CRA reports go through ENISA's platform

What is new

The reporting obligations of Art. 14 CRA have applied since 11 September 2026. Reports go through the single reporting platform under Art. 16: the manufacturer selects the coordinating CSIRT of the Member State of its main establishment in the Union, and ENISA receives the notification at the same time.

What it means for machine manufacturers

The deadlines stay the same: early warning within 24 hours, notification within 72 hours, a final report afterwards – and affected users must be informed. What changes is the channel. Anyone who only looks for access and responsibilities during an incident loses hours the deadline does not allow.

What to do now

First: register in advance and decide who reports in the company and who stands in. Second: know which components are in which machine – without a component list (SBOM) you cannot tell within 24 hours whether you are affected. Third: record the reporting channel in the technical documentation.