Single Reporting Platform

The Single Reporting Platform (SRP) is the web portal through which manufacturers send the notifications the Cyber Resilience Act (CRA) requires: actively exploited vulnerabilities and severe incidents affecting their products. ENISA, the EU Agency for Cybersecurity, runs it under Article 16 of Regulation (EU) 2024/2847. It launched on 11 September 2026, the day the CRA's reporting obligations began to apply.

What gets reported, and by when

Manufacturers report two kinds of event: an actively exploited vulnerability in a product with digital elements, and a severe incident that affects the security of such a product. Both terms are defined in the regulation. Each goes through three steps:

Step	Deadline	Applies to
Early warning	Within 24 hours of becoming aware	Both
Notification	Within 72 hours of becoming aware	Both
Final report	Within 14 days after a fix or mitigation is available	Actively exploited vulnerabilities
Final report	Within one month after the notification	Severe incidents

The deadlines are set by Article 14 of the CRA, not by the portal, and ENISA's SRP FAQ repeats them. The obligation covers products already on the market, not only those placed on it after the CRA applies in full. Article 14 also requires manufacturers to inform the impacted users, which they do themselves: the platform reaches authorities, not customers.

Who receives a notification

A manufacturer submits each notification once. It goes to the CSIRT designated as coordinator in the Member State of the manufacturer's main establishment and to ENISA at the same time, except in particularly exceptional circumstances. The coordinator passes it to the CSIRTs of the other Member States where the product is available. ENISA lists the designated coordinators on its SRP page.

Once a notified vulnerability is fixed, ENISA can disclose it in the European Vulnerability Database (EUVD), in agreement with the manufacturer. How the EUVD relates to CVE IDs is explained under CVE.

How access works

Manufacturers act on the platform through Assigned Representatives (ARs). Each AR signs in with a personal EU Login account with multi-factor authentication. A manufacturer has one Primary AR, who can invite up to 20 Secondary ARs, and they can submit and update the manufacturer's notifications. A manufacturer with several group companies coordinates internally who reports for which entity.

What the platform does not do yet

As of November 2026, according to the SRP FAQ:

• No API. No application programming interface is provided at the initial release, so notifications are entered through the web interface. ENISA says an API may be considered in a future phase, and that organizations may automate their own internal reporting workflows.
• No voluntary reporting yet. Voluntary notifications under Article 15, for example of a vulnerability that is not actively exploited, are planned for a future phase. Today the platform accepts the mandatory notifications only.

ENISA calls the launch version its initial operating capability and plans to extend it. Its launch announcement also says the reporting obligations of open-source software stewards apply from 11 December 2027.

Getting ready to report

The 24 hours start when you become aware of the exploitation, so most of the work happens before anyone logs in:

• Register your Assigned Representatives before you need them, with a deputy in another time zone.
• Agree in advance who decides that a vulnerability counts as actively exploited, and how fast.
• Keep a per-version record of the components in each product, so you can name the affected products and versions within hours. See build-time SBOMs and are we affected by a CVE?.
• Prepare the notice to impacted users, since the platform does not send it.
• Keep the submitted text and timestamps for your own records.

CRACI prepares the content of the CRA notifications (early warning, notification and final report); a person at the manufacturer submits them through the Single Reporting Platform.

For the wider regulation see what is the CRA, the CRA guide and the glossary entry CRA. How a product security team runs this day to day is covered under PSIRT.