The ENISA platform is open: what it requires at 24 hours, and five things to do this week

On 11 September 2026, ENISA, the European Union Agency for Cybersecurity, put the Cyber Resilience Act’s Single Reporting Platform (SRP) online. It is the counter through which a manufacturer must now report any actively exploited vulnerability — a flaw someone is really using against its products — and any severe incident affecting their security. The obligation and the tool were born on the same day. What follows describes the platform as it is in production, recorded screen by screen on 12 September 2026, screenshots included.

Two terms before going further. A “product with digital elements” is software or connected hardware placed on the Union market — a router, a mobile app, an industrial controller, a connected device; if you do not yet know whether your products qualify, start with our analysis “Does the CRA apply to your product?”, the rest of this article assumes the answer is yes. A CSIRT is the computer security incident response team designated by each Member State; ENISA publishes the list of the twenty-seven designated as coordinators, one per country.

What changed on 11 September

The calendar comes from the regulation itself. The text applies as a whole from 11 December 2027, but Art. 14, the reporting article, is the exception:

And Art. 14 leaves no choice of channel. The report goes simultaneously to two recipients, through one submission:

The platform serves both recipients at once: you file once, the CSIRT receives it, ENISA receives it. That is the whole point of Art. 16, which tasks ENISA with setting up and running this counter.

The entry path, screen by screen

The first screen asks for neither a password nor a company: it asks who you are. Two roles exist, the CSIRT representative and the Assigned Representative (AR). The latter is the individual who submits notifications on behalf of the manufacturer. That is the role a manufacturer picks.

The account is personal. It relies on EU Login, the European Commission’s login service used across EU portals, with multi-factor authentication (MFA) mandatory — a code on a phone on top of the password. ENISA’s FAQ is explicit (question 9): “EU Login accounts are personal, and MFA is required to access the platform. Therefore, ARs submitting notifications should use their own EU Login accounts.” A manufacturer has one Primary AR and up to twenty Secondary ARs, invited by the primary.

The second screen is a surprise: before you even log in, you must pick your coordinating CSIRT from a list of twenty-seven. That choice is not a preference, it is a rule of the regulation. In plain terms: the country that counts is the one where your products’ cybersecurity decisions are taken, not the registered office. A Dutch manufacturer with no other establishment picks CSIRT Netherlands, a German one CSIRT Germany; the text provides fallback tests for groups and for manufacturers with no establishment in the Union:

That choice shows up in the address bar: once logged in, you are no longer on the common portal but on a per-country instance — fr.cra-srp.enisa.europa.eu for CSIRT France. This is the architecture Art. 16(1) calls for, requiring that the platform “allow Member States and ENISA to put in place their own electronic notification end-points”. Pick the wrong country and you land on the wrong instance.

Then, in the order of ENISA’s user manual (version 1.1, September 2026): EU Login authentication, a legal agreement to accept, a pre-filled identity to confirm, the manufacturer’s name to enter. The account becomes “Active” immediately. The link between representative and manufacturer is then verified by the CSIRT, in parallel, and that verification does not block anything: the FAQ states that a not-yet-verified representative “may submit up to 20 notifications for that manufacturer before verification becomes mandatory”. For a small company that means one thing: verification is never what stops you from reporting.

A point that matters: ENISA asks manufacturers not to register in advance, so as not to load CSIRTs with pointless verifications. The exact wording (question 9): “manufacturers […] are advised to register and initiate the validation process only when they need to submit a notification. Provided that the AR already has an active EU Login account, registration on the SRP takes just a few minutes.” What you prepare ahead of time is therefore the EU Login account with its multi-factor authentication, not the platform registration.

The 24-hour form, as it is

The “Submit new notification” button opens a three-step path, shown at the top of the page as a progress bar: Early Warning, 72-hour Notification, Final Report, plus an optional notes tab. It is the structure of Art. 14(2) and (4), rendered as an interface. At each step you can save a draft or submit.

