Before an incident: what to prepare
ENISA asks manufacturers not to register pre-emptively, to spare CSIRTs validation work. Registration takes minutes if the person already has an EU Login account. So the preparation is about people and facts, not the platform account:
- Name who will be the Primary AR and at least one backup. Each needs their own EU Login account with MFA working, because accounts are personal.
- Agree the exact manufacturer name to register. A misspelt name creates a separate manufacturer entity.
- Record your CSIRT designated as coordinator and why. Which CSIRT do you notify?
- Prepare the content of each report in advance as a template, so the person submitting is copying agreed text rather than writing under pressure. CRA Article 14 report template
Registering when you need to submit
Per ENISA's registration guidance, the Primary AR:
- opens the platform and selects the Assigned Representative role;
- selects the CSIRT designated as coordinator;
- authenticates with EU Login and accepts the legal agreement;
- confirms their personal details and enters the manufacturer details.
The account becomes active straight away and the association with the manufacturer goes to the CSIRT for validation. You can submit while validation is pending. Once the association shows as verified, the Primary AR can invite Secondary ARs. Every AR associated with the manufacturer can see and update its notifications, except drafts, which stay in the account of the AR who wrote them.
Submitting: one case, three stages
You choose whether the notification is an actively exploited vulnerability or a severe incident, and the fields adapt. ENISA's SRP Glossary explains each field and the stage it is required at. Some fields are optional in the early warning and required later.
- Early warning: within 24 hours of becoming aware.
- Notification: within 72 hours of becoming aware.
- Final report: no later than 14 days after a corrective or mitigating measure is available (vulnerability), or within one month after the notification (incident).
Only one notification is needed per vulnerability or incident, even with several EU subsidiaries or a parent company outside the EU. Coordinating internally is your job.
Do not rely on the platform's countdowns
ENISA's FAQ says the platform's counters are reminders, not your legal deadlines. In the current release the 72-hour counter shows a due time 48 hours after the early warning was submitted, not 72 hours after you became aware. There is no counter yet for the final report on a vulnerability, because it depends on when a fix becomes available. Track the deadlines from your own awareness time. CRA Article 14 reporting deadlines explained.
Delaying dissemination
The CSIRT that receives your notification passes it to the CSIRTs of the Member States where you said the product is available. Under Article 16(2), in exceptional circumstances and on justified cybersecurity grounds, that dissemination can be delayed, including at your request. The platform calls the strictest cases “particular exceptional circumstances” and ENISA suggests assessing whether they apply during the first 72 hours. Indicate how sensitive the information is when you submit.
Questions people ask
- What is the CRA Single Reporting Platform?
- The online tool, built and run by ENISA under Article 16 of the Cyber Resilience Act, through which manufacturers submit Article 14 notifications of actively exploited vulnerabilities and severe incidents. It went live on 11 September 2026.
- Who can submit on the Single Reporting Platform?
- Assigned Representatives (ARs) of the manufacturer, each using a personal EU Login account with multi-factor authentication. ENISA's FAQ allows one Primary AR per manufacturer and up to 20 Secondary ARs.
- Should we register before we have an incident?
- ENISA advises registering on the platform and starting CSIRT validation only when you need to submit, to limit the validation workload. You can still prepare in advance: create EU Login accounts with MFA for the people who will submit, and decide who the Primary AR will be and which CSIRT is yours.
- Can we submit before the CSIRT validates our registration?
- Yes, according to ENISA's FAQ. Validation of the AR to manufacturer association runs in parallel, and an unverified association can submit up to 20 notifications before verification becomes mandatory.
- Is there an API for the Single Reporting Platform?
- Not at launch. ENISA says notifications must be submitted through the platform interface and that an API may be considered later.
- What if the platform is down?
- ENISA's FAQ says to submit once it is available again. If you think immediate communication is needed, you may contact your designated CSIRT directly, but you still have to submit through the platform afterwards.