EU CRA Manufacturer Reporting Obligations Begin With ENISA Platform Launch

What happened

ENISA launched the initial operating capability of the Cyber Resilience Act Single Reporting Platform on 11 September 2026 and stated that manufacturer reporting obligations applied from that date.

Technical mechanism

The platform supports notifications concerning actively exploited vulnerabilities and severe incidents involving covered products with digital elements.

Why it matters

The operational start of manufacturer reporting obligations and ENISA's reporting platform creates a durable cross-border incident-reporting milestone for organizations placing covered digital products on the EU market.

Impact

Manufacturers of covered products with digital elements became subject to Cyber Resilience Act reporting obligations, with ENISA's platform intended to route notifications about actively exploited vulnerabilities and severe incidents.

Response

Establish product scope, reporting ownership, authorized submitters, incident clocks, evidence-preservation procedures, and legal review for EU-market products.

Defensive lessons

• Map covered products, legal roles, component ownership, and authorized reporting personnel before an incident.
• Create an around-the-clock process for preserving awareness time, affected versions, exploitation evidence, mitigations, and decision records.
• Separate manufacturer duties from the later obligations described for open-source stewards and obtain product-specific legal advice.

Evidence register

1. ENISA — ENISA — CRA Single Reporting Platform launch (verified)
2. OpenSSF — OpenSSF — Community guide to the CRA reporting milestone (qualified)