What the regulation requires at 24 hours fits in one line: the early warning indicates, “where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available” (Art. 14(2), point (a)). The form, however, will not go without seven fields, marked “Required” on screen on 12 September 2026:

• The notification type: severe incident or actively exploited vulnerability. The choice changes the rest of the form.
• A title, 255 characters at most.
• A summary, 4,000 characters at most. This is the human-written field you cannot pre-fill: you need to know, in one page, what is going on.
• The manufacturer, picked from the companies linked to the account.
• The Member States where the product is available — the only field the regulation itself imposes at this stage.
• The product name.
• The product version. Not “the range”, the version: at 24 hours, you need to know which one is affected.

For a severe incident, an eighth field is mandatory: whether the incident is suspected of being caused by unlawful or malicious acts — the regulation expressly asks for it at 24 hours for incidents (Art. 14(4), point (a)). Everything else is optional at this stage: corrective measures taken or available to users, description of severity and impact, malicious actor, date and time of detection.

The product block shows two things. First, the platform asks you to classify the product under the regulation’s three regimes — default, important or critical — without making it mandatory: the manufacturer must already know where its product sits. Second, it accepts two vulnerability identifiers, the CVE ID, the unique number given to each known flaw in the global reference list, and the EUVD ID, from the European Union Vulnerability Database maintained by ENISA. Several products can be added to one notification.

What the platform does not do

Four limits of the version opened on 11 September, all documented by ENISA itself, all with consequences for how a manufacturer organises itself.

• No programming interface. Question 15: “no Application Programming Interface (API) will be provided at the initial release of the SRP, so notifications must be submitted through the platform interface.” An internal tool can prepare the content; a person types it in.
• English only. Question 24: “At launch, the platform will be available in English only.”
• A counter that rings too early. Question 26: in the current release, the 72-hour counter shows a due date “48hrs after submission of the 24-hour Early Warning”, so a notification may appear overdue before 72 hours have elapsed since awareness. ENISA announces a fix; until then, your own clock is the reference, not the one on screen.
• No plan B in case of outage. Question 25: if the platform is temporarily unavailable, “manufacturers should wait until it becomes available again and then submit the required notification.” The same answer adds a release valve: if immediate communication is necessary before the platform is restored, the manufacturer may contact its designated CSIRT directly; the formal notification must still go through the platform once it is back.

Two visibility rules complete the picture, from the user manual: a draft is visible only to the person who created it, and a Secondary AR sees only their own notifications. One registered representative, on leave or unreachable, is a notification nobody else can open. Finally, voluntary reporting under Art. 15 — a flaw without evidence of exploitation — is not available yet: the platform accepts mandatory notifications only.

Five things to do this week

• Create two EU Login accounts with multi-factor authentication, today. One for the future Primary AR, one for a secondary. It is the only step ENISA invites you to do in advance, and the only one that takes time when everything goes wrong. Registration on the platform itself can wait for the first notification.
• Settle the coordinating CSIRT, and write it down. The test is the country where your products’ cybersecurity decisions are taken (Art. 14(7)). For a group, the question deserves ten minutes now rather than at 3 a.m.
• Prepare the seven fields for each product in scope: name, version, manufacturer, Member States of availability. Four of the seven can be filled cold, provided you know which products are in scope — our analysis “Does the CRA apply to your product?” goes through the tests one by one.
• Decide who writes the 4,000-character summary, in English, in under 24 hours. It is not a technical field, it is a text. The person who judges “exploited or not” and the person who writes must be named before the incident.
• Keep your own clock. The platform miscounts the 72 hours and does not count the final report for a vulnerability at all. The deadline runs from awareness, not from submission: note the time of discovery, that is what counts.

One last calendar note. The fine for a breach of Art. 14 — up to EUR 15,000,000 or 2.5 % of worldwide annual turnover (Art. 64(2)) — applies, like the rest of the regulation, only from 11 December 2027. We detailed this in “What becomes mandatory on 11 September 2026”: that gap is not a grace period. The obligation itself has been running since 11 September 2026, and the platform that receives it is open.