ENISA Single Reporting Platform
The SRP is the single EU portal manufacturers use to report actively exploited vulnerabilities and severe incidents under Article 14 of the Cyber Resilience Act. Here is what it is, who must register, the mandatory fields, and how to be ready when the 24-hour clock starts.
The SRP is live
ENISA launched the Single Reporting Platform on 11 September 2026, the day the Article 14 reporting obligations started to apply. Sign in with your EU Login account to file. If you do not have an EU Login account yet, create one now: the 24-hour clock runs from the moment you become aware, not from when your account is ready.
The Single Reporting Platform (SRP) is the central platform, operated by ENISA, through which manufacturers of products with digital elements submit the notifications required by Article 14 of the Cyber Resilience Act. Every actively exploited vulnerability and every severe incident is reported once, through the SRP, which routes it to the coordinating CSIRT and ENISA. It replaces separate national channels with one entry point across the EU.
11 Jun 2026
Chapter IV applies
The rules on notification of conformity assessment bodies enter into application.
11 Sep 2026
Article 14 reporting applies
Manufacturers must report actively exploited vulnerabilities and severe incidents through the SRP — including for products already on the market.
11 Dec 2027
Full application of the CRA
All remaining obligations apply: essential requirements, technical documentation, Declaration of Conformity, CE marking and support period.
The reporting duty falls on the manufacturer. Open-source software stewards and authorised representatives can act on a manufacturer's behalf. Registration uses the EU's central login and, for representatives, a CSIRT validation step.
Register an EU Login account in advance
Manufacturers and the representatives of open-source software stewards sign in to the SRP with an EU Login (ECAS) account. You can create it ahead of time so access is not a blocker when the 24-hour clock is running.
Create an EU Login accountAuthorised representatives can report for you
An authorised representative can submit reports on behalf of a specific manufacturer. Their authority to do so is confirmed by the coordinating CSIRT after their first access to the platform.
CSIRT validation is parallel and non-blocking
The coordinating CSIRT validates a representative's authority to report for a given manufacturer after the first platform access. This runs in parallel with the reporting process and does not prevent you from filing. The procedure can vary from one CSIRT to another and is the CSIRT's responsibility.
Register only when you need to
To keep the effort low, ENISA advises starting registration and validation only when they are actually needed for a concrete report, rather than provisioning everything speculatively in advance.
Once an actively exploited vulnerability or a severe incident triggers Article 14, three staged submissions follow. Each stage adds detail; most fields carry over from the previous step.
Early warning
Within 24 hours of becoming aware: name the affected Member States and, for an incident, say whether it is suspected to be malicious.
Art. 14(2)(a) / 14(4)(a)
Notification
Within 72 hours: submit the general nature and severity of the event, and any indicators of compromise available at that point.
Art. 14(2)(b) / 14(4)(b)
Final report
Within 14 days of a fix being available (vulnerability) or one month after the notification (incident): submit the root cause, the mitigations applied, and any cross-border effects.
Art. 14(2)(c) / 14(4)(c)
The ENISA FAQ lists the fields captured across the three stages, separately for vulnerability and incident notifications. Field names below are the ENISA labels; the columns show whether each field is required at 24 hours, 72 hours or in the final report.
