The CRA Single Reporting Platform Goes Live on 11 September
Manufacturers get a 24-hour early-warning clock with no onboarding grace period, and registration validation by a national CSIRT is explicitly not a precondition for filing.
From 11 September 2026 the Single Reporting Platform becomes the channel through which manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents, alongside the national CSIRTs that receive them. ENISA has published its onboarding material ahead of the date: assigned representative guides for user registration, notification submission and interface functions, updated during the first half of August, plus a factsheet and an FAQ.
The mechanics are worth reading before the first incident rather than during one. Each manufacturer gets two seats: an assigned representative primary user and a backup, the second joining by an emailed invitation whose link expires after seven days. Access runs through an EU Login account, which is a separate thing from platform registration and can be created in advance — a detail that matters when the clock you are working against is twenty-four hours.
The most useful clarification is about validation. A coordinator CSIRT validating an assigned representative's registration is not a prerequisite for meeting the reporting obligation; validation proceeds in parallel and does not block a submission. In other words a manufacturer whose paperwork is still being processed is not thereby excused, and equally is not blocked.
One operational caveat sits in the dissemination path. Only early warnings reach ENISA automatically; cross-border dissemination of early warnings, 72-hour notifications and final reports by the coordinator CSIRT is a manual step. A manufacturer selling the same product into several member states should not assume a single filing propagates on its own.
As of the middle of August no public platform URL, no list of coordinator CSIRTs and no API had been published, which leaves a short window for preparation. The work that does not depend on any of that: create the EU Login accounts, name a primary and a backup representative whose mailbox somebody actually watches, and draft the early-warning template now. A twenty-four-hour obligation is not something to meet by improvising on a Saturday.
Source: ENISA