Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
Where do you submit CRA vulnerability reports?
Updated
Manufacturers submit Article 14 reports of Regulation (EU) 2024/2847 simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform established under Article 16. This page is not legal advice and does not start a clock.
CRA where-to-submit guide, last verified 9 September 2026 against Regulation (EU) 2024/2847 Articles 3(51), 14, 16 and 71(2), Commission Delegated Regulation (EU) 2026/881, the European Commission's CRA reporting page (Commission materials — guidance, not the regulation), and ENISA Single Reporting Platform pages and FAQ updated 8 September 2026 (agency guidance, not the regulation). It is not legal advice, not a filing, not a determination that the CRA applies, and not a substitute for counsel.
This is the channel, not YOUR filing
Audience: an incident responder, CISO, or compliance lead at an organisation that might be a manufacturer of products with digital elements under Regulation (EU) 2024/2847. This page is not legal advice. It does not start a clock. Reading it does not start a clock. Mapping a row is not a determination that the CRA applies, that you are a manufacturer, that a product with digital elements has been made available on the Union market, that you have become aware, or that a filing is due.
Article 14 and Article 16 are legal requirements only if the Cyber Resilience Act applies to YOUR facts. This page quotes where those articles send a notification. It does not send one. Last verified 9 September 2026. Not legal advice.
- Statute versus guidance: Articles 3(51), 14, 16 and 71(2) are legal requirements only if they apply. Commission Delegated Regulation (EU) 2026/881 is a delegated act on delaying dissemination under Article 16(2) — not Article 14 itself. The Commission's CRA reporting page is Commission materials — guidance, not the regulation. ENISA Single Reporting Platform pages and the SRP FAQ (updated 8 September 2026) are agency guidance, not the regulation. This page quotes which kind of text it is relying on.
- The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The CRA-cluster Article 14 overview on this site is the Article 14 hub. The live Article 14 reporting guide on this site is the CRA Article 14 page under breach reporting — the 24-hour / 72-hour / 14-day ladder. This page does not duplicate that ladder.
- The CSIRT guide on this site is the coordinator-interaction page. The ENISA-workflow guide on this site is the platform-flow page. A dedicated 24-hour-early-warning, 72-hour-notification, final-report, and actively-exploited guide is not on this site yet. Naming them is not a link.
- The signed-in CRA ladder tracks recorded awareness for findings the organisation classified as CRA-in-scope. That tracker does not start an Article 14 clock, does not decide that the CRA applies, and does not file with a CSIRT or ENISA. There is no submit button. A named human still files.
Recipients and channels — Article 14 and Article 16
Article 14(1): a manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7, and to ENISA, via the single reporting platform established pursuant to Article 16. Article 14(3) uses the same two recipients and the same platform for a severe incident having an impact on the security of the product with digital elements. Those two tracks are not one filing class. This page does not find that YOUR event is either.
Article 14(7): the notifications referred to in paragraphs 1 and 3 of this Article shall be submitted via the single reporting platform referred to in Article 16, using one of the electronic notification end-points referred to in Article 16(1). The notification shall be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union, and shall be simultaneously accessible to ENISA. That is the legal requirement. Last verified 9 September 2026. Not legal advice.
- One notification, two simultaneous recipients: the CSIRT designated as coordinator and ENISA, via the platform. Do not invent a third manufacturer-facing desk in the article.
- Dissemination to other CSIRTs is the receiving CSIRT's Article 16(2) duty. It is not a second manufacturer submission.
- Article 14(8) user information is not the SRP filing. The who-to-notify page on this site is the recipient-class map.
