ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

The EU Agency for Cybersecurity switched on the Cyber Resilience Act ‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency.

Anyone placing a product with digital elements on the EU market now reports actively exploited vulnerabilities and severe incidents through that one portal . The clock starts when the manufacturer becomes aware of the event. An early warning is due within 24 hours, a fuller notification with an initial assessment within 72 hours, and a final report within 14 days of a corrective or mitigating measure becoming available. For a severe incident, the final report is due one month after the 72-hour notification.

One submission, then the CSIRTs pass it along

A manufacturer files electronically and picks a CSIRT designated as coordinator, the national incident response team that takes first receipt. That team forwards the notification to CSIRTs in other Member States where the product is available. ENISA gets a copy at the same moment, unless the manufacturer marks one of the exceptional circumstances in Article 16(2), in which case ENISA sees partial information until the receiving CSIRT makes the rest available.

Picking the coordinator is the manufacturer’s job. In general it is the Member State of their main establishment in the EU, where decisions their products’ cybersecurity are predominantly taken. If they choose the wrong one, the notification may be invalidated and has to be resubmitted to the correct coordinator.

Registration runs on an EU Login account with multi-factor authentication. Each manufacturer gets one Primary Assigned Representative and up to 20 Secondary ARs, and the designated CSIRT validates the association. An AR whose association is still pending may file up to 20 notifications before verification becomes mandatory.

“The streamlined reporting and sharing of information on actively exploited vulnerabilities and severe incidents helps to build a more resilient Digital Single Market,” said ENISA Executive Director Juhan Lepassaar .

What the first release leaves out

No API ships with this version, so notifications go through the web interface. ENISA says organizations can automate their internal workflows and may get API functionality in a future phase. A vendor with several affected product lines still types one notification per event into a form, and coordinates across its branches and subsidiaries so that exactly one goes in.

The platform is in English at launch, with translations of the supporting material to follow. Voluntary reports of vulnerabilities, cyber threats, incidents and near misses under Article 15 are planned for a later phase. Open-source software stewards come under the same obligation on 11 December 2027.

What we know the Revolut data breach so far

Turn it off and on again, but for critical infrastructure

IDScan confirms breach after 153 million driver’s licenses leak on dark web

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

What we know the Revolut data breach so far

Turn it off and on again, but for critical infrastructure

Permify: Open-source authorization as a service

IDScan confirms breach after 153 million driver’s licenses leak on dark web

Getting a stranger’s phone kicked off the cellular network costs a few dollars