ENISA Single Reporting Platform: How to Register and File a CRA Notification — and Why Your Deputy Can’t Join Until the CSIRT Verifies You

ENISA’s Single Reporting Platform (SRP) has been live at portal.cra-srp.enisa.europa.eu since 11 September 2026, and it is the channel the Cyber Resilience Act requires for Article 14 notifications. ENISA says registering takes “just a few minutes” once you have an EU Login account. The hard part is in the fine print of the official documents: a deputy can’t be added until a national CSIRT has verified the first person, drafts are invisible to the other representatives, and ENISA advises registering only when you need to file, while at least one national CSIRT’s preparation guidance lists registration of both representatives without saying when.

This walkthrough follows the platform screen by screen from ENISA’s AR User Manual (version 1.1), three of its guidance pages, the platform’s terms and conditions, and the SRP FAQ as updated on 15 October 2026. When we lined these documents up against each other, one guidance page contradicted the FAQ and the manual on what a deputy can see. That conflict is flagged below where it matters.

Who files on the platform, and who doesn’t

In plain terms: if you are the manufacturer of a product with digital elements sold in the EU, your people file here. Almost nobody else can yet.

Articles 14(1) and 14(3) of the Cyber Resilience Act (Regulation (EU) 2024/2847) require the manufacturer to notify actively exploited vulnerabilities and severe incidents “simultaneously to the CSIRT designated as coordinator … and to ENISA”, and to do it “via the single reporting platform established pursuant to Article 16”. Article 16(1) makes ENISA responsible for building and running that platform.

Who you are	Do you file on the SRP?	Source
Manufacturer of an in-scope product (including products placed on the market before 11 December 2027)	Yes, mandatory since 11 September 2026	CRA Art. 14; Art. 71(2) brings Art. 14 forward; ENISA FAQ 12
Open-source software steward	Yes, from 11 December 2027: Art. 71(2) brings forward Art. 14 (and the notified-body rules in Chapter IV), but not Art. 24(3), so steward duties wait for the general date (FAQ 4). They cover exploited vulnerabilities in products it helps develop, and for severe incidents affecting the systems it provides for their development	ENISA FAQ 4; CRA Art. 24(3)
Importer, distributor, security researcher or user who spots a problem	No. Contact the national CSIRT directly; an SRP submission “might be marked as ‘invalid'”	ENISA FAQ 30
Anyone wanting to report voluntarily (near misses, non-exploited vulnerabilities)	Not yet; voluntary reporting comes “in a future phase”	ENISA FAQ 6 and 27
NIS2 entity reporting its own significant incident	No. NIS2 reports go to the national CSIRT or competent authority	NIS2 Art. 23

The table’s main point: the SRP is a manufacturer’s tool. If you are an NIS2 entity, your incident reports still go to the national front doors in our map of CSIRT reporting portals, even if you also make products.

One naming trap. ENISA calls the people who log in “Assigned Representatives” (ARs). That is a platform account role. It is not the authorised representative under Article 18 of the CRA, which is a legal mandate. Keep the two terms apart in your procedures: an Article 18 mandate doesn’t give anyone a platform seat, and a platform seat doesn’t make anyone your authorised representative.

Before you open the portal: pick the right coordinator CSIRT

In plain terms: you select your CSIRT from a drop-down at the start of registration, right after choosing your role, and if you select the wrong one, your notification may be invalidated and have to be resubmitted.

Article 14(7) sends every notification to “the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union”. It defines the main establishment as the Member State “where the decisions related to the cybersecurity of its products with digital elements are predominantly taken”. Where that can’t be determined, it’s the Member State of your establishment with the highest number of EU employees. ENISA’s SRP FAQ (question 18) warns that “if the wrong CDaC is selected, the notification may be invalidated and will need to be resubmitted to the correct CDaC”.

Your situation	Coordinator CSIRT you select
Product-security decisions are taken mainly in one EU country	That country’s CSIRT
Several EU sites, no clear decision centre	The country of your EU establishment with the most employees
No EU establishment, but an authorised representative	Country where the authorised representative acting for the most of your products is established
No EU establishment, no authorised representative	Importer’s country, then distributor’s country (each by the most products), then the country with the most users

The order in that table is binding and runs top to bottom. Two details competitors skip. First, the last fallback is “sticky”: under the fourth subparagraph of Article 14(7), a non-EU manufacturer that used the most-users rule may send later notifications to the same CSIRT it first reported to. Second, the CSIRT drop-down isn’t only a registration screen. Section 3.1 of ENISA’s manual shows it again at every login, before EU Login authentication, so the person filing at 02:00 has to know the answer too.

