Mandatory vulnerability and incident reporting under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) (the “CRA“) has applied since 11 September 2026. Manufacturers must now submit the relevant notifications through the Single Reporting Platform (the “SRP“) established and operated by the European Union Agency for Cybersecurity (“ENISA“). ENISA describes the SRP as a single electronic reporting channel through which manufacturers and, once applicable, open-source software stewards can meet their CRA reporting obligations.
This is an important practical milestone in the implementation of the CRA, with significant implications for manufacturers of products with digital elements (“PDEs“) made available on the EU market and, in due course, open-source software stewards (“OSS Stewards“) within the scope of the CRA.
For more information about the CRA generally, see our previous insights here and here.
How does ENISA’s Single Reporting Platform assist with CRA reporting obligations?
As outlined in our previous insight here, manufacturers of PDEs must report certain events upon becoming aware of them. These include:
- Actively exploited vulnerabilities contained in a PDE (“AEVs”): vulnerabilities for which there is reliable evidence that a malicious actor has exploited the vulnerability in a system without the permission of the system owner, for example where a malicious actor exploits a flaw in the PDE resulting in a security breach affecting its users or other natural or legal persons; and
- Severe incidents having an impact on the security of a PDE (“SSIs”): incidents meeting the severity criteria set out in Article 14(5) of the CRA, including where the incident negatively affects, or is capable of negatively affecting, the ability of a PDE to protect the availability, authenticity, integrity or confidentiality of data or functions. ENISA guidance similarly distinguishes the concept of a severe incident from the criteria determining whether the requisite severity threshold is met.
The mandatory reporting obligations for manufacturers have applied since 11 September 2026. OSS Stewards will also have reporting obligations, to the extent provided for under the CRA, from 11 December 2027.
The SRP is an online platform which enables manufacturers and, once applicable, OSS Stewards to submit the relevant notifications to the CSIRT designated as coordinator (the “CSIRT Coordinator“) and ENISA. The system is designed to enable reporting through a single platform, with the relevant information then communicated to the appropriate authorities.
The SRP is also intended to provide functionality for voluntary notifications of vulnerabilities, cyber threats, incidents and near misses under Article 15 of the CRA.
How to identify the correct CSIRT Coordinator?
Manufacturers and, once applicable, OSS Stewards are responsible for identifying the appropriate CSIRT Coordinator when submitting a notification through the SRP.
As a general rule, for manufacturers established in the EU, this is determined by reference to the Member State in which the manufacturer has its main establishment in the EU, meaning where decisions relating to the cybersecurity of its PDEs are predominantly taken. If this cannot be determined, the CRA provides further criteria for identifying the relevant CSIRT Coordinator.
For manufacturers that do not have a main establishment in the EU, the CRA provides a hierarchy based on, among other things, the location of an authorised representative and the relevant importer or distributor and, ultimately, the Member State in which the highest number of users of the manufacturer’s PDEs are located.
What happens after the SRP notification is submitted?
Once a notification is submitted through the SRP, it is made available to the CSIRT Coordinator and ENISA. Subject to the CRA’s provisions on delayed dissemination, the relevant information is subsequently disseminated to the other relevant CSIRTs in Member States where the affected PDE has been made available. Where appropriate, information may also be shared with market surveillance authorities in order to enable them to fulfil their responsibilities under the CRA.
The SRP therefore provides a single electronic reporting channel through which the relevant CRA notification can be communicated to ENISA and the relevant CSIRTs, rather than requiring a manufacturer to make individual CRA submissions to each relevant national CSIRT. ENISA describes this as a “report once” model intended to simplify the EU reporting process.
The applicable reporting stages and timelines must nevertheless be completed. Manufacturers therefore need appropriate internal coordination arrangements to ensure the required notifications are made within the applicable deadlines.
| Important: Use of the SRP does not necessarily remove separate notification obligations arising under other EU or national cybersecurity, data protection or sector-specific regimes. Depending on the circumstances, the same event may therefore require assessment against other applicable regulatory reporting requirements, including obligations under the NIS2 framework or the GDPR. |
When is delayed dissemination of notifications permitted?
