Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How does the ENISA single reporting platform workflow work?
Updated
The ENISA Single Reporting Platform is the Article 16 channel for CRA Article 14 notifications: identity, then 24-hour, 72-hour, and final entries, then CSIRT dissemination. This page is an agency-guidance walkthrough, not the regulation, not legal advice, and does not start a clock.
ENISA reporting workflow, last verified 9 September 2026 against Regulation (EU) 2024/2847 Articles 14 and 16, ENISA's Single Reporting Platform page, SRP FAQ (updated 8 September 2026 — agency guidance, not the regulation), ENISA Assigned-Representative submission guidance (updated 3 August 2026 — agency guidance, not the regulation), and the European Commission's CRA reporting page (Commission materials, last updated 31 July 2026). The live platform UI at the ENISA portal was not fetchable on that verification date: ENISA's FAQ states the portal is available from 11 September 2026. This page does not invent screenshots or live button labels. It is not legal advice, not a filing, not a determination that the CRA applies, and not a substitute for counsel. It does not start a clock.
This is the ENISA workflow page, not a filing
Audience: a CISO, product, engineering, or compliance lead at an organisation that might be a manufacturer of products with digital elements under Regulation (EU) 2024/2847. This page is not legal advice. It does not start a clock. Reading it does not start a clock. Mapping a row is not a determination that the CRA applies, that you are a manufacturer, that a product with digital elements has been made available on the Union market, that you have become aware, or that a filing is due.
This page walks the Article 16 single reporting platform as a numbered workflow. The CRA-cluster Article 14 overview on this site is the cluster hub. The statute-clock Article 14 guide on this site is the ladder under breach reporting. Those two pages agree on the 24-hour, 72-hour, and 14-day marks. This page does not invent a second set of clocks. Last verified 9 September 2026. Not legal advice.
- Statute versus guidance: Articles 14 and 16 are legal requirements only if they apply. ENISA's Single Reporting Platform page, SRP FAQ, glossary, and Assigned-Representative guidance are agency guidance, not the regulation. The Commission's CRA reporting page and implementation FAQs are Commission materials, not the regulation. Commission Delegated Regulation (EU) 2026/881 is a delegated act specifying delay grounds under Article 16(2), not a substitute for Article 16. This page quotes which kind of text it is relying on.
- The live platform UI was not fetchable at last verification on 9 September 2026. ENISA's SRP FAQ (updated 8 September 2026) states the portal is available from 11 September 2026. This page describes the flow generically from the regulation and from ENISA's published guidance. It does not invent screenshots or live button labels.
- The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The CRA-cluster Article 14 overview on this site is the cluster hub. Article 14 reporting is a manufacturer duty; this page does not find that YOU are a manufacturer.
- The where-to-submit guide on this site is the Article 14 channel page. The CSIRT guide on this site is the coordinator-interaction page. A dedicated 24-hour early-warning, 72-hour notification, and final-report guide is not on this site yet. Naming them is not a link.
- The signed-in CRA ladder tracks recorded awareness for findings the organisation classified as CRA-in-scope. That tracker produces a named-reviewer draft. It does not start an Article 14 clock, does not decide that the CRA applies, and does not submit into the ENISA platform. A named human still submits.
What Article 16 establishes — legal requirement, not ENISA's FAQ
Article 16(1): for the purposes of the notifications referred to in Article 14(1) and (3) and Article 15(1) and (2) and in order to simplify the reporting obligations of manufacturers, a single reporting platform shall be established by ENISA. The day-to-day operations of that single reporting platform shall be managed and maintained by ENISA. The architecture of the single reporting platform shall allow Member States and ENISA to put in place their own electronic notification end-points. That is the legal requirement. Last verified 9 September 2026 against the regulation on EUR-Lex.
Article 14(1) and 14(3): a manufacturer shall notify simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform established pursuant to Article 16. Article 14(7) addresses the notification to the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union and, unless particularly exceptional circumstances as referred to in Article 16(2), third subparagraph, apply, simultaneous accessibility to ENISA. This page does not run that cascade for YOU.
