Summary
- Manufacturers have been required to use the CRA Single Reporting Platform since 11 September.
- The system handles reports covering actively exploited vulnerabilities and severe security incidents.
- Updated ENISA guidance explains registration, authority routing, confidentiality, and different obligations for manufacturers and open source stewards.
As the Cyber Resilience Act moves into operational reporting, ENISA has expanded its guidance on the Single Reporting Platform now used by manufacturers to notify actively exploited vulnerabilities and severe security incidents affecting products with digital elements.
Manufacturers have been required to submit those notifications through the platform since 11 September, giving organisations a single EU route rather than requiring them to reproduce the same report independently for several national authorities.
Updated guidance published by ENISA explains how users register, choose the relevant computer security incident response team, appoint representatives, submit reports, and handle cases where several EU authorities need access to the information.
Although open source software stewards are also supported by the platform, their equivalent mandatory reporting obligations do not apply until December 2027. Treating both groups as if their legal duties had begun simultaneously would therefore misrepresent the implementation timetable.
One submission can reach several authorities
Centralising the submission does not remove national authorities from the process, since information is still routed according to the countries and competent bodies connected with the affected product or incident. The platform instead reduces the administrative burden of sending substantially identical reports through separate channels.
When a manufacturer files a notification, it identifies a main CSIRT, after which the system can make the information available to other relevant authorities under the framework established by the CRA. ENISA is responsible for operating and maintaining the platform and for implementing measures to protect the confidentiality of submitted information.
That confidentiality is particularly important when an early report concerns an actively exploited vulnerability that has not yet been fully remediated, because detailed technical information can itself create additional risk if distributed beyond those entitled to receive it.
Reporting also develops in stages rather than ending with the first notification. Organisations may have to provide increasingly detailed information as an incident or vulnerability investigation progresses, which ties legal reporting deadlines to the technical work of determining exploitation, affected products, impact, and remediation.
Cyber Insider previously covered the platform entering operation; ENISA’s latest material moves the story into implementation by defining more precisely how organisations and authorities are expected to use it.
As experience accumulates, ENISA says its frequently asked questions will continue to be updated, leaving the operational guidance able to evolve while organisations work through their first mandatory CRA notifications.
