ENISA launches Single Reporting Platform as EU Cyber Resilience Act reporting obligations take effect

The EU Agency for Cybersecurity (ENISA) has deployed the initial operating capability of the Single Reporting Platform (SRP), the online tool that manufacturers and open-source software stewards will use to meet their Cyber Resilience Act (CRA) reporting obligations for actively exploited vulnerabilities and severe incidents.

The platform lets users report once, with the notification then shared with the relevant national CSIRTs and made available to ENISA. The CSIRT designated as coordinator receives the initial submission and disseminates it to counterparts in Member States where the affected product is available, which ENISA said supports faster mitigation of risks.

The CRA’s reporting obligations apply to manufacturers from 11 September 2026, while its main cybersecurity requirements apply from 11 December 2027. Under Article 24(3), the reporting duties also extend to open-source software stewards involved in developing products with digital elements.

ENISA has published supporting material including an FAQ, user manuals, tutorial videos, a glossary and a factsheet in several EU languages, and has set up a dedicated help desk for reporting questions.