Article 71(2): Article 14 shall apply from 11 September 2026. This page does not start that clock. It does not treat an ENISA FAQ as moving that date.
| Provision | What the cited text says | Kind of text | Last verified |
|---|---|---|---|
| Article 16(1) — establishment | A single reporting platform shall be established by ENISA for the notifications referred to in Article 14(1) and (3) and Article 15(1) and (2). ENISA manages and maintains day-to-day operations. | Legal requirement — Article 16(1). Only if the CRA applies. | 9 September 2026 |
| Article 14(1) and 14(3) — simultaneous notification | Notify simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform established pursuant to Article 16. | Legal requirement — Article 14(1) and 14(3). This page does not submit that notification. | 9 September 2026 |
| Article 16(2) — dissemination | After receiving a notification, the CSIRT designated as coordinator initially receiving it shall, without delay, disseminate it via the single reporting platform to the CSIRTs designated as coordinators on the territory of which the manufacturer has indicated that the product with digital elements has been made available. | Legal requirement — Article 16(2). This page does not disseminate. | 9 September 2026 |
| Article 16(2) — delayed dissemination | In exceptional circumstances, dissemination may be delayed based on justified cybersecurity-related grounds for a period that is strictly necessary. In particularly exceptional circumstances listed in Article 16(2), third subparagraph, only limited information is made available simultaneously to ENISA until the full notification is disseminated. | Legal requirement — Article 16(2). This page does not decide that those grounds apply to YOU. | 9 September 2026 |
| Article 16(3) — market surveillance authorities | After receiving a notification of an actively exploited vulnerability or of a severe incident having an impact on the security of a product with digital elements, the CSIRTs designated as coordinators shall provide the market surveillance authorities of their respective Member States with the notified information necessary for those authorities to fulfil their obligations under this Regulation. | Legal requirement — Article 16(3). This page does not notify YOUR market surveillance authority. | 9 September 2026 |
| Article 16(4) — platform security | ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the single reporting platform and the information submitted or disseminated via it. | Legal requirement — Article 16(4). | 9 September 2026 |
Last-verified: live platform UI was not fetchable
Last verified 9 September 2026. ENISA's SRP FAQ (updated 8 September 2026) states the portal will be available from 11 September 2026 at the URL ENISA publishes, and that Assigned Representatives log in with an EU Login account. That FAQ is agency guidance, not the regulation, and not a verified live screenshot. This page did not fetch a production platform UI on the verification date. It does not invent screenshots or live button labels.
The Commission's CRA reporting page (last updated 31 July 2026) states that the Single Reporting Platform will be operational by 11 September 2026 and that functional and security testing are under way. That page is Commission materials, not the regulation. ENISA's FAQ 22 (updated 8 September 2026) states ENISA does not currently foresee additional testing before go-live. Those two guidance pages are not the same text and are not Article 16. This page does not treat either as proof the production UI was fetchable on 9 September 2026.
ENISA's published Assigned-Representative submission guidance (updated 3 August 2026) describes starting a new notification from a dashboard, completing early-warning fields, then later completing 72-hour and final-report fields on the same case. That guidance includes screenshots. This page does not reproduce them. Field lists live in ENISA's SRP glossary (agency guidance). This page does not copy that glossary as YOUR form.
Numbered workflow
The table is a walkthrough of the cited texts, not a submit button and not YOUR filing. Steps that quote Articles 14 and 16 are legal requirements only if they apply. Steps that quote ENISA pages are agency guidance, not the regulation. The live platform UI was not fetchable at last verification. Last verified 9 September 2026. Not legal advice.
