 11, 2026, Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, has applied. The obligations for the product itself follow on December 11, 2027.
This is the first CRA obligation that affects manufacturers in their day-to-day business. From this date, you need a working reporting channel, even before you have a compliant product.
Contents
What applies since September 11
Two events trigger the reporting obligation. The first is any actively exploited vulnerability in a product with digital elements that you become aware of. Actively exploited means that there is reliable evidence that a malicious actor has exploited it without the permission of the system owner. The second is any severe incident having an impact on the security of the product.
Reporting runs in three stages: an early warning notification within 24 hours, a notification within 72 hours, and then the final report. The deadlines in detail and the question of what must be reported in the first place are covered in separate articles.
Reports go through ENISA's platform
Notifications are submitted via the Single Reporting Platform (SRP), the single reporting platform that ENISA sets up and operates under Article 16. It has been available since September 11, 2026, at portal.cra-srp.enisa.europa.eu.
When you submit a notification, you select the CSIRT designated as coordinator yourself, usually based on your main establishment in the Union. As a rule, the notification is accessible to ENISA at the same time. The receiving CSIRT passes it on to the CSIRTs of the Member States where the product is available and informs the market surveillance authorities. If you select the wrong CSIRT, the notification may become invalid and you have to submit it again.
No registration, no notification
Only someone who has registered beforehand as an assigned representative (AR) may submit a notification. Do not confuse the AR with the authorized representative under the CRA. The AR is an access role on the reporting platform. The authorized representative acts under a written mandate from the manufacturer to carry out specified tasks on its behalf. The same person can be both, but does not have to be.
The AR signs in to the portal with a personal EU Login account, which must have multi-factor authentication enabled. You can create this account in advance. The platform currently does not use any additional authentication of the company.
Each manufacturer has exactly one Primary AR. The Primary AR registers directly, selects the competent CSIRT, enters the manufacturer's details, and links to the company. Up to 20 Secondary ARs join by invitation and confirm the prefilled details; the Primary AR can invite and remove them. ENISA describes the procedure in a separate guide to AR registration.
The reporting obligation binds the company, but access depends on a natural person. If you only look at this on the day you need it, you end up sorting out who can stand in while the 24-hour deadline runs. Vacations, sick leave, and departures of the registered people therefore belong in your reporting process.
ENISA advises registering only when a notification is due, so that the CSIRTs' validation workload stays manageable. You can set up the EU Login and decide who submits in an emergency beforehand.
Who reports for you when it happens?
The template package sets out responsibilities, approval paths, and deadline tracking for your reporting process, regardless of what each individual notification contains.
What ENISA leaves open
The CSIRT only checks the link between AR and manufacturer afterward. While this check is running, an AR that has not been validated may submit up to 20 notifications per manufacturer. The procedure and processing time are up to each CSIRT and may differ. The FAQ does not say what happens to notifications already submitted if validation then fails.
The platform launched in English only. ENISA has announced translations of the factsheet and supporting materials; further language versions of the platform itself will be considered in the next project phase. Plan for this if English is not the working language of the people who report for you. They complete the early warning under 24-hour time pressure in an English-language form.
The platform sets the due time for the 72-hour notification at 48 hours after the early warning is submitted. The legal deadline, however, runs 72 hours from when you become aware. For the final report on a vulnerability, there is no counter at all. A notification can therefore look overdue on the platform even though there is still time. Track the deadlines yourself.
There are 15 months between September 11, 2026, and December 11, 2027. During this period, manufacturers report actively exploited vulnerabilities in products to which the essential requirements of Annex I do not yet apply. The authorities therefore see the vulnerabilities before the requirements for the product and for vulnerability handling apply.
Further reading
This post only touches on three questions. How a specific notification runs, from the assessment to informing users, is described in our article on the CRA reporting process. Whether products placed on the market before the date of application are also affected is covered under reporting obligations for existing products. Which fields the reporting form requires at each stage is listed in ENISA's glossary.
The ENISA FAQ on the SRP is updated continuously, most recently on September 7, 2026. Details of how the platform operates may still change after launch.
