Single reporting platform (SRP)
Every notification under Article 14 goes through a single platform run by ENISA. It forwards the notification to the competent CSIRT and to ENISA itself. Whoever has to use it in an emergency should know it beforehand.
The single reporting platform (SRP) is ENISA's central platform through which manufacturers report actively exploited vulnerabilities and severe incidents. It has been in operation since 11 September 2026.
Definition in the Regulation
Under Article 16(1) of Regulation (EU) 2024/2847, ENISA establishes and runs the single reporting platform; the Member States and ENISA have their own electronic notification end-points on it. Article 14(1) and (3) require the manufacturer to notify "via the single reporting platform established pursuant to Article 16", simultaneously to the CSIRT designated as coordinator and to ENISA. Under Article 16(2), the CSIRT disseminates the notification to the CSIRTs of the Member States in which the product has been made available. Dissemination may be delayed on cybersecurity grounds, which Delegated Regulation (EU) 2026/881 sets out in more detail. Voluntary notifications under Article 15 are also meant to go through the platform, but this has not yet been implemented there.
What it means for manufacturers
The platform at portal.cra-srp.enisa.europa.eu is a web form in English, with no application programming interface and no test environment; only drafts can be created without submitting. Access requires a personal EU Login account with multi-factor authentication and the Assigned Representative role. Early warning, 72-hour notification and final report are tabs within the same report; each submission is confirmed by e-mail. A field for the time of awareness is still missing, and the 72-hour counter runs from the early warning rather than from awareness, so manufacturers have to document the moment themselves. According to the BSI, if the platform is down, CERT-Bund will accept the notification by e-mail as an exception. Registering in advance is not mandatory, but it saves time when it matters.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit