ENISA launches CRA single reporting platform as EU cyber incident duties start
Published · Updated
What happened
ENISA launched the initial operating capability of the Cyber Resilience Act Single Reporting Platform on 11 September 2026. The launch coincided with the start of CRA reporting obligations for actively exploited vulnerabilities and severe incidents by manufacturers and open-source software stewards.
Why it matters
The EU now has a live reporting channel tied to a binding cyber law rather than a future implementation plan. Companies, open-source maintainers and national authorities can begin using one submission path for time-sensitive vulnerability and incident notifications across member states.
ENISA said it has launched the initial operating capability of the Cyber Resilience Act Single Reporting Platform on 11 September 2026, the same day the Act's reporting obligations for actively exploited vulnerabilities and severe incidents took effect. The platform is meant to let manufacturers and open-source software stewards file one report that can be routed to the relevant authorities across the EU. This turns a previously planned compliance mechanism into a live operational test of Union cyber-governance, data flows and enforcement coordination.
Watch for
ENISA publication of user guidance, outage notices, or throughput updates for the CRA Single Reporting Platform by 2026-09-15 European Commission DG CONNECT clarification on CRA reporting scope for open-source software stewards by 2026-09-15 National cybersecurity authorities in at least two member states confirming receipt-routing from the ENISA platform by 2026-09-15 First public manufacturer or open-source steward acknowledgement of a CRA report filed through the platform by 2026-09-15
Sources
- Cyber Resilience Act · digital-strategy.ec.europa.eu
- Commission publishes new guidance to support businesses' implementation of the Cyber Resilience Act · digital-strategy.ec.europa.eu
- ENISA launches CRA Single Reporting Platform · enisa.europa.eu
- The EU spent billions on a cyberattack shield — nobody checked if it worked · euronews.com