EU Makers Must Report Exploited Flaws Through One ENISA Platform Since 11 September 2026

Since 11 September 2026, manufacturers of products with digital elements have been required to report two kinds of events to EU authorities: vulnerabilities that are being actively exploited, and severe security incidents. The duty comes from the Cyber Resilience Act. ENISA, the EU cybersecurity agency, says its Single Reporting Platform reached initial operating capability on that date, and that manufacturers' reporting obligations started the same day. The law's main cybersecurity requirements for products apply later, from 11 December 2027.

The reporting rules arrive well before the design requirements, and they set short deadlines that run from the moment a manufacturer becomes aware of a problem. For companies that ship connected hardware or software into the EU, the reporting clock is the first part of the law to apply, and it covers products already on the market.

What Has to Be Reported Under Article 14

Article 14 of the Cyber Resilience Act sets the reporting duty. Mondaq, a legal publication, describes two categories. The first is actively exploited vulnerabilities, meaning flaws that are being used in the wild. NCSC Ireland says such a flaw is one where reliable evidence shows a malicious actor is exploiting it.

The second category is serious incidents. Mondaq describes these as incidents that have, or could have, a significant impact on a product's security or on its users. NCSC Ireland describes a severe incident as an operational security incident that affects, or could affect, a product's security functions, the confidentiality of its data or the integrity of its systems.

The two descriptions are worded differently.

A Three-Stage Clock That Starts at Awareness

The first stage is an early warning, due within 24 hours of the manufacturer becoming aware of a reportable event. NCSC Ireland says it should be submitted without waiting for a detailed technical analysis. Mondaq gives the same 24-hour figure.

The second stage is a detailed notification due within 72 hours of awareness. NCSC Ireland describes this as 48 hours after the early warning, which reaches the same 72-hour mark. According to NCSC Ireland, the notification should carry an initial severity assessment, the root cause, the nature of the event and any temporary mitigations.

The third stage is the final report. For an actively exploited vulnerability, it is due no later than 14 days after a corrective or mitigating measure becomes available. For a severe incident, it is due no later than one month after the 72-hour notification. NCSC Ireland says the final report includes full root-cause analysis, patch details and corrective actions.

The clock starts at awareness, not at the moment a fix ships. The final-report deadline for an exploited flaw, however, depends on when a fix or workaround becomes available.

One Platform, Staged Submissions

ENISA develops, operates and maintains the Single Reporting Platform. It says the tool helps manufacturers and open-source software stewards meet their CRA reporting duties, and that they can report once so the information reaches all relevant authorities. ENISA says the platform reached initial operating capability on 11 September 2026.

NCSC Ireland says every notification goes through the platform, which routes reports to the relevant national CSIRT and to ENISA. Only submissions made through the platform satisfy the statutory obligation, according to NCSC Ireland. Mondaq describes the platform as the EU-wide route through which these notifications must flow.

Reporting can be staged. Mondaq says the CRA expressly allows information to be provided progressively, and that the coordinating authority may ask for an additional interim report before the final report. NCSC Ireland adds that no pre-registration is needed, and that an account is created during the first submission.

ENISA also publishes an FAQ, user manuals, tutorial videos, a glossary and a factsheet in several EU languages, and runs a help desk for questions the published material does not cover. The European Commission publishes further reporting guidance, according to ENISA.

Two Accounts of Who Files the Report

ENISA describes manufacturers and open-source software stewards as the parties that meet the duty through the platform. Mondaq says submissions run through authorised representatives who act for the manufacturer. Mondaq describes one primary representative and up to 20 secondary representatives, each logging in through an individual EU Login account with multi-factor authentication.

Mondaq also separates these platform representatives from the Article 18 authorised representative, which handles external duties such as dealings with market surveillance authorities and keeping technical documentation.

Coordination raises a related point. Mondaq says the coordinating authority is the CSIRT of the Member State where the manufacturer's main establishment is located, meaning where product cybersecurity decisions are predominantly taken. It also says that choosing the wrong authority risks invalidation and resubmission.

ENISA says the CSIRT designated as a coordinator receives a notification first, passes the information to other CSIRTs in Member States where the product is available, and makes it available to ENISA at the same time.

Email Fallback, Third-Party Parts and Products Already Sold

Email is a fallback only. NCSC Ireland says it is accepted at a dedicated address, cra_fallback@ncsc.gov.ie, and only when ENISA officially declares the platform offline. Email sent while the platform is operating does not satisfy the legal obligation, and NCSC Ireland says email is otherwise used for voluntary urgent alerts. Once the platform is available again, the early warning and the 72-hour notification must be submitted through it.

For third-party components, NCSC Ireland says the duty applies once the manufacturer confirms that its product is affected by an actively exploited vulnerability or severe incident in that component.

Products placed on the market before 11 December 2027 are exempt from the design rules, according to NCSC Ireland. They remain fully subject to the reporting obligations while they are available on the EU market.

Who Is Covered, Who Enforces It, and the Calendar

Mondaq describes the duty as applying to manufacturers of connected products, covering both hardware and software. ENISA refers to products with digital elements. ENISA also says reporting obligations will apply to open-source software stewards under Article 24(3), to the extent they are involved in developing products with digital elements. It gives 11 December 2027 as the date that article applies from.

Mondaq says the coordinating authority may request further information. The competent market surveillance authority may request information to assess compliance with the reporting duties and, where appropriate, take enforcement action. Mondaq expects enforcement to build over time and to vary by Member State.

ENISA says the reporting obligations began on 11 September 2026, the day the platform reached initial operating capability. The main cybersecurity requirements apply from 11 December 2027. Between the two dates, about 15 months, reporting applies without the full set of product requirements.