Common fields (both notification types)
| Field | 24 h | 72 h | Final |
|---|---|---|---|
| Notification type (Vulnerability / Incident) | X | C | C |
| Notification level (24 h / 72 h / Final) | X | X | X |
| Name of manufacturer or open-source software steward | X | C | C |
| Product | X | C | C |
| Product type (Default / Important / Critical) | O | C | C |
| Product category (CRA Annex III / IV) | O | C | C |
| Member States where the product is available | I | C | C |
| Title | X | C | C |
Vulnerability notification
| Field | 24 h | 72 h | Final |
|---|---|---|---|
| CVE ID | O | C | C |
| EUVD ID | O | C | C |
| General nature of the vulnerability | O | X | C |
| General nature of the exploit | O | X | C |
| Corrective or mitigating measures taken | O | X | C |
| Corrective or mitigating measures users can take | O | X | C |
| Considered sensitivity of information | O | I | C |
| Date a corrective / mitigating measure became available | O | O | X |
| Full description (severity, impact) | O | O | X |
| Malicious actor that has exploited / is exploiting the vulnerability | O | O | I |
| Details about the security update / corrective measures | O | O | X |
Incident notification
| Field | 24 h | 72 h | Final |
|---|---|---|---|
| Incident suspected to be caused by unlawful or malicious acts | X | C | C |
| General information about the nature of the incident | O | X | C |
| Date and time the incident was detected | O | X | C |
| Date and time the incident occurred | O | X | C |
| Initial assessment of the incident | O | X | C |
| Corrective or mitigating measures taken | O | X | C |
| Corrective or mitigating measures users can take | O | X | C |
| Considered sensitivity of information | O | I | C |
| Severity of the incident | O | O | X |
| Impact of the incident | O | O | X |
| Type of threat or root cause | O | O | X |
| Applied and ongoing mitigation measures | O | O | X |
Source: ENISA Single Reporting Platform FAQ (as of 29 July 2026). Fields and obligations may change; always follow the SRP itself as the authoritative source.
Prepare your report content before you sign in to the SRP. These free tools require no sign-up and keep your data in your browser.
SRP reporting playbook
A four-step walkthrough that drafts your 24-hour, 72-hour and final report content, ready to paste into the SRP.
Article 14 readiness check
A self-assessment of whether your organisation can meet the reporting deadlines, with a gap runbook.
Incident response gap analysis
Why incident response is the weakest CRA maturity area for SMEs, and how to close the gap.
CVD policy generator
Generate a publishable Coordinated Vulnerability Disclosure policy — a key source of the awareness that starts the 24-hour clock.
security.txt generator
Publish a machine-readable security contact so vulnerability reports reach you in time to act.
What is the ENISA Single Reporting Platform (SRP)?
The SRP is the single EU portal, operated by ENISA, through which manufacturers submit the vulnerability and incident notifications required by Article 14 of the Cyber Resilience Act. It routes each report to the coordinating CSIRT and ENISA, replacing separate national channels.
Who must report through the SRP?
Manufacturers of products with digital elements are responsible for reporting. Open-source software stewards and authorised representatives can report on a manufacturer's behalf.
Is the SRP online?
Yes. ENISA launched the platform on 11 September 2026, when the Article 14 reporting obligations started to apply. You sign in with an EU Login account via ENISA's SRP page.
When do the CRA reporting obligations start?
Article 14 reporting obligations apply from 11 September 2026. They cover products already on the market, not only new products. The CRA applies in full from 11 December 2027.
Do I need an EU Login account to use the SRP?
Yes. Manufacturers and the representatives of open-source software stewards sign in to the SRP with an EU Login (ECAS) account. You can create it in advance at the EU Login page so access is not a blocker when a report is due.
Can an authorised representative report on behalf of a manufacturer?
Yes. An authorised representative can submit reports for a specific manufacturer. Their authority is validated by the coordinating CSIRT after their first access to the platform.
Does the CSIRT validation block my report?
No. The coordinating CSIRT validates a representative's authority after the first platform access, but this runs in parallel with the reporting process and does not prevent you from filing. The procedure can vary between CSIRTs.
What are the SRP reporting deadlines?
Reporting is staged: an early warning within 24 hours of becoming aware and a notification within 72 hours. The final report is due within 14 days of a corrective measure becoming available for an actively exploited vulnerability, or within one month of the notification for a severe incident.
What information is mandatory in the 24-hour early warning?
The early warning must identify the notification type and level, the manufacturer and product, the title, and — for incidents — whether the cause is suspected to be malicious. The Member States where the product is available are required if that information is available.
Do the reporting duties apply to products already on the market?
Yes. From 11 September 2026 the Article 14 reporting duties apply to products with digital elements already placed on the market, not only to newly released products.