You've finished this phase Next phase: How do I write the technical file?
A four-step walkthrough that prepares the three staged submissions the CRA requires — the 24-hour early warning, the 72-hour notification and the final report (14 days after a fix for a vulnerability, one month after the notification for a severe incident). Copy the generated blocks straight into the ENISA Single Reporting Platform. Free, no sign-up, aligned with Commission guidance C(2026) 5252.
This is a preparation tool, not a filing channel. The authoritative submission is on the SRP itself, which went live on 11 September 2026 — the day the reporting duties started to apply. They cover legacy products already on the market too, and the 24-hour clock runs from the moment you become aware.
Before you can file, you sign in to the SRP with an EU Login (ECAS) account — create it in advance so access is not a blocker. An authorised representative can report on a manufacturer's behalf; the coordinating CSIRT validates that authority after first access, in parallel and without blocking your report. How SRP registration works
Article 14 only triggers when a vulnerability is actively exploited or an incident is severe. Regular vulnerabilities you've found and are patching quietly stay on the CVD side of the fence.