What Is the ENISA Single Reporting Platform? A Manufacturer Guide

When EU manufacturers ask what is the ENISA Single Reporting Platform, the practical answer is simple: it is the single, central channel through which CRA incident reporting and vulnerability disclosures under Regulation (EU) 2024/2847 are submitted to the authorities. From 11 September 2026, manufacturers of products with digital elements must file actively exploited vulnerabilities and significant incidents there on tight timelines. This guide explains what the platform is, what it expects from a submission, and how to prepare so the 24-hour clock is something you hit rather than fear.

The platform’s role under the CRA

The Cyber Resilience Act designates the ENISA Single Reporting Platform as the common reporting infrastructure for the obligations in Article 14. Its purpose is consolidation: instead of manufacturers navigating a patchwork of national inboxes, there is one authenticated destination for vulnerability and incident reports that ENISA then routes to the relevant national cybersecurity authorities and CSIRTs.

The same platform increasingly coordinates with NIS2 reporting pathways, so an event that triggers both regimes can be handled through a coordinated submission rather than duplicate, potentially contradictory filings. That makes the platform the operational centre of gravity for an EU manufacturer’s disclosure obligations.

What triggers a submission

Two scenarios send a manufacturer to the platform:

1. Actively exploited vulnerability. When you know or have reason to believe a vulnerability in your product is being exploited in the field, you report it within 24 hours, covering the vulnerability, its impact, and available mitigations.
2. Significant security incident. You file an early warning within 24 hours, a fuller incident notification within 72 hours, and a final report once handling is complete.

The platform is therefore not a passive registry — it is the channel that satisfies a deadline-driven legal duty.

What the portal expects in a submission

Although the platform’s exact form fields evolve, a submission that satisfies Article 14 consistently includes:

• Product identification — name, versions, and components affected.
• Vulnerability or incident description — how it was discovered and what it does.
• Impact assessment — effects on users, dependent products, and the wider ecosystem.
• Mitigations — patches, workarounds, and configuration guidance already available or planned.
• Identifiers — CVE or EUVD references where they exist.
• Reporter and contact — who is accountable for follow-up.

Pre-drafting these fields as templates is the single highest-leverage preparation step. When the 24-hour clock starts, the work is filling content, not inventing structure.

How to prepare before the deadline

Treat platform readiness as a repeatable drill, not a one-off configuration:

• Register early. Establish organisational access and credential management for the ENISA vulnerability portal before you need it under pressure.
• Map detection to reporting. Your PSIRT, threat-intelligence feeds, and incident response process should route an “actively exploited” verdict straight to the person authorised to submit.
• Rehearse the clock. Run a tabletop that ends in a completed platform submission, timed against the 24-hour window.
• Keep evidence auditable. Maintain a defensible record of what you knew and when — the trigger is awareness, and you may need to prove the timeline.

Connect reporting to the risk picture

A report filed to the platform is only as accurate as the risk view behind it. Manufacturers that submit quickly and correctly tie each reported vulnerability or incident back to the products, suppliers, and assets it touches — which is exactly what a maintained risk register provides. Understanding the pricing of the tooling that keeps that register current ensures readiness is funded as a standing capability, not discovered as a gap mid-incident.

The bottom line

The ENISA Single Reporting Platform is where the CRA’s reporting obligations become concrete: a single, authenticated channel for the vulnerability and incident disclosures manufacturers owe the EU from 11 September 2026. The manufacturers who navigate it well are those who register early, pre-draft submissions, and rehearse the 24-hour clock — turning a regulatory threat into a routine operational discipline.

For the wider obligations around Article 14, read our guide to CRA Article 14 reporting requirements.