Cyber Resilience Act Response Center Request a demoDemo

News Updated

ENISA FAQ of 3 October 2026: the 72-hour counter on the platform shows 48 hours

ENISA updated its questions and answers on the single reporting platform on 3 October 2026. They state that the platform's counter shows the vulnerability notification as due 48 hours after the early warning. The Regulation counts differently. Manufacturers therefore have to record the time of awareness themselves.

On 3 October 2026, ENISA updated its questions and answers on the single reporting platform (SRP), the reporting portal through which manufacturers have been reporting actively exploited vulnerabilities and severe incidents since 11 September 2026. In question 26, ENISA confirms that the counter for the vulnerability notification shows a due time 48 hours after the early warning is submitted. The field "Date/Time when you became aware", in other words the time at which the manufacturer became aware, will only be used to calculate the deadline in a future version of the platform. ENISA gives no date for this.

Regulation (EU) 2024/2847 counts differently from the platform. Under Article 14(2), the deadline for the early warning is 24 hours from awareness and the deadline for the vulnerability notification is 72 hours from awareness. Both clocks therefore start at the same moment. The platform, by contrast, only starts the second clock once the first notification has been submitted. If you submit the early warning early, say after six hours, the platform shows the notification as due after 54 hours, although the Regulation allows 72 hours. If you submit the early warning just before the 24 hours run out, the platform shows a due time that almost matches the legal one. In no case is the platform display the benchmark.

What it means for manufacturers

The time of awareness is the anchor for all deadlines. According to a summary of the ENISA documentation of 12 September 2026, the platform does not currently ask for it for actively exploited vulnerabilities; the field is planned for the next version. Until then, responsibility for calculating the deadlines lies entirely with the manufacturer. Three things follow from this:

  • Record the time of awareness yourself. The Commission guidance C(2026) 5252 of 27 July 2026 ties "awareness" to the completion of an initial assessment that gives a reasonable degree of certainty, not to the arrival of an e-mail. When that assessment was completed belongs in your own record, with date, time and name. More on this in the guide When does the 24-hour deadline start?.
  • Track deadlines outside the platform. For now, the platform's counter is an indication, not a deadline tracker. The manufacturer calculates the 72 hours from awareness itself, for example with the deadline calculator on our reporting obligation page.
  • Do not delay the early warning. It would be a mistake to submit the early warning late just to make the platform counter look more generous. Article 14(2) requires the early warning "without undue delay and in any event within 24 hours". The platform display does not change that.

The three reporting stages, their content and their deadlines are described in the guide Early warning, notification, final report. The FAQ also confirms three further points that have applied since launch. There is no programming interface (API). The interface and the notifications are in English. And voluntary reporting under Article 15 has not yet been implemented on the platform.

For your readiness, this means: the record of the time of awareness is currently the only reliable evidence for the deadlines. CRA Response Center keeps this history from the moment a report arrives and calculates the deadlines from confirmed awareness, regardless of what the platform displays.

What remains open

ENISA has not given a date for the new version of the platform. We were unable to verify whether the awareness field already exists for incident notifications. It is also unclear how coordinating CSIRTs, and later market surveillance, will deal with cases in which the platform display and the legal deadline differ. There is no statement from any authority on this. If you can document your own time of awareness properly, you are prepared for either reading.

Update 8 October 2026: ENISA's SRP glossary (version 1.4, as of 1 October 2026) answers the open question. For incidents, the field already exists: the glossary calls it "Date and time when you become aware of the incident", while the current release still labels it "Date and time when the incident was detected". For actively exploited vulnerabilities, the corresponding field has been announced for the next release. According to question 26 of the questions and answers, the deadline counter does not yet use the time of awareness for either type of notification.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days