CSIRT designated as coordinator
Every manufacturer reports to exactly one CSIRT: that of the Member State of its main establishment. Article 14(7) calls it the CSIRT designated as coordinator. ENISA keeps the list; for Germany, it names CERT-Bund.
The CSIRT designated as coordinator (CDaC) is the CSIRT of the Member State in which the manufacturer has its main establishment. It receives the notification under Article 14 and passes it on to the other CSIRTs concerned.
Definition in the Regulation
For the CSIRT designated as coordinator, Article 3, point (51), of Regulation (EU) 2024/2847 refers to Article 12(1) of Directive (EU) 2022/2555. Article 14(7) determines the competent CSIRT: it is the CSIRT of the Member State in which the manufacturer has its main establishment. That is the Member State "where the decisions related to the cybersecurity of its products with digital elements are predominantly taken", or failing that, the Member State with the highest number of employees in the Union. If the manufacturer has no main establishment in the EU, the order is authorised representative, importer, distributor, users. Under Article 16(2), the coordinator forwards the notification to the CSIRTs of the Member States in which the product has been made available. It may delay dissemination on cybersecurity grounds; the conditions are laid down in Delegated Regulation (EU) 2026/881.
What it means for manufacturers
ENISA keeps the list of coordinators for all 27 Member States (as of 10 September 2026): CERT-Bund within the BSI for Germany, CERT.at for Austria. When registering on the reporting platform, the manufacturer selects its coordinator from a list; the platform does not check the choice. If the wrong CSIRT is chosen, the notification can be declared invalid and has to be submitted again. For groups with several sites, it is worth recording in advance where the cybersecurity decisions for the product are taken. Swiss manufacturers without an EU establishment report to the CSIRT of the Member State in which their authorised representative is established; without an authorised representative, the remaining order in Article 14(7) applies.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit