ENISA

ENISA is the European Union Agency for Cybersecurity. Under the Cyber Resilience Act, it runs the single reporting platform and receives every notification from a manufacturer.

Definition in the Regulation

Regulation (EU) 2024/2847 does not define ENISA but assigns it tasks. Under Article 16(1), ENISA establishes and maintains the single reporting platform. Under Article 14(1) and (3), the manufacturer notifies an actively exploited vulnerability or a severe incident "simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA". So the notification does not go either to the authority in your own country or to ENISA, but to both at once, via the same platform. Under Article 60(3), ENISA can identify product categories from the notifications it receives and propose them to the market surveillance authorities for coordinated control actions (sweeps).

What it means for manufacturers

ENISA's platform has been in operation since 11 September 2026. It is a web form in English without a programming interface; ENISA does not mention a practice environment. Anyone who has to report needs an EU Login account with multi-factor authentication and, when registering, selects the competent CSIRT of their country, which for Germany is CERT-Bund within the BSI. ENISA's helpdesk (cra-srp-helpdesk@enisa.europa.eu) answers questions about the platform. The status of a notification (valid, invalid, closed) is set not by ENISA but by the coordinating CSIRT.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Related terms

• Single reporting platform (SRP)
• CSIRT designated as coordinator
• CERT-Bund
• Early warning notification

Learn more

• CERT-Bund, BSI, ENISA: who receives CRA notificationsThe three bodies, their roles and how a notification passes between them.