Under the Cyber Resilience Act, Article 14(7) names one electronic notification end-point for each manufacturer, belonging to the coordinating CSIRT of the Member State of main establishment. A national end-point forms part of the single reporting platform under Article 16(1).
Key takeaways
- Article 14(7) of Regulation (EU) 2024/2847 requires the notification to be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union.
- Article 14(7) makes that submission simultaneously accessible to ENISA, so one filing reaches the coordinating CSIRT and ENISA together.
- Article 16(1) states that the architecture of the single reporting platform allows Member States and ENISA to put in place their own electronic notification end-points.
- The recitals record that ENISA is to take into account the possibility for national electronic notification end-points to be integrated into national single entry points that may also integrate other notifications required under Union law.
- Article 14 applies from 11 September 2026, and Article 69(3) extends it to products placed on the market before 11 December 2027.
Why the end-point is not a preference
Article 14(1) and (3) require a manufacturer to notify an actively exploited vulnerability, and a severe incident having an impact on the security of the product, through the single reporting platform referred to in Article 16, using one of the electronic notification end-points referred to in Article 16(1).
Article 14(7) then fixes which end-point. The notification is submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union, and is simultaneously accessible to ENISA.
Two things follow. A manufacturer files once rather than twice. And a manufacturer does not select the recipient, because main establishment decides it.
What a national end-point is
Article 16(1) establishes the single reporting platform, places its day-to-day operations with ENISA, and states that the architecture of the single reporting platform allows Member States and ENISA to put in place their own electronic notification end-points.
A reporting channel operated by a Member State authority under that provision is an end-point of the platform. Filing there is filing on the platform.
The recitals of the Regulation go one step further. When establishing the single reporting platform, ENISA is to take into account the possibility for the national electronic notification end-points to be integrated into national single entry points that may also integrate other notifications required under Union law. That wording is the room a Member State has to place CRA reporting beside notifications it already collects under other Union law.
What Article 14 settles, and what the operating authority settles
| Question | Settled by |
|---|---|
| Which end-point receives the notification | Article 14(7), through the Member State of main establishment |
| Whether one submission also reaches ENISA | Article 14(7), simultaneously accessible to ENISA |
| Which other Member States receive it | Article 16(2), from the Member States the manufacturer indicates |
| Which credential signs in | The authority that operates the end-point |
| Which language the form accepts | The authority that operates the end-point |
| Whether a machine interface exists | The authority that operates the end-point |
The lower three rows are why a manufacturer cannot finish this preparation from the Regulation alone. ENISA states that no application programming interface will be provided at the initial release of the single reporting platform, and that API functionality may be considered in a future phase. Each Member State answers the credential and language questions for its own end-point.
What to settle before 11 September 2026
- Determine the Member State of main establishment under Article 14(7) and record the reasoning with the technical documentation.
- Identify the CSIRT designated as coordinator for that Member State and locate its published reporting channel.
- Confirm which credential the end-point accepts and create the accounts in advance.
- Name more than one person who can file outside working hours.
- Keep current the list of Member States where the product has been made available, because Article 14(2), point (a) requires the 24-hour early warning to indicate it where applicable.
Our ENISA Single Reporting Platform guide covers registration and the notification screens. Our answer on reporting routes covers the four-step order for a manufacturer with no establishment in the Union.
Sources
- Regulation (EU) 2024/2847, Article 14
- Regulation (EU) 2024/2847, Article 16
- Regulation (EU) 2024/2847, Article 69
- Regulation (EU) 2024/2847, Article 71
- ENISA Single Reporting Platform
- ENISA Single Reporting Platform, frequently asked questions
Published by Porta Regulus B.V. Our editorial policy carries the company registration.
Settle the Article 14 filing path before 11 September 2026.
Get started freeFrequently asked questions
Can a manufacturer choose between the ENISA platform and a national CSIRT portal?
No. Article 14(7) requires the notification to be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union. The Member State of main establishment fixes the end-point, so no selection is available.
Does filing at a national end-point still reach ENISA?
Yes. Article 14(7) states that a notification submitted at the coordinating CSIRT's electronic notification end-point is simultaneously accessible to ENISA. One submission discharges the duty toward both recipients, and Article 16(2) then covers dissemination to the CSIRTs of other affected Member States.
Is a national reporting portal part of the ENISA single reporting platform?
Article 16(1) states that the architecture of the single reporting platform allows Member States and ENISA to put in place their own electronic notification end-points. A Member State end-point is therefore part of the platform architecture, and Article 14(1) and (3) require notification through the platform using one of those end-points.
Can a Member State fold CRA reporting into a portal it already operates?
The recitals of Regulation (EU) 2024/2847 record that ENISA is to take into account the possibility for the national electronic notification end-points to be integrated into national single entry points that may also integrate other notifications required under Union law. Whether a given Member State does so is a national implementation question.