When a reportable event occurs, the CRA uses a centralized routing architecture. Each Article 14 notification reaches both ENISA and the relevant national CSIRT simultaneously through a single submission.
Understanding this structure in advance ensures rapid filing during the mandatory 24-hour early-warning window.
This guide explains how the reporting pipeline functions and how authorities process submissions.
The Single Reporting Platform
The CRA (Regulation (EU) 2024/2847) establishes the Single Reporting Platform operated by ENISA.
The platform provides a unified submission endpoint. Instead of filing separate reports across multiple EU Member States, the manufacturer files once. The platform manages regulatory distribution.
National endpoints route submissions to designated CSIRTs while simultaneously notifying ENISA.
Who Receives the Report
Every Article 14 notification reaches two primary authorities simultaneously:
1. ENISA
ENISA, the European Union Agency for Cybersecurity, operates the platform and maintains EU-wide visibility. ENISA monitors cross-border threat patterns and coordinates Union-wide responses.
The platform includes privacy safeguards. Manufacturers can restrict sensitive technical details when broad circulation would increase exploitation risk before a patch is released.
2. The Designated National CSIRT
The notification routes to the coordinating Computer Security Incident Response Team (CSIRT) in the Member State where the manufacturer has its main establishment.
The national CSIRT provides operational support, liaises with local operators, and coordinates regional advisories. Manufacturers should identify their coordinating CSIRT in advance.
Onward Cross-Border Notifications
Exploited vulnerabilities often affect products deployed across multiple EU countries.
When an incident affects multiple jurisdictions, the platform alerts CSIRTs in other impacted Member States. This creates coordinated EU-wide situational awareness without requiring separate regional filings by the manufacturer.
Manufacturer Preparation Steps
Submissions require electronic filing with structured technical data. Manufacturers should prepare four key capabilities:
Platform access. Verify user credentials and administrative access for the Single Reporting Platform before an incident occurs.
Structured templates. Maintain pre-drafted templates covering affected versions, exploit indicators, and mitigating controls.
Linked notifications. Ensure early warnings, 72-hour notifications, and final reports share consistent tracking identifiers.
CSIRT contacts. Maintain direct contact information for your national coordinating CSIRT.
Summary for SMEs
Small and medium manufacturers do not need complex routing infrastructure. The Single Reporting Platform manages regulatory dissemination automatically.
The manufacturer's responsibility is operational readiness: verified platform credentials, clear triage authority, and structured data ready to submit within 24 hours. CVD Portal prepares manufacturers to meet these statutory requirements smoothly.
The portal captures incoming vulnerability reports through your branded disclosure channel, runs them through a CVSS-based triage that flags potential active exploitation, and generates structured notification content aligned to the early-warning, detailed-notification, and final-report stages of Article 14. It maintains the linkage between the three reports for a single event and keeps a complete audit trail of what was sent and when. The aim is that when an Article 14 event occurs, producing an accurate submission for the platform is a matter of minutes, not a scramble to assemble facts from scratch.
The bottom line
Article 14 reporting is organised around a single ENISA-operated platform that delivers each notification to ENISA and the relevant national CSIRT at once, with onward distribution to other affected member states built into the system. The manufacturer files once. The architecture turns that single filing into coordinated, Union-wide awareness.
For the manufacturer, the work is readiness: verified platform access, a known national CSIRT contact, and the ability to produce structured notifications fast. With the routing understood, the next question is timing, which the next post addresses in detail: reporting timelines and follow-up obligations.