| Recipient or onward path | Channel | Who sends it | Kind of text | Last verified |
|---|---|---|---|---|
| CSIRT designated as coordinator | The electronic notification end-point of that CSIRT on the single reporting platform (Article 14(7); Article 16(1)). | The manufacturer, via the platform. This page does not name YOUR CSIRT. | Legal requirement — Articles 14(1), 14(3), 14(7) and 16. Only if the CRA applies. | 9 September 2026 |
| ENISA | The same single reporting platform. Article 14(7): the notification shall be simultaneously accessible to ENISA. | The manufacturer, via the platform — not a second, separate ENISA portal. Simultaneous accessibility is the article. This page does not treat an ENISA FAQ as a second desk. | Legal requirement — Articles 14(1), 14(3), 14(7) and 16. | 9 September 2026 |
| Other CSIRTs designated as coordinators where the product has been made available | Dissemination through the single reporting platform after the first CSIRT receives the notification (Article 16(2)). | The CSIRT designated as coordinator that initially receives the notification — not a second manufacturer filing to each Member State. | Legal requirement — Article 16(2). The manufacturer does not file a copy to every CSIRT. | 9 September 2026 |
| Market surveillance authorities | Not an Article 14 manufacturer filing desk. ENISA's SRP FAQ (updated 8 September 2026) states that CSIRTs designated as coordinators may share some information with their respective market surveillance authorities. | The notified CSIRT, as that FAQ describes. Agency guidance, not the regulation. | ENISA SRP FAQ points 19 and 20 — agency guidance, not the regulation. | 9 September 2026 |
| Impacted users, and where appropriate all users | Article 14(8) — a different stream from the CSIRT/ENISA filings. Not the single reporting platform. | The manufacturer informs users. If the manufacturer fails to inform users in a timely manner, the notified CSIRTs designated as coordinators may provide that information when considered proportionate and necessary. | Legal requirement — Article 14(8). Distinct from the Article 14(1) and 14(3) filings. | 9 September 2026 |
Which CSIRT designated as coordinator — Article 14(7)
Article 3(51) defines CSIRT designated as coordinator as a CSIRT designated pursuant to Article 12(1) of Directive (EU) 2022/2555. This page does not find that YOUR national team is that CSIRT. Last verified 9 September 2026. Not legal advice.
Article 14(7) second subparagraph: main establishment is the place where the decisions related to the cybersecurity of the products with digital elements are predominantly taken. If that cannot be determined, it is the establishment with the highest number of employees in the Union. This page does not run that test for YOU.
If there is no main establishment in the Union, Article 14(7) third subparagraph sets a cascade, based on information available to the manufacturer. This table is the cascade as the article states it. It is not YOUR CSIRT.
- This page does not name YOUR CSIRT and does not publish a 27-Member-State filing-desk list. National CSIRT directories (including the CSIRTs Network) are directories, not Article 14.
- Article 14(7) fourth subparagraph: in relation to the third subparagraph, point (d), a manufacturer may submit notifications related to any subsequent actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements to the same CSIRT designated as coordinator to which it first reported.
- ENISA's SRP FAQ 18 (updated 8 September 2026 — agency guidance, not the regulation) restates the Article 14(7) cascade and states that selecting the wrong CSIRT designated as coordinator may invalidate the notification so that it needs to be resubmitted. That FAQ is not the article.
- The CSIRT guide on this site is the coordinator-interaction page.
| Order in Article 14(7) | What the article uses | Kind of text | Last verified |
|---|---|---|---|
| Main establishment in the Union | The CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union. Main establishment: the Member State where the decisions related to the cybersecurity of its products with digital elements are predominantly taken; if that Member State cannot be determined, the establishment with the highest number of employees in the Union. | Legal requirement — Article 14(7), first and second subparagraphs. | 9 September 2026 |
| (a) No main establishment — authorised representative | The Member State in which the authorised representative acting on behalf of the manufacturer for the highest number of products with digital elements of that manufacturer is established. | Legal requirement — Article 14(7), third subparagraph, point (a). This page does not find that YOU have that representative. | 9 September 2026 |
| (b) Then importer | The Member State in which the importer placing on the market the highest number of products with digital elements of that manufacturer is established. | Legal requirement — Article 14(7), third subparagraph, point (b). | 9 September 2026 |
| (c) Then distributor | The Member State in which the distributor making available on the market the highest number of products with digital elements of that manufacturer is established. | Legal requirement — Article 14(7), third subparagraph, point (c). | 9 September 2026 |
| (d) Then users | The Member State in which the highest number of users of products with digital elements of that manufacturer are located, based on the information available to the manufacturer. | Legal requirement — Article 14(7), third subparagraph, point (d). This page does not count YOUR users. | 9 September 2026 |
Single reporting platform — Article 16, and live status
Article 16(1): for the purposes of the notifications referred to in Article 14(1) and (3) and Article 15(1) and (2), and in order to simplify the reporting obligations of manufacturers, a single reporting platform shall be established by ENISA. The day-to-day operations of that single reporting platform shall be managed and maintained by ENISA. The architecture of the single reporting platform shall allow Member States and ENISA to put in place their own electronic notification end-points. That is the legal requirement.
Article 16(2): after receiving a notification, the CSIRT designated as coordinator that initially receives it disseminates the notification via the single reporting platform to the CSIRTs designated as coordinators of the Member States on whose territory the manufacturer indicated the product with digital elements has been made available. In exceptional circumstances and on justified cybersecurity-related grounds, that CSIRT may delay dissemination. Commission Delegated Regulation (EU) 2026/881 specifies the terms and conditions for those grounds. The delegated act is not Article 14.
