CERT-Bund, BSI, ENISA: who receives CRA notifications
A notification under Article 14 goes to two recipients at once: the coordinating CSIRT of the Member State and ENISA. In Germany, the CSIRT is CERT-Bund, part of the BSI. This page explains who plays which role and whom a manufacturer actually deals with.
CRA notifications are submitted through ENISA's single reporting platform, a web form under Article 16. When registering, the manufacturer selects the coordinating CSIRT of the Member State in which it has its main establishment (Article 14(7)). For Germany, that is CERT-Bund, the computer emergency response team of the German Federal Office for Information Security (BSI); ENISA includes it in its list of coordinators (as of 10 September 2026). The notification goes simultaneously to this CSIRT and to ENISA, and the CSIRT disseminates it to other CSIRTs concerned. Under the German government bill, the BSI as an authority will also become the market surveillance authority, which can later check whether the deadlines were met.
Key points
- ENISA operates the platform (Article 16). It is a recipient, but not the contact for the individual case.
- The coordinating CSIRT is your actual counterpart. It is determined by the main establishment (Article 14(7)); in Germany it is CERT-Bund.
- CERT-Bund is part of the BSI. Under the bill, the BSI will also become the market surveillance authority and the authority that imposes fines.
- The CSIRT disseminates the notification to other CSIRTs; Delegated Regulation (EU) 2026/881 governs when it may delay this.
- Private service providers are not among these bodies. The manufacturer always remains responsible for the notification.
What role does ENISA play?
Under Article 16, the European Union Agency for Cybersecurity (ENISA) operates the central reporting platform, the single reporting platform (SRP). It has been in operation since 11 September 2026, as a web form with no API, with the interface and notifications in English. Access is via EU Login with multi-factor authentication. Each manufacturer has one Primary Assigned Representative, a named person with access, and up to 20 more. ENISA receives every notification in parallel with the CSIRT, maintains an FAQ, a glossary and user manuals (FAQ last updated on 3 October 2026, glossary on 1 October 2026) and runs a helpdesk at cra-srp-helpdesk@enisa.europa.eu. It is the right contact for questions about using the platform, but not for assessing a specific case.
Two things on the platform are not yet finished. Voluntary notifications under Article 15 have not been implemented. And the counter for the 72-hour notification currently calculates 48 hours from submission of the early warning, not from awareness. The field for the time of awareness is only to be used for deadline calculation in a future release. The statutory deadline still runs from awareness. If you submit the early warning early, the portal shows a due date that is too early, so keep your own clock. Registration and notification are explained in ENISA Single Reporting Platform: registration and notification step by step.
What is the coordinating CSIRT, and how is it determined?
A CSIRT is a computer security incident response team, a public-sector team that responds to cybersecurity incidents. Every Member State has designated one as coordinator for CRA notifications, and ENISA keeps the list of all 27 (as of 10 September 2026). Which one is responsible for a manufacturer is governed by Article 14(7): the Member State of the main establishment, meaning where decisions related to the cybersecurity of the product are predominantly taken. That is not necessarily where the holding company has its seat. If that Member State cannot be determined, the establishment with the highest number of employees in the Union counts. A manufacturer of laboratory equipment whose group headquarters are in France, but whose decisions on product cybersecurity are taken in Germany, selects CERT-Bund.
The choice is made by the named person when registering on the platform. The CSIRT verifies the registration; according to ENISA, the time this takes and the procedure differ between CSIRTs. A Belgian company reported three working days with its CSIRT; no figure is available for CERT-Bund. Importantly, accounts that have not yet been verified may submit up to 20 notifications. Verification is therefore no reason to put off a notification.
What does CERT-Bund do, and what does the BSI do?
CERT-Bund is the German federal government's computer emergency response team and is organisationally part of the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik). The distinction is still useful for manufacturers, because the BSI has several roles.
| Body | Role under the CRA | Legal basis | Status |
|---|---|---|---|
| ENISA | Operates the reporting platform, receives every notification in parallel, helpdesk for the platform | Article 16 | in operation since 11 September 2026 |
| CERT-Bund (within the BSI) | Coordinating CSIRT for Germany: receives the notification, verifies accounts, disseminates to other CSIRTs, coordinates on disclosure | Article 14(7), section 5(3), point 6, of the draft BSI Act (BSIG-E) | on the ENISA list since 4 September 2026 |
| BSI as an authority | Future central market surveillance authority, notifying authority, fining authority | Sections 65 to 70 BSIG-E (draft) | Act not promulgated; notification procedure for conformity assessment bodies running since 11 June 2026 |
| BSI at EU level | Chairs the administrative cooperation group of market surveillance authorities | ADCO CRA | since 19 March 2026 |
As the CSIRT, CERT-Bund receives the notification and is your counterpart in an ongoing case. The BSI page on the platform explicitly names CERT-Bund as the "coordinating CSIRT" and points out that registration takes minutes and that no advance registration is needed. CERT-Bund is also the national CSIRT with which, under BSI TR-03183-3, any extension of the 90-day deadline for disclosing a vulnerability must be agreed. As the market surveillance authority, by contrast, the BSI will later be able to request information and evidence on whether the deadlines were met. This role only formally exists once the implementation act is in force, see The German CRA implementation act. What may follow is covered in Fines and market surveillance under the CRA.
What happens to the notification after it is submitted?
- Received by two recipientsThe notification reaches the selected coordinating CSIRT and ENISA at the same time.
- DisseminationThe coordinating CSIRT forwards the notification to the CSIRTs of the other Member States concerned, for example where the product is in use there. That is why the early warning asks in which Member States the product is used.
- Possible delayDelegated Regulation (EU) 2026/881 (adopted on 11 December 2025, published in the Official Journal on 20 April 2026, in force since 10 May 2026) sets out the conditions under which a CSIRT may delay dissemination on cybersecurity grounds.