Don’t assume your NIS2 jurisdiction answers the question. NIS2 Article 26 places most entities under the Member State where they are established, and uses a main-establishment test only for certain digital providers, as our guide to Article 26 jurisdiction explains. A group can land in one country for NIS2 and another for the CRA. ENISA publishes the list of CSIRTs designated as coordinators for all 27 Member States. Write down which rule applies to you and why, before an incident forces the question.

Step 1: an EU Login account with MFA, one per person

In plain terms: every filer needs their own EU Login account with a second factor. Shared accounts break, and they can break mid-incident.

FAQ 9 is explicit: EU Login accounts “are personal”, MFA is required, and “no additional corporate entity authentication mechanism is currently used by the SRP”. You can create the account in advance at ecas.ec.europa.eu. If someone already has an EU Login account without MFA, ENISA’s registration guidance says they should enable it before their first access.

Three account details decide whether filing works under pressure:

• Name and email come from EU Login and can’t be changed in the SRP. ENISA’s AR user registration guidance says the pre-filled first name, last name and email “cannot be edited in the SRP”. Create the account with a work email and the person’s real name, not a private address.
• A shared “psirt@” login is a liability. The SRP terms and conditions make access “strictly personal” (clause 3.1.8) and let ENISA “refuse access to a user logging in, if a session is already open on another computer” with the same EU Login account (clause 4.6.1). Two responders sharing one login can lock each other out.
• Losing the phone is a recovery project. The EU Login FAQ says that if you no longer have access to your second factors, “you will have to erase all registered phone numbers and devices”. EU Login’s own FAQ covers the mobile app, security keys, passkeys and eID. Our recommendation, not an ENISA rule: register a backup second factor for each person (for example the app and a hardware key). It’s cheap insurance.

The CSIRT will later verify the Primary AR’s link to your company, and deputies can only be invited after that, so pick both people deliberately: someone who can be reached out of hours, and who is authorised to speak for the company.

Step 2: register as Primary Assigned Representative

In plain terms: the first person to register becomes the Primary AR and creates your company’s record on the platform. Registration itself takes six actions in the portal.

1. Open the portal, select the Assigned Representative role and click Continue.
2. Select your coordinator CSIRT from the drop-down. ENISA’s note on this screen: “the manufacturer is responsible for identifying the correct CDaC in accordance with Article 14(7)”.
3. Authenticate through EU Login. A failed login lands on a “Not Authorised” page.
4. Read and accept the legal agreement.
5. Confirm the personal details pulled from EU Login.
6. Enter the manufacturer details: the manufacturer name (required) and optional additional information. Without a name, Continue stays disabled.

The result, per ENISA’s guidance: your account becomes “Active” with the role “AR Primary User”, the manufacturer record is created, the link between you and the manufacturer goes to the CSIRT for validation, and you get a confirmation email. By registering, you also “represent and guarantee” that you are an Assigned Representative “authorized to act on [your organisation’s] behalf” (terms, clause 3.1.4).

Two practical points. Type the legal entity name exactly as it appears on the product’s documentation. If you misspell it, FAQ 32 says you can simply register the manufacturer again with the correct name, and ask the CSIRT to reject the wrong one if it gets verified by mistake. Groups with several legal manufacturers can attach more manufacturer records to the same account under Settings > Association Management > Add Manufacturer. FAQ 8 adds that only one notification is needed per event, even if the manufacturer has several EU branches or a non-EU parent.

The verification gate: 20 notifications, and no deputy until “Verified”

In plain terms: you can file before the CSIRT has checked you, but you can’t add a backup person until it has.

Verification is the coordinator CSIRT confirming that you really act for the manufacturer. ENISA is clear that it is “not a prerequisite for submitting a notification”, at least for your first notifications. It runs in parallel, and an unverified AR may submit up to 20 notifications for that manufacturer before verification becomes mandatory (FAQ 9). ENISA doesn’t run this step: “The CSIRTs designated as coordinators verify the ARs, ENISA is not intervening in this process” (FAQ 33). Procedures and processing times “may vary between CSIRTs”.

