Cyber Resilience Act Response Center Request a demoDemo

News Updated

ENISA publishes the list of coordinating CSIRTs: CERT-Bund for Germany, CERT.at for Austria

In early September 2026, ENISA published the list of "CSIRTs Designated as Coordinators" for all 27 Member States (on 4 September according to an industry news service; the page itself is dated 10 September 2026). It is now clear which body to select when registering on the reporting platform: CERT-Bund for Germany, CERT.at for Austria.

On 4 September 2026, ENISA published a list of the coordinating CSIRTs for all 27 Member States (the date comes from the industry news service cyberresilienceact.eu; the ENISA page itself only gives a "last updated" date), most recently updated on 10 September 2026. A CSIRT is a public computer security incident response team; the coordinating CSIRT (in the Regulation, the CSIRT designated as coordinator) is the body that receives manufacturers' notifications under Article 14 of Regulation (EU) 2024/2847 and passes them on to other CSIRTs concerned. For Germany, the list names CERT-Bund, which is part of the German Federal Office for Information Security (BSI). For Austria, it names CERT.at. Until then, formal designation had been an open question: as late as the end of August 2026, a German law firm wrote that designation by the Member States was still pending. The BSI had already treated CERT-Bund as the competent CSIRT when the reporting obligation started on 11 September 2026. The ENISA list confirms this.

What it means for manufacturers

The list answers a question that comes up in practice when registering on ENISA's single reporting platform (SRP). During registration, the person who reports on behalf of the manufacturer (the "Assigned Representative" in the platform) selects the competent coordinating CSIRT. Under Article 14(7), what counts is the Member State of the main establishment, meaning the place where decisions related to the cybersecurity of the product are predominantly taken. In practice, this means:

  • Manufacturers headquartered in Germany select Germany and therefore CERT-Bund. The BSI says so explicitly on its page about the platform.
  • Manufacturers headquartered in Austria select Austria and therefore CERT.at. The Austrian Economic Chambers (Wirtschaftskammer Österreich, WKO) confirm, as of 28 September 2026, that notifications are automatically forwarded to CERT.at and to ENISA. Some articles named the Austrian Federal Chancellery as the recipient for Austria; that contradicts the ENISA list.
  • Manufacturers without an establishment in the EU, for example from Switzerland, do not appear on the list. They report to the CSIRT of the Member State determined under Article 14(7). Where there is no main establishment in the EU, that paragraph points, in this order, to the Member State of the authorised representative, the importer, the distributor or the users.

Once submitted, a notification goes simultaneously to the selected CSIRT and to ENISA. After registration, the CSIRT checks whether the reporting person actually belongs to the manufacturer stated; according to the ENISA FAQ, how long this check takes is up to the individual CSIRT. No figure has been published for CERT-Bund; the only public account from practice comes from Belgium and mentions three working days. According to that account, up to 20 notifications can be submitted before the check is complete. Anyone who only starts registering when an incident occurs will therefore not lose the ability to report, but will lose time and peace of mind. The registration steps are described in the guide ENISA Single Reporting Platform: registration and notification step by step; how CERT-Bund, the BSI and ENISA work together is explained in the guide CERT-Bund, BSI, ENISA: who receives CRA notifications.

For your readiness, this means: access to the platform should be registered, verified and backed by a deputy before the first notification is due. The free CRA Reporting Kit contains a template for the designated persons and the deputy arrangements; the accounts remain personal, and the notification itself is submitted by the manufacturer.

What remains open

The list settles who is responsible, not the legal basis in Germany: CERT-Bund's role as CSIRT under the Regulation is to be set out in the German CRA implementation act (CRA-Durchführungsgesetz, Bundestag printed paper 21/6134), which has not yet been promulgated. In Austria, the market surveillance authority has not yet been designated; the notifying authority sits within the Austrian Federal Chancellery. For manufacturers from third countries, Article 14(7) does set out the order of authorised representative, importer, distributor and users; we have not found anything in ENISA's documentation on how the platform handles this case during registration. How long CERT-Bund takes to check a registration has not been published anywhere. More on the neighbouring countries in the guide The CRA in Austria and Switzerland.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days