| Step | What the cited text says | Kind of text | What this page does not do |
|---|---|---|---|
| 1. Identity | ENISA's SRP FAQ (updated 8 September 2026) states Assigned Representatives of manufacturers register on the Single Reporting Platform with a personal EU Login account and multi-factor authentication. A Primary Assigned Representative associates with the manufacturer and selects the CSIRT designated as coordinator; Secondary Assigned Representatives join by invitation. ENISA's FAQ 28 states the portal is available from 11 September 2026. | ENISA SRP FAQ. Agency guidance, not the regulation. Live portal UI not fetchable at last verification. | Does not create YOUR EU Login, does not register YOU as an Assigned Representative, and does not fetch the live portal UI. |
| 2. Select the CSIRT designated as coordinator | Article 14(7): notifications shall be submitted via the single reporting platform and addressed to the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union. ENISA's FAQ 8 and 18 state manufacturers identify that CSIRT in accordance with Article 14(7) and select it when submitting. | Article 14(7) is the legal requirement. ENISA FAQ 8 and 18 are agency guidance, not the regulation. | Does not name YOUR CSIRT and does not run the Article 14(7) cascade. |
| 3. Submit the 24-hour early warning | Article 14(2)(a) and 14(4)(a): without undue delay and in any event within 24 hours of becoming aware, an early warning of the actively exploited vulnerability or of the severe incident. ENISA's published Assigned-Representative guidance describes completing early-warning fields on a new notification, then submitting or saving a draft. | Article 14(2)(a) and 14(4)(a) are the legal requirement. ENISA Assigned-Representative guidance is agency guidance, not verified live UI. | Does not start YOUR 24-hour clock, does not decide that you have become aware, and does not submit the early warning. |
| 4. Submit the 72-hour notification | Article 14(2)(b) and 14(4)(b): without undue delay and in any event within 72 hours of becoming aware, a notification with general information and an initial assessment. ENISA's published guidance describes completing 72-hour fields on the existing notification after an early warning has been submitted. | Article 14(2)(b) and 14(4)(b) are the legal requirement. ENISA guidance is agency guidance, not verified live UI. | Does not start YOUR 72-hour clock and does not submit the notification. |
| 5. Submit the final report | Article 14(2)(c): a final report no later than 14 days after a corrective or mitigating measure is available, on the actively-exploited track. Article 14(4)(c): a final report within one month after the 72-hour incident notification, on the severe-incident track. Those two final-report marks are not one number. ENISA's published guidance describes completing final-report fields on the existing notification after the early warning and 72-hour notification. | Article 14(2)(c) and 14(4)(c) are the legal requirement. ENISA guidance is agency guidance, not verified live UI. | Does not start YOUR final-report clock and does not blend the 14-day mark with the one-month mark. |
| 6. Simultaneous availability to ENISA | Article 14(1), 14(3) and 14(7): unless particularly exceptional circumstances as referred to in Article 16(2), third subparagraph, apply, the notification is simultaneously accessible to ENISA. ENISA's FAQ 8 and 20 restate that simultaneous availability as platform behaviour. | Articles 14(1), 14(3) and 14(7) are the legal requirement. ENISA FAQ is agency guidance, not the regulation. | Does not file with ENISA and does not decide that particularly exceptional circumstances apply. |
| 7. Dissemination to other CSIRTs | Article 16(2): the CSIRT designated as coordinator initially receiving the notification shall, without delay, disseminate it via the single reporting platform to the CSIRTs designated as coordinators on the territory of which the manufacturer has indicated that the product with digital elements has been made available. | Legal requirement — Article 16(2). ENISA FAQ 8 describes the same flow as agency guidance. | Does not disseminate to other CSIRTs and does not decide a delay. |
| 8. Market surveillance authorities | Article 16(3): CSIRTs designated as coordinators shall provide the market surveillance authorities of their respective Member States with the notified information necessary for those authorities to fulfil their obligations under this Regulation. ENISA's FAQ 1 and 8 state that national CSIRTs may share some information with their respective market surveillance authorities. | Article 16(3) is the legal requirement. ENISA FAQ is agency guidance, not the regulation. | Does not notify YOUR market surveillance authority. |
| 9. Confidentiality and delayed dissemination | Article 16(2): in exceptional circumstances, dissemination may be delayed based on justified cybersecurity-related grounds for a period that is strictly necessary. Article 16(4): ENISA shall take measures to manage risks to the security of the platform and the information submitted or disseminated via it. Commission Delegated Regulation (EU) 2026/881 further specifies delay conditions. ENISA's FAQ 21 describes particularly exceptional circumstances (PEC) as a 72-hour-window assessment. | Article 16(2) and 16(4) are legal requirements. Delegated Regulation (EU) 2026/881 is a Commission delegated act. ENISA FAQ 21 is agency guidance, not the regulation. | Does not decide YOUR confidentiality marking, does not invoke PEC, and does not delay dissemination. |
What ENISA guidance currently says the platform does — not the article
The rows below are ENISA or Commission guidance. They are not Article 16. Last verified 9 September 2026. Not legal advice.