The catch sits one line further down in the same guidance. Each manufacturer can have one Primary AR and up to 20 Secondary ARs (FAQ 9), but only a Primary AR whose association shows “Verified” can use “Invite Backup”. Until then, your company has exactly one person who can file.

What the person can do	Primary AR (“AR Primary User”)	Secondary AR (“AR Backup User”)
How many per manufacturer	One	Up to 20 (FAQ 9; a separate limit from the 20 unverified notifications)
How they join	Registers directly and creates the manufacturer record	Only by email invitation from a Verified Primary AR, valid 7 days
Submit and update notifications	Yes	Yes (which cases they can see is disputed; see below)
Invite or remove Secondary ARs	Yes, once Verified	No (can remove only their own association)
Become Primary	Already is	Can claim the role; the CSIRT must approve

The single-person window is the takeaway from that table. Two more rules from ENISA’s interface guidance and the manual bite here. The invitation must go to the email the deputy used for EU Login; if they accept with a different EU Login account, they won’t be linked. And if nobody accepts within 7 days, the invite shows “Invitation Expired”, so chase acceptance within the week.

If your Primary AR leaves, a Secondary AR can claim the role, but the CSIRT has to approve it. The terms also oblige your organisation to “promptly revoke or update user access where authorisation ceases” (clause 4.1.5). Put AR changes into your leaver checklist.

Register now or wait? ENISA’s advice and a national CSIRT’s checklist

In plain terms: ENISA advises registering only when you need to file; Finland’s national CSIRT, in guidance on preparing in advance, says both representatives must register, without saying when. Both are official sources, and you should know what your own CSIRT expects.

ENISA’s position, repeated in its FAQ, registration guidance and manual: “To limit the validation workload for designated CSIRTs, manufacturers … are advised to register and initiate the validation process only when they need to submit a notification.” It adds that registration takes “just a few minutes” once EU Login exists.

The National Cyber Security Centre Finland, itself a coordinator CSIRT, published a checklist on 28 August 2026, two weeks before the platform opened, that reads differently: “Appoint primary and secondary Assigned Representatives (ARs) … Both representatives must register on the SRP.” It doesn’t say when registration should happen, but it sits in a list of things to have ready before the first case, which also expects the procedure to have been practised at least once. Given the platform describes no test mode, that practice means a paper exercise.

The two positions trade different risks. Waiting spares the CSIRT the verification work, but it means your first 24-hour early warning rests on one person while verification is pending, with no published timeline. Registering early lets the CSIRT verify you in calm conditions and lets you add the deputy before you need one, at the cost of work ENISA has asked manufacturers not to create. Neither text is binding law; Article 14 doesn’t mention registration at all.

Step	Do it now?	Effort
Decide and document your coordinator CSIRT under Art. 14(7)	Yes; Article 14(7) sets the test, and ENISA’s registration screen and FAQ 18 put it on you	Low
EU Login with MFA for at least two named people (our advice: plus a backup factor each)	Yes, ENISA says it can be done in advance	Low
Ask your coordinator CSIRT whether it wants early registration	Yes; it is the body that verifies you	Low
Register the Primary AR on the SRP	Follow your CSIRT’s answer; ENISA’s default is “only when needed”	Low
Invite and register the Secondary AR	Only possible after verification	Low, but depends on the CSIRT

Our read: the first three rows cost almost nothing and remove the delays you control. If you follow ENISA and wait, write the single-person window into your plan. The Primary-designate needs a named stand-in in your own escalation chain, even though that stand-in can’t touch the platform until verification lands.

Filing the first notification: what the platform does with it

In plain terms: you click “Submit new notification”, fill in the early-warning tab and submit. The CSIRT, ENISA and every other AR of the selected manufacturer get an email at once. Other countries only see it when your CSIRT forwards it.

ENISA’s submission guidance describes the sequence; FAQ 11 and the manual add that you choose actively exploited vulnerability or severe incident, and the fields adapt to that choice. You pick the manufacturer (“approved or pending validation”), and either submit or save a draft. On submission, an email and alert go to the coordinator CSIRT, to ENISA, and “to you and all other ARs of the selected manufacturer”. Concerned CSIRTs in other countries receive it “only after manual dissemination” by your coordinator. Article 16(2) requires that forwarding “without delay” to the CSIRTs of the countries where you said the product is available, unless the CSIRT delays it on the justified cybersecurity grounds the same article allows.

