Report a vulnerability
Everything for a notification under Article 14 on one page: the way to the ENISA single reporting platform, the CSIRT for your country, the required information for each stage and your details ready to copy.
Notifications go exclusively through the ENISA platform, submitted by a person from your company. This page submits nothing. Based on Regulation (EU) 2024/2847, Articles 14 and 16, and the ENISA list of coordinating CSIRTs of 10 September 2026. Not legal advice.
Found a vulnerability in a product you do not make? Report it to the manufacturer, for example via its security.txt, or to the CSIRT of your country from the list below. To report a vulnerability in our own service, use our security contact.
Report now
- Record the moment of awarenessFrom then on you have 24 hours for the early warning and 72 hours for the notification. The platform does not currently ask for it, so you have to document it yourself.
- Sign in with your personal EU LoginOnly a registered assigned representative of your company can report, with multi-factor authentication.
- Submit the early warningYou chose the CSIRT when registering. The notification goes to that CSIRT and to ENISA at the same time.
Platform unavailable? According to ENISA (FAQ question 25), wait until it is available again and then submit. If you consider immediate communication necessary, you may contact your CSIRT directly in the meantime. This does not replace the notification through the platform. Record the outage with the time and a screenshot.
Your coordinating CSIRT
A CSIRT is a country's computer security incident response team. The responsible one is the CSIRT of the Member State where you have your main establishment: where decisions on the cybersecurity of your products are predominantly taken, otherwise the Member State with the most employees in the EU (Article 14(7)). You choose this CSIRT when registering on the platform; choosing the wrong one can make the notification invalid.
| Member State | Coordinating CSIRT, contact page according to ENISA |
|---|---|
| Belgium | ccb.belgium.be |
| Bulgaria | govcert.bg |
| Denmark | fe-ddis.dk |
| Germany | CERT-Bund at the BSI: bsi.bund.de/CERT-Bund |
| Estonia | ria.ee |
| Finland | kyberturvallisuuskeskus.fi |
| France | cert.ssi.gouv.fr |
| Greece | cyber.gov.gr |
| Ireland | ncsc.gov.ie |
| Italy | acn.gov.it |
| Croatia | ncsc.hr |
| Latvia | cert.lv |
| Lithuania | nksc.lt |
| Luxembourg | circl.lu |
| Malta | mita.gov.mt |
| Netherlands | ncsc.nl |
| Austria | CERT.at: cert.at |
| Poland | cert.pl |
| Portugal | cncs.gov.pt |
| Romania | dnsc.ro |
| Sweden | cert.se |
| Slovakia | sk-cert.sk |
| Slovenia | cert.si |
| Spain | incibe.es |
| Czechia | nukib.gov.cz |
| Hungary | ncsc.gov.hu |
| Cyprus | csirt.cy |
No establishment in the EU, for example a manufacturer from Switzerland: the relevant Member State is then that of your authorised representative, otherwise of the importer, otherwise of the distributor, otherwise the Member State with the most users of your products, in that order (Article 14(7)). The contact pages of the CSIRTs come from the ENISA list; they are for questions, not a reporting channel. More in the guide CERT-Bund, BSI, ENISA.
What goes into which stage
Each stage has its minimum content under Article 14. What you have already submitted need not be repeated. The individual platform fields are listed in the field table of the guide to the reporting platform.
Actively exploited vulnerability (paragraph 2)
- Early warning, 24 hours after awarenessThat an actively exploited vulnerability exists and in which Member States the product has, to your knowledge, been made available.
- Vulnerability notification, 72 hours after awarenessWhere available: general information about the product, the general nature of the exploit and of the vulnerability, corrective or mitigating measures taken, measures users can take and, where applicable, how sensitive you consider the information.
- Final report, 14 days after a fix is availableA description of the vulnerability including its severity and impact, where available information about any malicious actor, and details of the security update or other corrective measures.
Severe incident (paragraph 4)
- Early warning, 24 hours after awarenessAt least whether the incident is suspected of being caused by unlawful or malicious acts and, where applicable, the Member States in which the product has been made available.
- Incident notification, 72 hours after awarenessWhere available: the nature of the incident, an initial assessment, corrective or mitigating measures taken, measures users can take and, where applicable, how sensitive you consider the information.
- Final report, one month after the notificationA detailed description including severity and impact, the type of threat or root cause that likely triggered the incident, and applied and ongoing mitigation measures.
The deadlines for your case are calculated by the deadline calculator. When awareness begins is explained in the guide When does the 24-hour deadline start?, the content of the three stages in detail in Early warning, notification, final report. You also inform affected users yourself (Article 14(8)).
Early warning details ready to copy
Enter what you know. The page puts together the required content of the early warning, each field with its own copy button. Everything stays in your browser; nothing is sent or stored.
Early warning
Field names are approximate; the platform may label them differently. Read every text before submitting; the suggestions are not binding and do not replace your own review.
So the 24 hours do not start on Monday morning.
CRA Response Center reads along in your security mailbox, classifies reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. It records the moment of awareness, the deadlines and the early warning in the log. You do the reporting. EUR 190 per month per domain including VAT. Try it free for 30 days.