| Topic | What the cited text says | Kind of text | What this page does not do |
|---|---|---|---|
| When the portal is available | ENISA's SRP FAQ 4 and 28: the platform is scheduled to be operational from 11 September 2026, coinciding with Article 14. FAQ 28: the portal will be available from 11 September 2026. | ENISA SRP FAQ (updated 8 September 2026). Agency guidance, not the regulation. | Does not treat an ENISA FAQ as starting YOUR clock. Does not treat a named portal URL as proof the production UI was live on 9 September 2026. |
| What is in scope at launch | ENISA's FAQ 4 and 27: at launch the platform supports mandatory reporting of actively exploited vulnerabilities and severe incidents under Article 14. Corresponding open-source software steward reporting under Article 24(3) applies from 11 December 2027. Voluntary reporting under Article 15 is not available at launch. | ENISA SRP FAQ. Agency guidance, not the regulation. Article 71(2) is the legal requirement for when Article 14 applies. | Does not open a voluntary-reporting channel and does not classify YOU as a steward. |
| One notification | ENISA's FAQ 8: only one notification is required for any given actively exploited vulnerability or severe incident, even when a manufacturer has multiple branches or subsidiaries in the EU. | ENISA SRP FAQ. Agency guidance, not the regulation. | Does not file that one notification for YOU. |
| No API at launch | ENISA's FAQ 15: no application programming interface will be provided at the initial release, so notifications are submitted through the platform interface. | ENISA SRP FAQ. Agency guidance, not the regulation. | Does not provide an ENISA-platform API and does not submit through one. |
| If the platform is unavailable | ENISA's FAQ 25: if the platform is temporarily unavailable, wait until it becomes available again and then submit. Direct contact with the designated CSIRT does not replace submission through the platform once it is available, in accordance with Article 14(7). | ENISA SRP FAQ. Agency guidance, not the regulation. Article 14(7) is the legal requirement for using the platform. | Does not contact YOUR CSIRT and does not queue a filing. |
| Platform counters versus Article 14 clocks | ENISA's FAQ 26: platform counters are a reference for reminders and alerts. They do not replace the obligation to report upon becoming aware, without undue delay and in any event within the timelines in Article 14. FAQ 26 also states that in the current release the 72-hour counter displays a due time 48 hours after the 24-hour early warning. | ENISA SRP FAQ. Agency guidance, not the regulation. Article 14 clocks are the legal requirement. | Does not treat an ENISA counter as YOUR Article 14 clock. Does not start a clock. |
What to do now
As of last verification on 9 September 2026, Article 14 applies from 11 September 2026 — two days from that verification date. The live ENISA portal UI was not fetchable. The list below is operational preparation. It is not a determination that the CRA applies to YOU, that you are a manufacturer, or that a reporting clock has started. Walk it with counsel.
- Ask counsel whether the CRA applies and whether YOU are a manufacturer. This page does not run that test. Marking CRA in an obligation map is not that determination.
- If counsel says Article 14 may apply, open the CRA-cluster Article 14 overview and the statute-clock Article 14 guide on this site for the 24-hour / 72-hour / 14-day ladder. This page does not start that clock.
- Decide who, if anyone, will be the human Assigned Representative on ENISA's platform, and whether that person already has an EU Login account. That is ENISA guidance on identity, not a filing by this product. This page does not register YOU.
- Do not treat ENISA documentation as the regulation. Do not treat a named portal URL as a submit button in this product. Do not treat reading this page as becoming aware.
- The where-to-submit guide on this site is the Article 14 channel page. The CSIRT guide on this site is the coordinator-interaction page. A dedicated 24-hour, 72-hour, and final-report guide is not on this site yet. Naming them is not a link.
Checklist
This is a question list, not a filing, and not YOUR notice. Walk it with counsel. The CRA-cluster Article 14 overview on this site is the cluster hub. The statute-clock Article 14 guide on this site is the ladder. The CRA overview on this site is the pillar page.
- Does the CRA apply? Manufacturer of a product with digital elements made available on the Union market. This page does not run that test.
- Article 16 single reporting platform: identity, then 24-hour, 72-hour, and final entries, then CSIRT dissemination. This page does not submit those entries.
- Early warning: 24 hours from becoming aware — Article 14(2)(a) or 14(4)(a). This page does not start that clock.
- Notification: 72 hours from becoming aware — Article 14(2)(b) or 14(4)(b). Same start event as the 24-hour early warning.
- Final report, actively-exploited track: 14 days after a corrective or mitigating measure is available — Article 14(2)(c). Final report, severe-incident track: one month after the 72-hour notification — Article 14(4)(c). Those two marks are not one number.
- Live ENISA portal UI: not fetchable at last verification on 9 September 2026. ENISA's FAQ states availability from 11 September 2026. This page does not invent screenshots.
- Document the assessment, including a no-notification decision. This page does not keep YOUR file.
Where this shows up in ShipReady Metrics
The signed-in app does not decide that the CRA applies, does not decide that you are a manufacturer, does not decide that a finding is an actively exploited vulnerability or a severe incident, does not start an Article 14 clock, and does not submit to ENISA or a CSIRT. None of the surfaces below is 'CRA applies', 'this clock has started', or a submit button on the ENISA platform.
