Do I have to use the ENISA single reporting platform to report under the CRA?

Article 14(7) states that the notifications referred to in Article 14(1) and (3) shall be submitted via the single reporting platform referred to in Article 16, using one of the electronic notification end-points referred to in Article 16(1).^[1] There is no parallel channel, no direct-to-ENISA alternative, and no national form that substitutes for it.

Which end-point you use is determined rather than chosen. The notification is submitted using the end-point of the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union, and it is simultaneously accessible to ENISA.^[1] ENISA and the coordinating CSIRT are not alternatives you pick between.

Article 16(1) puts the platform itself in ENISA's hands. It is established by ENISA, its day-to-day operations are managed and maintained by ENISA, and its architecture allows Member States and ENISA to put in place their own electronic notification end-points.^[3]

Article 14(7) defines main establishment for this purpose as the Member State where the decisions related to the cybersecurity of the manufacturer's products with digital elements are predominantly taken. Where that Member State cannot be determined, it is the Member State where the manufacturer has the establishment with the highest number of employees in the Union.^[1]

A manufacturer with no main establishment in the Union follows an ordered cascade, based on the information available to it: the Member State of the authorised representative acting for the highest number of its products, then the Member State of the importer placing the highest number on the market, then the Member State of the distributor making the highest number available, then the Member State with the highest number of users.^[1]

This is a determination to settle before an incident rather than during one. Working out which CSIRT is your coordinator while a 24-hour clock runs is avoidable work.

Article 16(2) puts dissemination on the receiving CSIRT. After receiving a notification, the coordinating CSIRT initially receiving it shall without delay disseminate it via the platform to the coordinating CSIRTs of the territories where the manufacturer has indicated the product has been made available.^[3]

That dissemination can be held back. In exceptional circumstances, particularly on the manufacturer's request and in light of the sensitivity indicated under Article 14(2), point (a), dissemination may be delayed on justified cybersecurity-related grounds for a strictly necessary period, including where the vulnerability is subject to a coordinated vulnerability disclosure procedure under Article 12(1) of the NIS2 Directive. A CSIRT that withholds must immediately inform ENISA, give its justification, and indicate when it will disseminate.^[3][4]

The practical consequence is that the sensitivity flag on your 24-hour filing is a real lever rather than a formality. It is the input that the withholding decision is made against.

Article 15 opens a second channel with a much wider entrance. Manufacturers as well as other natural or legal persons may voluntarily notify any vulnerability contained in a product with digital elements and any cyber threat that could affect its risk profile, and separately any incident having an impact on the security of the product and any near miss that could have resulted in such an incident.^[2]

Those notifications go to a CSIRT designated as coordinator or ENISA, and are processed in accordance with the Article 16 procedure. The coordinating CSIRT may prioritise mandatory notifications over voluntary ones.^[2]

Two consequences matter to a manufacturer. Where someone other than the manufacturer voluntarily notifies an actively exploited vulnerability or a severe incident in your product, the coordinating CSIRT shall without undue delay inform you.^[2] And voluntary reporting shall not result in the imposition of additional obligations on the notifier, which removes a common reason for hesitating over a borderline case.^[2]