ENISA Launches Cyber Resilience Act Single Reporting Platform
ENISA has launched the initial operating capability of the Single Reporting Platform (SRP), the EU’s common electronic reporting channel under the Cyber Resilience Act (CRA). From 11 September 2026, manufacturers must use the platform to notify actively exploited vulnerabilities and severe incidents affecting products with digital elements.
The SRP is intended to reduce fragmented reporting across Member States. A manufacturer can submit a notification once, after which the designated coordinating CSIRT receives it, shares relevant information with CSIRTs in Member States where the affected product is available, and makes the notification available to ENISA. This model is designed to support faster risk mitigation and more consistent handling of product-security incidents across the EU.
The reporting duty is part of the CRA’s phased implementation. While the incident and vulnerability reporting obligations now apply to manufacturers, the core cybersecurity requirements of the Regulation will apply from 11 December 2027. Open-source software stewards will also become subject to the reporting requirements from that date, where they are involved in developing products with digital elements, under Article 24(3) CRA.
ENISA developed, operates, and maintains the SRP and plans to expand its functions based on operational experience and user feedback. The Agency has also published supporting materials, including FAQs, user manuals, tutorial videos, a glossary, and multilingual factsheets. The European Commission provides separate guidance on the scope and application of the CRA reporting obligations.
For manufacturers, the SRP makes CRA compliance more operational but does not reduce the need for internal vulnerability-management, incident-response, and record-keeping processes. Businesses placing connected products on the EU market should ensure that they can identify reportable events promptly, assess notification deadlines, and submit accurate information through the new platform.