If you already have a session: signed-in app → Compliance → CRA reporting tracks the Article 14 24-hour and 72-hour stages from recorded awareness, and the 14-day final-report mark from recorded measure availability, for findings the organisation has classified as CRA-in-scope. That tracker is the E14 named-reviewer draft a human can take into the ENISA platform. It does not start an Article 14 clock. It is not a determination that the CRA applies. A named human still submits into ENISA.
The obligation map lists frameworks the organisation has marked in-scope, including CRA if that mark is set. That mark is not a determination that the CRA applies, not a determination that you are a manufacturer of a product with digital elements, and not a legal opinion. The cyber risk register lives under Security. None of those surfaces files an Article 14 early warning, notification, or final report with a CSIRT or ENISA.
This page does not document a public demo URL. There is no public CRA demo path. ENISA's Single Reporting Platform is ENISA's Article 16 platform, not a submit button in this product.
Primary sources (last verified 9 September 2026)
Every regulatory or guidance claim on this page is taken from one of these. If a later revision of a source changes the rule, the date above is how you can see we have not re-checked yet.
Regulation (EU) 2024/2847 of 23 October 2024 (Cyber Resilience Act), Articles 14 and 16, is a legal requirement only if it applies. Article 14 reporting applies from 11 September 2026 (Article 71(2)). ENISA's Single Reporting Platform page, SRP FAQ (updated 8 September 2026), SRP glossary, and Assigned-Representative submission guidance (updated 3 August 2026) are agency guidance on the Article 16 platform, not the regulation. The European Commission's CRA reporting page (last updated 31 July 2026) and CRA implementation FAQs are Commission materials, not the regulation. Commission Delegated Regulation (EU) 2026/881 is a delegated act specifying conditions for delayed dissemination under Article 16(2), not a substitute for Article 16. The live platform UI was not fetchable at last verification. Directive (EU) 2022/2555 Article 23 is a different instrument; the NIS2 incident-reporting guide is on this site. Regulation (EU) 2022/2554 Articles 18–19 are a different instrument; the DORA incident-reporting guide is on this site. These are not a complete world list. Not legal advice.
The CRA-cluster Article 14 overview on this site is the cluster hub. The statute-clock Article 14 guide on this site is the live ladder under breach reporting. The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The where-to-submit guide on this site is the Article 14 channel page. The CSIRT guide on this site is the coordinator-interaction page. A dedicated 24-hour early-warning, 72-hour notification, and final-report guide is not on this site yet. Naming them is not a link.
Frequently asked questions
Is this legal advice?
No. It is a workflow page distilled from Regulation (EU) 2024/2847 Articles 14 and 16, with ENISA Single Reporting Platform materials and Commission CRA pages labelled as guidance, not the regulation. Whether the CRA applies, whether you are a manufacturer, whether you have become aware, and whether a clock has started are legal questions for counsel on your facts. This page does not start a reporting clock.
Does ShipReady submit on the ENISA platform?
No. The signed-in app does not submit into the ENISA Single Reporting Platform, does not file with a CSIRT, and does not start an Article 14 clock. Compliance → CRA reporting is the E14 named-reviewer draft for findings the organisation classified as CRA-in-scope. A named human still submits into ENISA. The obligation map is frameworks marked in-scope, not a legal opinion.
Is ENISA documentation the regulation?
No. Articles 14 and 16 of Regulation (EU) 2024/2847 are the legal requirement, only if they apply. ENISA's Single Reporting Platform page, SRP FAQ, glossary, and Assigned-Representative guidance are agency guidance, not the regulation. Commission CRA pages are Commission materials, not the regulation. This page labels which kind of text it is relying on.
Did you verify the live ENISA portal UI?
No. Last verified 9 September 2026, the live platform UI was not fetchable. ENISA's SRP FAQ (updated 8 September 2026) states the portal is available from 11 September 2026. This page describes the flow generically from the regulation and from ENISA's published guidance. It does not invent screenshots or live button labels.
Does the in-app ladder start my Art. 14 clock?
No. The signed-in Compliance → CRA reporting tracker runs from recorded awareness for findings the organisation classified as CRA-in-scope. Recorded awareness is a human determination the platform must not backdate. Opening the ladder, classifying a finding as CRA-in-scope, or reading this page does not start the Article 14 clock. A named human still files with the CSIRT and ENISA via the single reporting platform.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.