ENISA Single Reporting Platform: registration and reporting under the CRA

At a glance

The ENISA Single Reporting Platform has been in operation since 11 September 2026 and was available in early November 2026.
Access via portal.cra-srp.enisa.europa.eu with a personal EU Login and two-factor authentication.
One Primary Assigned Representative per manufacturer and up to 20 further representatives. The competent CSIRT verifies the assignment.
The platform is English only and has no API; reports are entered in the web interface.
German manufacturers choose the BSI (Germany’s Federal Office for Information Security) with CERT-Bund as the competent CSIRT. Choosing the wrong one can invalidate the report.

What the Single Reporting Platform is

Art. 16 CRA requires ENISA to establish and operate a single reporting platform. All reports under Art. 14 go through it to the competent CSIRT and to ENISA at the same time. The receiving CSIRT forwards the report to the CSIRTs of the member states in which the product has been made available. In particularly exceptional circumstances, forwarding can be delayed for cybersecurity reasons; the conditions are set out in Delegated Regulation (EU) 2026/881.

ENISA launched the platform on 11 September 2026 with an initial operating capability. Its status page reported the service as available in early November 2026. If the platform is down, ENISA recommends contacting the CSIRT directly in urgent cases and submitting the report on the platform afterwards.

Access and roles

Access is via portal.cra-srp.enisa.europa.eu. There you choose the role of Assigned Representative (AR) and sign in with EU Login and two-factor authentication. EU Login accounts are personal; there is currently no separate sign-in for companies.

Role	Task
Primary AR	Registers directly, chooses the competent CSIRT and enters the manufacturer’s details. Exactly one person per manufacturer.
Secondary AR	Invited by the Primary AR. Up to 20 per manufacturer, for example as cover during holidays or at night.
CSIRT	Verifies the assignment of representative and manufacturer and handles the reports. Up to 20 reports are possible before verification.

ENISA recommends registering only when a report is due, to reduce the load on the CSIRTs. With an existing EU Login, registration takes a few minutes. In practice it still pays to create the representatives’ EU Login accounts in advance and set up two-factor authentication, so that signing in does not hold anything up within the 24-hour deadline.

Choosing the right CSIRT

The competent body is the CSIRT designated as coordinator in the member state of the main establishment: where decisions on the cybersecurity of the products are predominantly taken, or failing that, where the largest number of employees work (Art. 14(7)). For Germany, ENISA lists the BSI with CERT-Bund.

Manufacturers without an establishment in the EU follow a fixed order via authorised representative, importer and distributor. A manufacturer with several establishments in the EU submits only one report per event. If it chooses the wrong CSIRT, the report can become invalid and has to be resubmitted.

How a report runs

Create a case: After signing in, the representative creates a report on an actively exploited vulnerability or a severe incident and selects the affected product.
Submit the early warning within 24 hours of awareness, with the member states in which the product has been made available and, for an incident, the assessment of whether a malicious act is suspected.
Complete the notification within 72 hours of awareness: product, nature of the exploit, vulnerability with CVE or EUVD identifier, severity, measures and information for users. The platform currently shows the notification as due 48 hours after the early warning; the statutory deadline is what counts.
Provide an intermediate report if the CSIRT requests one.
Final report no later than 14 days after a fix is available (vulnerability), or one month after the notification (incident). The platform shows no countdown for this report; the manufacturer has to track the deadline itself.

At launch the platform has no API. Every entry is made in the web interface, in English. ENISA considers an API possible in a future phase.

Stop counting deadlines by hand

Fixradar matches your SBOMs every day, detects actively exploited vulnerabilities and prepares the early warning, notification and final report for the ENISA platform.

Book a demo See Fixradar

Which information is requested

There is no implementing act on the reporting format under Art. 14(10) so far. The fields follow from the glossary and the user manual for representatives published by ENISA. For vulnerabilities, ENISA lists among other things the CVE and EUVD identifiers, severity, information on the malicious actor and the type of exploit.

If a reported vulnerability is publicly known, ENISA can, in agreement with the manufacturer, add it to the European Vulnerability Database (EUVD) and assign a CVE identifier as a CVE Numbering Authority (Art. 17(5)).

Common pitfalls

Nobody is registered when it matters. The Primary AR is on holiday, deputies have not been invited, EU Login accounts are missing.
The texts are not available in English. Product description, nature of the exploit and measures have to be precise and consistent within hours.
The list of countries is unclear. The early warning needs the member states in which the product has been made available.
The final report deadline is forgotten, because it only starts with the fix and the platform shows no countdown.
Informing users under Art. 14(8) does not run through the platform and is therefore easily overlooked.

Frequently asked questions

Since when has the ENISA reporting platform been in operation?

Since 11 September 2026, the day from which the reporting obligation under Art. 14 CRA applies.

Do I need a company account with ENISA?

No. Sign-in uses personal EU Login accounts with two-factor authentication. A Primary Assigned Representative registers the manufacturer and invites up to 20 further representatives.

Is there an API for automated reporting?

Not at launch. Reports are entered in the web interface. ENISA considers an API possible in a future phase.

In which language are reports submitted?

The platform is in English. Report texts should therefore be prepared in English from the start.

Which CSIRT do manufacturers from Germany choose?

The BSI (Federal Office for Information Security) with CERT-Bund, provided the main establishment is in Germany.

Sources

As of: November 2026. This page reflects the general legal position and is not legal advice for individual cases.

CRA reporting obligation: who must report what, and by whenEarly warning within 24 hours, notification within 72 hours, final report. What Art. 14 requires, for which products and through which route.Actively exploited vulnerability: when the reporting obligation appliesThe definition in Art. 3(42), the start of the deadline, zero-days, bug bounty findings and vulnerabilities in supplier components.SBOM under the CRA: what the software bill of materials has to deliverMandatory from December 2027, needed today: requirements from Annex I, formats, the BSI guideline and the route to an SBOM for each firmware version.

Reporting through the ENISA Single Reporting Platform step by step