What ENISA and the Commission currently publish, last verified 9 September 2026: ENISA's CRA SRP page and SRP FAQ (FAQ updated 8 September 2026) state that the platform is scheduled to be operational from 11 September 2026, coinciding with Article 14 application. ENISA FAQ 28 names https://portal.cra-srp.enisa.europa.eu and states the portal will be available from 11 September 2026. The Commission's CRA reporting page states the same operational-by date and that functional and security testing are under way.
As of 9 September 2026 this page cannot confirm that the production filing portal is live. A retrieval of the published portal address on the verification date did not return a live filing desk. ENISA has published that it will be available from 11 September 2026. This page does not invent a live portal, an API, or a national substitute URL.
| Claim | What the cited text currently says | Kind of text | Last verified |
|---|---|---|---|
| Who establishes the platform | A single reporting platform shall be established by ENISA. Day-to-day operations managed and maintained by ENISA. Member States and ENISA may put in place their own electronic notification end-points. | Legal requirement — Article 16(1). | 9 September 2026 |
| Scheduled operational date | ENISA FAQ 4 and the Commission's CRA reporting page state the platform is scheduled to be operational from 11 September 2026, coinciding with Article 14 application. | ENISA FAQ and Commission CRA reporting page — guidance, not the regulation. Article 71(2) is the legal requirement for when Article 14 applies. | 9 September 2026 |
| Published portal address | ENISA FAQ 28 names https://portal.cra-srp.enisa.europa.eu and states the portal will be available from 11 September 2026. | Agency guidance, not the regulation. Not proof the production system is live on the verification date. | 9 September 2026 |
| Production portal live on this page's verification date? | No confirmation. A retrieval of that published address on 9 September 2026 did not return a live filing desk. Do not invent a different portal. | This page's verification, not a legal finding. | 9 September 2026 |
| If the SRP is temporarily unavailable | ENISA FAQ 25 (guidance) states that manufacturers should wait until the SRP becomes available again and then submit; contacting the CSIRT directly does not replace the SRP filing once the platform is available. | Agency guidance, not a rewrite of Article 14(7). | 9 September 2026 |
Confirmed mechanism versus anticipated implementing detail
The confirmed mechanism is in the regulation: one manufacturer notification, submitted via the ENISA-established single reporting platform, using the electronic notification end-point of the CSIRT designated as coordinator, simultaneously accessible to ENISA. That is Articles 14 and 16. Last verified 9 September 2026. Not legal advice.
Platform behaviour that ENISA currently publishes — Assigned Representatives, EU Login with multi-factor authentication, Primary and Secondary AR roles, CSIRT validation of the association, no API at initial release, English only at launch, voluntary Article 15 reporting not available at launch — is agency guidance on implementing detail. It is not the article. The ENISA-workflow guide on this site is the platform-flow page.
| Point | What is confirmed in the regulation | What is currently published as guidance |
|---|---|---|
| Where the manufacturer files | Via the single reporting platform, to the CSIRT designated as coordinator and to ENISA (Articles 14(1), 14(3), 14(7) and 16). | ENISA FAQ 28 names a portal URL scheduled to be available from 11 September 2026. That URL is not confirmed live on 9 September 2026. |
| How many manufacturer filings | One notification via the platform, simultaneously accessible to ENISA. Dissemination to other CSIRTs is Article 16(2), not a second manufacturer filing. | ENISA FAQ 8 (guidance) states only one notification is required even where a manufacturer has multiple Union branches. |
| Who logs in | The regulation names the manufacturer (and, separately, open-source software stewards under Article 24(3) to the extent that article states). It does not name an 'Assigned Representative' role. | ENISA FAQ 9 (guidance) describes Assigned Representatives logging in with EU Login and multi-factor authentication. Registration and CSIRT validation of that association are ENISA/CSIRT process, not Article 14 itself. |
| API or bulk upload | The regulation does not specify an API. | ENISA FAQ 15 (guidance) states that no API will be provided at the initial release. |
| Article 15 voluntary reporting | Article 16(1) includes Article 15(1) and (2) among the notifications the platform is established for. Article 15 is a different stream from Article 14. | ENISA FAQ 4 and 27 (guidance) state that voluntary reporting under Article 15 will not be available at launch. That is platform sequencing, not a rewrite of Article 15. |
| Language | The regulation does not set the platform's interface language. | ENISA FAQ 24 (guidance) states that at launch the platform will be available in English only. |
Legal requirement versus Commission and ENISA guidance
The table below labels each text. Do not treat guidance as the article, and do not treat the article as optional because a FAQ exists. Last verified 9 September 2026. Not legal advice.
| Text | What it is | What this page does not do |
|---|---|---|
| Regulation (EU) 2024/2847 Articles 3(51), 14, 16 and 71(2) | Legal requirement — the regulation, only if it applies. | Does not apply those articles to YOU. Does not name YOUR CSIRT. |
| Commission Delegated Regulation (EU) 2026/881 | Delegated act specifying terms and conditions for delaying dissemination of notifications under Article 16(2), adopted 11 December 2025. Not Article 14 itself. | Does not find that YOUR notification meets a delay ground. |
| European Commission CRA reporting page | Commission materials. Guidance, not the regulation. Last update as fetched: 31 July 2026. | Does not treat a Commission page as a substitute for Articles 14 and 16. |
| ENISA Single Reporting Platform page, SRP FAQ (updated 8 September 2026), SRP Glossary, SRP factsheet | Agency guidance on the platform ENISA establishes under Article 16. Not the regulation. | Does not treat an ENISA FAQ as starting YOUR clock, and does not treat a named portal URL as proof the production system is live on the verification date. |
| CSIRTs Network directory | A directory of CSIRTs. Not Article 14, and not a filing desk. | Does not treat a directory listing as YOUR designated coordinator. |
How this differs from NIS2 and DORA filing desks
Do not paste one filing desk onto another. The NIS2 incident-reporting guide on this site is Directive (EU) 2022/2555 Article 23. The DORA incident-reporting guide on this site is Regulation (EU) 2022/2554 Articles 18–19. The CRA is Regulation (EU) 2024/2847 Articles 14 and 16. Last verified 9 September 2026. Not legal advice.
- NIS2 Article 23 is filed with the CSIRT or, where applicable, the competent authority. It is not filed with ENISA as the Article 23 desk, and it is not the CRA Single Reporting Platform.
- DORA Article 19 is filed with the relevant competent authority. It is not the CRA Single Reporting Platform.
- Filing one does not discharge another. A CRA Article 14 notification is not a NIS2 Article 23 early warning and not a DORA Article 19 initial notification.
- Article 3(51) borrows the CSIRT-designated-as-coordinator definition from NIS2 Article 12(1). That definition does not make a NIS2 filing into a CRA filing.
What to do now
As of last verification on 9 September 2026, Article 14 applies from 11 September 2026 — two days from that verification date. The list below is operational preparation. It is not a determination that the CRA applies to YOU, that you are a manufacturer, or that a reporting clock has started. Walk it with counsel.
- Ask counsel whether YOU are a manufacturer of a product with digital elements made available on the Union market. This page does not run that test. Marking CRA in an obligation map is not that determination.
- If counsel says Article 14 may apply, identify the CSIRT designated as coordinator under Article 14(7) (main establishment in the Union, or the cascade if you have none). This page does not name YOUR CSIRT.
- ENISA has published that the Single Reporting Platform is scheduled to be operational from 11 September 2026. As of 9 September 2026 the production filing portal is not confirmed live. ENISA's SRP FAQ (updated 8 September 2026) names https://portal.cra-srp.enisa.europa.eu and states the portal will be available from 11 September 2026. That URL is ENISA's published address, not a live filing this page can confirm. Do not invent a different portal.
- Do not treat contacting a national CSIRT outside the platform as a substitute for the Article 14(7) filing once the platform is available. ENISA FAQ 25 (guidance) says the same; it is not a rewrite of the article.
- The live Article 14 reporting guide on this site is the ladder. This page does not start that clock. The CSIRT guide on this site is the coordinator-interaction page. The ENISA-workflow guide on this site is the platform-flow page.
Checklist
This is a question list, not a filing, and not YOUR notice. Walk it with counsel. The live Article 14 reporting guide on this site is the ladder. The reporting-deadlines page on this site is the statute table of clocks.
- Does the CRA apply? Manufacturer of a product with digital elements made available on the Union market. This page does not run that test.
- Recipients: the CSIRT designated as coordinator and ENISA, via the single reporting platform — Articles 14(1), 14(3), 14(7) and 16. Not a separate national email as the statutory desk.
- Which CSIRT designated as coordinator under Article 14(7)? Main establishment, then the cascade. This page does not name it.
- Platform: ENISA has published that the SRP is scheduled to be operational from 11 September 2026. As of 9 September 2026 the production portal is not confirmed live. Verify ENISA's current SRP page before you treat a URL as a filing desk.
- Dissemination to other CSIRTs is Article 16(2), not a second manufacturer filing. User information is Article 14(8), not the SRP.
- The signed-in ladder, if you use it, tracks recorded awareness. It does not submit. There is no submit button. A named human still files.
- Document the assessment, including a no-notification decision. This page does not keep YOUR file.
Where this shows up in ShipReady Metrics
The signed-in app does not submit to ENISA or a CSIRT. It has no submit button to those authorities. It does not decide that the CRA applies, does not decide that you are a manufacturer, does not start an Article 14 clock, and does not file. A named human still files. None of the surfaces below is 'send this to ENISA' or 'this clock has started'.
If you already have a session: signed-in app → Compliance → CRA reporting tracks the Article 14 24-hour / 72-hour / 14-day ladder from recorded awareness for findings the organisation classified as CRA-in-scope actively exploited vulnerabilities. That tracker is recorded awareness only. It does not start an Article 14 clock. It does not file with a CSIRT or ENISA. A named human still files.
The obligation map lists frameworks the organisation has marked in-scope, including cra if that mark is set. That mark is not a determination that you are a manufacturer and is not a filing. The cyber risk register lives under Security. It is not an Article 14 file.
This page does not document a public demo URL. There is no public CRA demo path.
Primary sources (last verified 9 September 2026)
Every regulatory or guidance claim on this page is taken from one of these. If a later revision of a source changes the rule, the date above is how you can see we have not re-checked yet.
Regulation (EU) 2024/2847 of 23 October 2024 (Cyber Resilience Act), Articles 3(51), 14, 16 and 71(2), is a legal requirement only if it applies. Article 14 reporting applies from 11 September 2026 (Article 71(2)). Commission Delegated Regulation (EU) 2026/881 is the delegated act on delaying dissemination under Article 16(2) — not Article 14 itself. The European Commission's CRA reporting page is Commission materials, not the regulation. ENISA's Single Reporting Platform page, SRP FAQ (updated 8 September 2026), SRP Glossary and factsheet are agency guidance on the Article 16 platform, not the regulation. As of 9 September 2026 ENISA has published that the SRP is scheduled to be operational from 11 September 2026; the production portal is not confirmed live on the verification date. The CSIRTs Network directory is a directory, not Article 14. Directive (EU) 2022/2555 Article 23 is a different instrument; the NIS2 incident-reporting guide is on this site. These are not a complete world list. Not legal advice.
The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The CRA-cluster Article 14 overview on this site is the Article 14 hub. The CRA Article 14 reporting guide on this site is the live ladder. The CSIRT guide on this site is the coordinator-interaction page. The reporting-deadlines page on this site is the statute table of clocks. The who-to-notify page on this site is the recipient-class map. The NIS2 incident-reporting guide on this site is Article 23. The ENISA-workflow guide on this site is the platform-flow page. A dedicated 24-hour-early-warning, 72-hour-notification, final-report, and actively-exploited guide is not on this site yet. Naming them is not a link.
Frequently asked questions
Is this legal advice?
No. It is a where-to-submit page distilled from Regulation (EU) 2024/2847 Articles 14 and 16, with Commission and ENISA Single Reporting Platform materials labelled as guidance, not the regulation. Whether the CRA applies, whether you are a manufacturer, which CSIRT is designated as coordinator for YOU, and whether a clock has started are legal questions for counsel on your facts. This page does not start a clock.
Does ShipReady submit to ENISA?
No. The signed-in app does not submit to ENISA or a CSIRT, has no submit button to those authorities, does not start an Article 14 clock, and does not decide that the CRA applies or that you are a manufacturer. Compliance → CRA reporting tracks recorded awareness for findings the organisation classified as CRA-in-scope. A named human still files.
Does the CRA ladder file with a CSIRT?
No. The signed-in Compliance → CRA reporting ladder tracks recorded awareness only. It does not file with a CSIRT or ENISA, does not start an Article 14 clock, and does not become a notification. Opening the ladder, classifying a finding as CRA-in-scope, or reading this page does not submit a report. A named human still files via the single reporting platform.
Is the ENISA single reporting platform live?
As of last verification on 9 September 2026, this page cannot confirm that the production filing portal is live. ENISA's SRP FAQ (updated 8 September 2026 — agency guidance, not the regulation) names https://portal.cra-srp.enisa.europa.eu and states the portal will be available from 11 September 2026. Article 16 is the legal requirement that ENISA establish the platform. Do not invent a different portal.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.