In exceptional circumstances, the CSIRT Coordinator may, on justified cybersecurity-related grounds, decide to delay dissemination of a notification to other relevant CSIRTs for no longer than is strictly necessary. This may arise, in particular, following a request from the manufacturer and having regard to the sensitivity of the notified information.
Commission Delegated Regulation (EU) 2026/881 sets out the conditions governing the exercise of this mechanism. It provides, in particular, for circumstances where the cybersecurity risks associated with wider dissemination outweigh the security benefits and those risks cannot adequately be mitigated through information-handling measures, subject to the additional conditions in the Delegated Regulation.
Where the CSIRT Coordinator decides to delay dissemination, it must immediately inform ENISA of its decision, the reasons for it and when it intends to disseminate the notification. A decision to delay onward dissemination does not extend the manufacturer’s applicable CRA reporting deadline.
A separate and narrower exception concerns ENISA’s access to information. The rules permitting delayed dissemination to other CSIRTs do not themselves apply to ENISA’s access. In particularly exceptional circumstances, however, ENISA may receive only specified limited information in relation to the 72-hour AEV notification where the manufacturer indicates that one of the conditions in Article 16(2)(a) to (c) of the CRA is satisfied.
Manufacturers should therefore consider at an early stage of the reporting process whether circumstances potentially justifying delayed dissemination arise, while continuing to comply with the applicable CRA notification timetable, as detailed in our previous insight here.
What can I do to prepare?
While the SRP is intended to simplify CRA reporting by providing a single electronic reporting channel, the underlying obligations remain significant and time-sensitive.
Businesses manufacturing or otherwise placing PDEs on the EU market should use the current period to embed CRA reporting readiness into their cybersecurity governance and incident response arrangements. In particular, manufacturers and, once applicable, OSS Stewards should consider the following:
1. Identify the appropriate CSIRT Coordinator
Manufacturers and OSS Stewards should determine and document which CSIRT Coordinator will receive their notifications through the SRP. This should form part of the organisation’s CRA incident response playbook rather than being determined for the first time during a live cyber incident.
2. Identify Assigned Representatives and ensure appropriate EU Login arrangements are in place
Organisations should identify in advance the individuals who will be responsible for making notifications through the SRP and ensure that the necessary authentication arrangements are operational.
As ENISA continues to update the SRP and its supporting documentation, organisations should also ensure that their internal procedures reflect the latest ENISA operational guidance before a notification is required. ENISA notes that the SRP was upgraded to version 1.3 on 4 November 2026 and that its supporting documentation is being updated accordingly.
3. Review incident response and escalation arrangements
Organisations should review their existing incident response processes to ensure that detection, internal escalation and decision-making procedures are capable of meeting the CRA’s 24-hour, 72-hour and final-report deadlines. ENISA’s guidance confirms these staged reporting requirements, including different final-report timelines for AEVs and severe incidents.
Responsibility for determining whether an event is reportable, preparing notifications, obtaining appropriate internal approvals and making submissions should be clearly allocated before an incident occurs.
4. Map overlapping notification obligations
Organisations should map CRA reporting requirements against other potentially applicable cybersecurity and regulatory regimes, including NIS2 and, where personal data is involved, the GDPR, as well as applicable sector-specific requirements.
Incident response procedures should enable a single event to be assessed promptly against all potentially applicable reporting thresholds and deadlines, rather than treating CRA reporting as a standalone exercise.
Contact us
The introduction of mandatory CRA reporting represents an important change in the EU cybersecurity regulatory landscape. Manufacturers should ensure that responsibility for CRA reporting is clearly allocated and integrated into existing cybersecurity governance and incident response procedures.
For more information regarding ENISA’s Single Reporting Platform, CRA incident and vulnerability reporting requirements, or the Cyber Resilience Act more generally, please contact any member of our Technology and Innovation Group or your usual Matheson contact.