These platform behaviours belong in your procedure:

• Drafts are private. FAQ 9 says drafts “are stored locally in the individual AR’s account and are therefore not visible to other ARs”. If the person who started the early warning goes off shift, nobody else can open it. Draft in a shared document outside the platform, and paste in when ready.
• You can’t skip a stage, and the final report locks the case. The 72-hour tab opens only after an early warning is submitted, the final report only after both. According to the AR User Manual, after the final report the notification “is no longer editable by the AR”. Each update in between alerts the CSIRT again.
• Mistakes go through the CSIRT. Only the coordinator CSIRT can close a notification filed in error (FAQ 34); you ask through its contact details or the “additional note” field. Red alerts flag critical actions, such as a CSIRT invalidating a submission.
• No API, and no test mode described. There’s no API at launch (FAQ 15); Finland’s CSIRT expects one “from spring 2027”. ENISA’s documentation describes no test or sandbox environment. Separately, FAQ 34 stresses that “reporting is a legal obligation”, and ENISA may block accounts that breach the terms. Rehearse on paper, not on the live platform. The interface is also English-only (FAQ 24), so draft in English.

Then there’s the contradiction. ENISA’s interface guidance (last updated 12 September) says a Secondary AR “can only access notifications they submitted and drafts they created”. The FAQ, updated on 15 October, says Primary and Secondary ARs can access, view and update the manufacturer’s notifications, and the manual adds “regardless of which AR originally submitted them”. The newer FAQ favours full access. The dispute concerns submitted notifications; drafts are private either way. Until ENISA aligns its pages, record the platform reference number for every case in your own log, so a deputy can ask the CSIRT for help if their dashboard comes up empty.

The fields themselves, and where the platform demands more than Article 14 does, are mapped in our CRA vulnerability reporting template guide. How the portal’s countdowns differ from the legal deadlines is covered in CRA reporting requirements.

When the portal is down

In plain terms: wait and file on the SRP when it’s back; call your CSIRT in the meantime only if the situation can’t wait.

FAQ 25 says manufacturers “should wait until it becomes available again and then submit the required notification”. If immediate communication is necessary, they “may contact their designated CSIRT directly”, but the notification “must still be submitted through the SRP once it is available again”. ENISA posts the platform state on its CRA SRP status page, and its terms state that it doesn’t guarantee uninterrupted availability (clause 4.4.1). Screenshot the error, timestamp it in your log and keep retrying. Platform questions go to cra-srp-helpdesk@enisa.europa.eu; lost or stolen EU Login credentials must be reported to cra-srp-security@enisa.europa.eu (terms, clause 3.1.9).

Who owns what

In plain terms: plan for two people on the platform, even though the second can only join after verification, and for four owners of the surrounding decisions and evidence.

Role	Owns	Evidence to keep
PSIRT lead / CISO	Primary AR seat, EU Login factors, drafting outside the platform, filing	Platform reference, submission timestamps, screenshots
Deputy (Secondary AR)	Accepting the invite within 7 days; filing new notifications when the Primary is unavailable (access to notifications the Primary submitted is disputed, see above)	Invitation and acceptance dates
Compliance officer / legal	Art. 14(7) CSIRT decision, the CSIRT’s answer on early registration, AR changes at leavers	Written CSIRT determination with reasons
Board / SME owner	Authorising named people to act for the company	Written appointment of the ARs

For an SME owner, the shortest version is: two named people, two EU Login accounts with MFA and a backup factor each, one documented CSIRT choice, and a phone number for that CSIRT. For a CISO in a group, the work is mapping which legal entity is the manufacturer of which product, because the coordinator CSIRT follows each manufacturer’s main establishment under Article 14(7), and one account can hold several manufacturer records. ENISA’s materials don’t explain how one login handles manufacturers with different coordinator CSIRTs, so put that question to the ENISA helpdesk before the first case.

