ENISA Publishes SRP Registration and Notification Guidance

ENISA has published the operational guidance for the CRA Single Reporting Platform. It arrives as three documents: a two-page factsheet on reporting, guidance on authorised-representative user registration, and guidance on notification submission and update. The platform FAQ was refreshed at the same time.

The content is procedural rather than legal. Nothing here changes what Article 14 requires. What it changes is how much of the work has to happen before 11 September 2026 rather than on it.

You need an EU Login account, and you need it now

Access to the platform runs through EU Login, the European Commission's authentication service. Accounts can be created today at ecas.ec.europa.eu.

This applies to manufacturers and to the authorised representatives of open-source software stewards alike. If you are a non-EU manufacturer reporting through an authorised representative, the account belongs to that representative, not to you. Work out now which named people will hold accounts, because the answer determines who can file at three in the morning.

Your coordinating CSIRT validates you, after you arrive

ENISA states that the CSIRT designated as coordinator performs the validation that a representative may submit a report on behalf of a specific manufacturer, and that this happens after first access to the platform rather than as a prerequisite completed in advance.

Read that carefully, because it is the part most likely to be misread as reassuring. You cannot get validated and then relax. You sign in, and the check follows on a timetable that belongs to a national authority rather than to you. The only defence is to establish access early enough that any friction surfaces while nothing is on fire.

This makes the Article 14(7) determination more urgent, not less. If you have not established which CSIRT is yours and written down the reasoning, you do not know who validates you.

There is no API

ENISA has confirmed that no application programming interfaces will be provided at this stage.

Manufacturers who assumed that a vulnerability management platform would eventually push notifications programmatically should re-plan on the basis that it will not. Every early warning, every 72-hour notification and every final report is a person signing in and completing a form. Portfolio size does not change that. Neither does the hour at which awareness begins.

The practical consequence is a staffing question rather than a tooling one. A 24-hour deadline that can start at any moment, satisfied only by manual filing, needs named people and an out-of-hours path.

What to do before 11 September

The platform is scheduled to be operational by 11 September 2026, the same day the obligation starts to apply. There is no window in which to learn it under no pressure.

Four things are worth completing now. Create the EU Login accounts. Determine your coordinating CSIRT under Article 14(7) and record the reasoning with your technical documentation. Confirm platform access works and surface any validation delay early. Decide who files out of hours, and make sure more than one person can.

ENISA's guidance is published on its Single Reporting Platform page.