- Follow-up notificationsThe manufacturer submits the 72-hour notification and the final report through the same platform. Questions from the CSIRT come via the platform or the contacts on record.
If the platform is unavailable, ENISA recommends waiting or contacting the CSIRT directly, and submitting the notification once the platform is available again. Since 12 September 2026, ENISA has had a separate address for reporting vulnerabilities in the platform itself.
Whom does the manufacturer actually deal with?
Normally with exactly one body: the coordinating CSIRT, which in Germany is CERT-Bund. ENISA is a recipient in the background and the contact for the platform's technical side. The BSI as market surveillance authority only steps in when it requests evidence or opens proceedings. The market surveillance provisions only apply from 11 December 2027 (Article 71(2)), and the draft implementation act also has the BSI's responsibility begin only then. There is also a second reporting line that is often overlooked: entities covered by NIS2 report incidents under section 32 of the BSI Act (BSIG) through the BSI's reporting portal. Both notifications end up with the BSI, but one does not satisfy the other. In its questions and answers on the CRA platform, the BSI says that if an incident has to be reported under both sets of rules, it is reported twice, through the BSI portal and through the single reporting platform; each notification can contain a reference to the other. More in CRA and NIS2 compared.
For manufacturers with their main establishment in Austria, the coordinating CSIRT is CERT.at, see The CRA in Austria and Switzerland. Open-source software stewards only report from 11 December 2027.
What this means in practice
- Set up access before it is needed. Registration takes minutes; verification by the CSIRT takes longer. Both should be done before the first report arrives, including a deputy as a second named person.
- Choose the right CSIRT. In groups with several sites, clarify beforehand where cybersecurity decisions for the product are taken. The wrong choice costs time when it matters.
- Keep your own clocks. The platform's counter currently calculates the 72 hours incorrectly. The time of awareness belongs in your own record, including the time of day.
- The decision stays with the manufacturer. CERT-Bund receives, coordinates and disseminates. The available sources do not indicate that it assesses in advance whether an individual case must be reported.
That is what CRA Response Center is for: the tool monitors your security address, recognises important reports, alerts your people by SMS and e-mail and shows the deadlines from confirmed awareness. We are not a public authority and are not affiliated with ENISA, the BSI or the European Commission. We never submit notifications ourselves; your named person does that with their own account.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitFrequently asked questions
Whom do I have to notify under the CRA?
Through ENISA's single reporting platform, the coordinating CSIRT of your Member State and, in parallel, ENISA (Article 14(7), Article 16). In Germany, the CSIRT is CERT-Bund within the BSI.
Is CERT-Bund the same as the BSI?
CERT-Bund is the German federal government's computer emergency response team and part of the BSI. As the CSIRT, it receives notifications. Under the bill, the BSI as an authority will additionally be responsible for market surveillance and fines.
Can I notify CERT-Bund directly, without the platform?
The Regulation provides for the platform as the reporting channel. If it fails, ENISA recommends waiting or contacting the CSIRT directly; for this case, the BSI exceptionally mentions e-mail to CERT-Bund. According to the ENISA FAQ, this does not replace notification through the platform: it must be submitted once the platform is available again.
Does the CSIRT have to complete verification before I can submit a notification?
No. According to the ENISA FAQ, accounts that have not yet been verified may submit up to 20 notifications. The deadline runs from awareness, not from verification.
Does CERT-Bund help with the question of whether I have to report?
According to the available sources, not in individual cases. The CSIRT receives, coordinates and disseminates. The manufacturer decides whether a vulnerability is actively exploited or an incident is severe.
Do other countries receive my notification?
Yes, the coordinating CSIRT forwards it to the CSIRTs of the Member States concerned. Delegated Regulation (EU) 2026/881 governs when it may delay dissemination on cybersecurity grounds.
Is CRA Response Center a public authority or affiliated with one?
No. We are a private service provider, not affiliated with ENISA, the BSI or the European Commission. We receive the reports that third parties send to your security address; we do not submit the notification to the CSIRT, the manufacturer does.
Further reading
- ENISA Single Reporting Platform step by stepRegistration, roles, the fields of the early warning and the notification.
- The German CRA implementation actStatus and content, and which roles the BSI will take on.
- CRA and NIS2 comparedTwo reporting obligations, both to the BSI, neither counting towards the other.
- Glossary: CSIRT designated as coordinatorThe term in two sentences.
- ENISA publishes the list of coordinating CSIRTs: CERT-Bund for Germany, CERT.at for AustriaThe list for all 27 Member States is out. What to select when registering on the reporting portal.
Sources
- The CRA Single Reporting Platform is launched, ENISA, 11 September 2026.
- Single Reporting Platform: Frequently Asked Questions, ENISA, as of 3 October 2026.
- List of CSIRTs Designated as Coordinators, ENISA, as of 10 September 2026.
- Single Reporting Platform (CRA), BSI, 2026.
- Press release on the start of the CRA reporting obligation, BSI, 11 September 2026.
- Cyber Resilience Act implementation, European Commission, 2026.
- Commission Delegated Regulation (EU) 2026/881 enters into force, Digital Policy Alert, May 2026.
- Bill for the German CRA implementation act, Bundestag printed paper 21/6134 (in German), German Bundestag, 26 May 2026.
- BSI TR-03183-3 Vulnerability Reports and Notifications, v1.0.0, BSI, 20 August 2025.
- First account using the ENISA SRP, cyberresilienceact.eu, 28 September 2026.
- Reporting obligations under the Cyber Resilience Act (in German), Deloitte Legal, 10 September 2026.
- BSI takes over the chair of the EU coordination group (in German), Tagesspiegel Background, March 2026.