The money at stake is set by Article 64(2): breaching Article 14 can cost up to €15,000,000 or 2.5% of worldwide annual turnover, whichever is higher. Article 64 itself applies only from 11 December 2027 under Article 71(2), although the reporting duty has applied since 11 September 2026. A 2025 corrigendum changed Article 64(10) to derogate from “paragraphs 2 to 9”, so under point (a) micro and small manufacturers are not fined for “any failure to meet the deadline referred to in Article 14(2), point (a), or Article 14(4), point (a)”, which is the 24-hour early warning. The duty to report still applies to them.

Frequently asked questions

Can our company use one shared account for the SRP?

No. ENISA’s FAQ says EU Login accounts are personal, and the SRP terms make access strictly personal. ENISA may also refuse a login when the same account already has an open session elsewhere, so a shared account can block the second responder.

Do we have to register on the SRP before an incident?

Article 14 doesn’t mention registration. ENISA advises registering only when you need to file, to limit CSIRT workload; Finland’s NCSC, in its advance-preparation checklist, says both representatives must register on the SRP without saying when. Create the EU Login accounts now in either case, and ask your coordinator CSIRT which approach it expects.

How long does CSIRT verification take?

ENISA doesn’t publish a timeline; it says procedures and processing times vary between CSIRTs. You can submit up to 20 notifications while unverified, but you can’t invite a Secondary AR until your association shows “Verified”.

Can a consultant or law firm act as our Assigned Representative?

ENISA’s materials don’t address external representatives directly. The terms require each user to guarantee they are an Assigned Representative authorised to act for the organisation, and the coordinator CSIRT verifies that link, so check with your CSIRT before relying on an outside filer.

Is there an API to file from our ticketing system?

Not at launch: ENISA’s FAQ 15 says notifications must be entered through the platform interface. Finland’s NCSC expects API submission to become possible from spring 2027.

Key takeaways

• The SRP is the required channel for CRA Article 14 notifications, and it is English-only (FAQ 24). If it’s down, wait and file when it’s back; contact your CSIRT directly only if communication can’t wait.
• Settle the coordinator CSIRT under Article 14(7) before an incident; the portal asks for it right after your role, at registration and at every login.
• Every filer needs a personal EU Login account with MFA. We recommend a backup second factor for each person.
• No deputy can be added until the CSIRT verifies the Primary AR. Plan for that window.
• Draft outside the platform: SRP drafts are visible only to the person who created them.
• The CRA hub covers how this fits the wider regime: Cyber Resilience Act compliance guide.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

ENISA guidance checked on 21 October 2026. ENISA updates its SRP pages regularly; re-check the FAQ and manual before relying on any platform detail.

Sources

1. Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, as corrected by the corrigendum of 2 July 2025 (OJ L 2025/90555) — EUR-Lex. Articles 14(1), 14(2)(a), 14(3), 14(4)(a), 14(7), 16(1)–(2), 18, 24(3), 64(2), 64(10) and 71(2).
2. CRA Single Reporting Platform: Frequently Asked Questions, updated 15 October 2026 — ENISA. FAQs 4, 6, 8, 9, 11, 12, 15, 18, 24, 25, 27, 30, 32, 33 and 34.
3. CRA SRP Guidance: AR User Registration, last updated 12 September 2026 — ENISA.
4. CRA SRP Guidance: AR Interface functions, last updated 12 September 2026 — ENISA.
5. CRA SRP Guidance: AR Notification submission and update, last updated 12 September 2026 — ENISA.
6. CRA Single Reporting Platform – AR User Manual, version 1.1, September 2026 — ENISA.
7. The Cyber Resilience Act Single Reporting Platform Terms and Conditions, version 1.0, 10 September 2026 — ENISA. Clauses 3.1.4, 3.1.8, 3.1.9, 4.1.5, 4.4.1 and 4.6.1.
8. List of CSIRTs Designated as Coordinators, last updated 10 September 2026 — ENISA.
9. CRA SRP Status — ENISA.
10. External, self-registered account FAQ — EU Login Portal, European Commission.
11. Manufacturers – prepare in advance for reporting vulnerabilities and incidents under the Cyber Resilience Act, 28 August 2026 — National Cyber Security Centre Finland (Traficom).
12. Directive (EU) 2022/2555 (NIS2), Article 26: Jurisdiction and territoriality — primary-text edition, nis-2-directive.com.
13. Directive (EU) 2022/2555 (NIS2), Article 23: Reporting obligations — primary-text edition, nis-2-directive.com.