Is the ENISA Single Reporting Platform live?

The ENISA Single Reporting Platform is live. Since 11 September 2026, manufacturers file Article 14 notifications of actively exploited vulnerabilities and severe incidents through it. ENISA advises registering only when a notification is due, not in advance.

Key takeaways

The CRA Single Reporting Platform opened on 11 September 2026, the day Article 14 reporting entered application.
ENISA built the platform in cooperation with the CSIRT Network.
Register on the platform only when a notification is due. Pre-registration is not a prerequisite for filing.
One filing reaches your coordinating CSIRT and ENISA at the same time under Article 14(7).
Open-source software steward reporting under Article 24(3) does not start until 11 December 2027.

The platform opened on the reporting date

Article 14 reporting obligations entered application on 11 September 2026. ENISA launched the Single Reporting Platform on the same day, working with the CSIRT Network. User guidance, FAQs and training materials sit on the ENISA platform page.

A manufacturer files once. The submission reaches the coordinating CSIRT of the Member State where the manufacturer has its main establishment in the Union, and it is accessible to ENISA at the same time. Article 14(7) leaves no separate channel for mandatory notifications.

Register only when you need to file

ENISA advises manufacturers to register on the platform only when they need to submit a specific notification. Registering in advance gains nothing, because pre-registration is not a prerequisite for filing.

One task does need doing in advance. Work out which coordinating CSIRT receives your report under Article 14(7), and record the reasoning with your technical documentation. That determination has a defensible answer today. Answering it while a 24-hour clock runs is avoidable work.

Open-source stewards wait until December 2027

The reporting start date for open-source software stewards differs from the manufacturer date. Article 24(3) applies the Article 14(1), (3) and (8) reporting duties to stewards, but only from 11 December 2027.

Article 71(2) brings Article 14 forward to 11 September 2026 and leaves Article 24 on the general application date. The Commission set this out in FAQ 5.5 of its CRA implementation FAQ. A steward involved in developing a product with digital elements therefore carries no 24-hour or 72-hour duty before 11 December 2027, though voluntary reporting under Article 15 stays open.

Where the Commission explains reporting

The Commission expanded its reporting guidance alongside the platform launch. Section 9.1 of the guidance on the application of the CRA covers the reporting obligations. Section 5 of the Commission implementation FAQ answers the recurring reporting questions, and the Commission reporting webpage was updated to match.

Sources

Published by Porta Regulus B.V. Our editorial policy carries the company registration.

Frequently asked questions

Is the CRA Single Reporting Platform operational now?

Yes. ENISA launched the Single Reporting Platform on 11 September 2026, the day Article 14 reporting entered application. Manufacturers submit early warnings, 72-hour notifications and final reports through it. ENISA built it in cooperation with the CSIRT Network.

Do I have to register on the platform before an incident?

No. ENISA advises manufacturers to register only when they need to submit a specific notification. Pre-registration is not a prerequisite for filing. The step that cannot wait is working out which coordinating CSIRT receives your report under Article 14(7).

Do open-source software stewards report from 11 September 2026?

No. Article 24(3) applies Article 14 reporting duties to stewards from 11 December 2027, not 11 September 2026. Article 71(2) brings Article 14 forward but not Article 24. The Commission confirmed this in FAQ 5.5 of its CRA implementation FAQ.

Is the ENISA Single Reporting Platform live for CRA reporting?