ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities
ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.
ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.
- CRA reporting obligations binding since 11 September 2026.
- Deadlines: 24-hour early warning, 72-hour notification, 14-day final report.
- One submission routes to coordinating CSIRT, other Member State CSIRTs, and ENISA.
- First release is web-only, English-only, with no API.
- Open-source stewards covered from 11 December 2027.
From the original article
2 min read at helpnetsecurity.com
The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.