CRA: the reporting platform is live, but not finished
ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day the obligation to use it became binding. Live is not the same as finished: ENISA calls this release an "initial operating capability", it accepts the mandatory notifications of article 14 only, it ships without an API, and the voluntary reporting channel of article 15 is deferred to a later phase. The platform arrived on time and incomplete, which leaves manufacturers with a working obligation and a partial tool.
In short:
- The platform is the SRP portal and registration needs an EU Login account with multi-factor authentication.
- Each manufacturer has exactly one Primary Assigned Representative and up to 20 Secondary ones. Secondary representatives cannot self-register.
- No API in this release, so a first notification is a manual submission by a named human.
- If the platform is down, ENISA says to wait and submit when it returns. Nothing in that guidance says the 24-hour clock pauses.
- Delegated Regulation (EU) 2026/881 lets the receiving CSIRT hold a notification back from other national teams, for no longer than strictly necessary.
What shipped, and what did not
Section titled “What shipped, and what did not”The Commission describes the platform as operational as of 11 September 2026, managed by ENISA in cooperation with the CSIRT Network. ENISA describes it more narrowly. It "deployed the initial operating capability" and says it will "continue to improve and expand its functionalities over the coming months based on operational experience and user needs".
Two of those gaps matter immediately.
Article 15 voluntary reporting is not available. The CRA lets manufacturers, and anyone else, report vulnerabilities or incidents that fall outside the mandatory scope. ENISA states that channel will be introduced in a future phase. Until then the platform is a compliance instrument only, not a place to share something you think the ecosystem should know.
There is no API. Every notification in the first release is submitted by hand, through a browser, by a person holding the right role. A team that planned to trigger the early warning from its incident tooling has to insert a human step instead, and that step has to work at three in the morning.
Only manufacturers and open-source software stewards may submit. ENISA directs everyone else, including security researchers, to contact the relevant national CSIRT directly. Stewards themselves are not in scope until 11 December 2027, so today the platform serves manufacturers alone.
Registration is a two-role exercise, and one role is a single point of failure
Section titled “Registration is a two-role exercise, and one role is a single point of failure”Access is built on EU Login with multi-factor authentication, not a platform-specific account. If nobody in the compliance chain has an EU Login today, that is the first task, and it can be done in advance.
The role model is where the operational risk sits:
| Role | How it is obtained | Limit |
|---|---|---|
| Primary Assigned Representative | Registers directly on the platform, selecting the CSIRT designated as coordinator | One per manufacturer |
| Secondary Assigned Representative | Only by invitation from the Primary | Up to 20 |
Because Secondary representatives exist only by invitation from the Primary, the Primary is a bottleneck by design. A manufacturer whose single Primary representative has left the company, lost their MFA device or is simply asleep has an onboarding problem at the worst possible moment. Naming a Primary and inviting the Secondary representatives is a five-minute task now and an incident during an incident later.
Note that the Primary chooses the CSIRT designated as coordinator during registration. That choice is the article 14(7) determination, and it is not the registered address of the company. The reasoning behind it is set out in our earlier note on the article 14 reporting cascades.
The platform can be unavailable, and the clock is not documented as stopping
Section titled “The platform can be unavailable, and the clock is not documented as stopping”When we covered the obligation in August, neither ENISA nor the Commission published a contingency for the platform being unreachable. ENISA has now answered it. If the platform is temporarily unavailable, manufacturers "should wait until it becomes available again and then submit the required notification", though they may contact their CSIRT directly where immediate communication seems necessary.
Read that against article 14. The 24-hour early warning, the 72-hour notification and the final report are obligations on the manufacturer, triggered by awareness. The ENISA guidance tells you what to do when the tool is down; neither that guidance nor Delegated Regulation (EU) 2026/881 states that the manufacturer's deadline pauses while it is. The prudent reading is that the clock runs, that you document the outage and your attempts, and that you use the direct CSIRT route when the delay would be material.
What a delayed dissemination looks like from the other side
Section titled “What a delayed dissemination looks like from the other side”Delegated Regulation (EU) 2026/881 of 11 December 2025 was published on 20 April 2026 and entered into force on the twentieth day after publication. It governs something separate from your deadline: when the CSIRT that receives your notification may hold it back from other national teams.
It sets out three families of ground:
- The nature of the information, where the cybersecurity risk of circulating it outweighs the benefit and the usual traffic-light and action protocols cannot contain that risk. The named cases include a manufacturer indicating a patch is due within 72 hours, information that would let a low-skill actor exploit the flaw easily, a situation where partial information is enough for others to mitigate, and an active coordinated vulnerability disclosure process.
- The situation of the receiving CSIRT, where a recipient team has itself been hit by a cybersecurity incident or cannot demonstrate adequate security capability.
- Compromise of the platform itself.
A delay lasts no longer than strictly necessary, with a maximum of 72 hours where a security update is expected. While it holds, ENISA receives only a confirmation that a notification exists, general product information, a summary of the nature of the exploitation and an indication that security grounds were invoked, rather than the sensitive detail.
For a manufacturer the practical consequence is narrow but worth knowing: the "report once" design does not mean "circulated everywhere immediately", and a pending patch is an explicit, recognised reason for a CSIRT to hold the detail back.
What to do this week
Section titled “What to do this week”- Create the EU Login accounts and enable MFA, for the Primary and at least two Secondary representatives. This is the only step that cannot be improvised.
- Register the Primary and send the Secondary invitations now. The invitation dependency is the failure mode; discovering it during a live incident is the outcome to avoid.
- Record your article 14(7) determination and the CSIRT you selected, with the reasoning. Predominant cybersecurity decision-making is a question of fact.
- Replace any planned automation with a named human step, because there is no API yet, and rehearse it out of hours.
- Write the outage case into the procedure: attempt the platform, capture evidence of unavailability, and escalate to the CSIRT directly rather than treating the tool being down as an extension.
Going further
Section titled “Going further”- CRA: vulnerability reporting starts 11 September: the two cascades, the severity test and the CSIRT determination rule
- Cyber Resilience Act, 2026 and 2027 timeline: the full staged calendar to 11 December 2027
- Cyber Resilience Act guide: scope, product classes and assessment routes
Sources & references
- The CRA Single Reporting Platform is launched, ENISA www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched
- Single Reporting Platform (SRP), frequently asked questions, ENISA www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions
- Cyber Resilience Act, reporting obligations, European Commission digital-strategy.ec.europa.eu/en/policies/cra-reporting
- Commission Delegated Regulation (EU) 2026/881 of 11 December 2025, EUR-Lex eur-lex.europa.eu/eli/reg_del/2026/881/oj/eng
- Regulation (EU) 2024/2847, Cyber Resilience Act, articles 14 to 16, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj