EU Launches Cyber Resilience Act Reporting Platform as 24‑Hour Disclosure Rules Take Effect

The EU Agency for Cybersecurity (ENISA) has activated the Cyber Resilience Act's Single Reporting Platform, marking the start of mandatory vulnerability and incident reporting obligations for manufacturers placing products with digital elements on the EU market.

The platform went live on 11 September 2026, the same day the CRA's disclosure requirements became binding. ENISA built the system and now operates it under Article 16(1) of the regulation. Manufacturers must report actively exploited vulnerabilities and severe incidents through the portal as soon as they become aware of them.

The CRA imposes strict timelines. An early warning is due within 24 hours of awareness, followed by a fuller notification with an initial assessment within 72 hours. A final report must be submitted within 14 days of a corrective or mitigating measure becoming available. For severe incidents, the final report is due one month after the 72-hour notification.

Manufacturers submit electronically and select a national CSIRT to act as coordinator. The chosen CSIRT receives the notification first and forwards it to other Member State CSIRTs where the product is available. ENISA receives a copy simultaneously unless the manufacturer invokes one of the exceptional circumstances under Article 16(2), in which case ENISA initially sees only partial information until the coordinator releases the remainder.

Selecting the correct coordinator is critical. In general, it is the Member State where the manufacturer has its main establishment in the EU and where cybersecurity decisions for the product are primarily made. Choosing the wrong coordinator can invalidate the submission and require resubmission to the correct authority.

Registration uses an EU Login account with multi-factor authentication. Each manufacturer receives one Primary Assigned Representative and up to 20 Secondary ARs. The designated CSIRT validates the association. An AR whose association is still pending may file up to 20 notifications before verification becomes mandatory.

"The streamlined reporting and sharing of information on actively exploited vulnerabilities and severe incidents helps to build a more resilient Digital Single Market," said ENISA Executive Director Juhan Lepassaar.

The initial release ships without an API, meaning all notifications must be submitted through the web interface. ENISA says organizations may automate internal workflows and that API functionality may arrive in a future phase. Vendors with multiple affected product lines must still submit one notification per event and coordinate internally to ensure only a single report is filed.

The platform is available in English at launch, with translations of supporting materials to follow. Voluntary reporting under Article 15, covering vulnerabilities, cyber threats, incidents, and near misses, is planned for a later phase. Open-source software stewards will come under the same mandatory reporting obligations beginning 11 December 2027.