Reviewed 17 August 2026
Preparing for the CRA Single Reporting Platform
Access readiness and information readiness are two different problems. Rehearse both.
ENISA describes the Single Reporting Platform as the reporting channel that supports the CRA notification flow and routes reports to the CSIRT designated as coordinator for the manufacturer's main establishment and to ENISA. The platform is operational from 11 September 2026.
Preparation is not the same as submitting test incident content. Confirm which legal entity is the manufacturer, where its main establishment is, who owns access, which deputies can act outside business hours and how platform credentials are protected. Document the safe path from the internal incident record to the authorised submitter. Test access using only the platform's permitted test or onboarding process.
Keep platform access separate from the substantive decision: a working login does not prove that the organisation can assemble product versions, market information, impact, measures and user mitigation within 72 hours.
Access and routing checklist
| Check | Evidence to keep |
|---|---|
| Manufacturer legal entity confirmed | Written scope note from legal |
| Main establishment and coordinating CSIRT identified | Routing decision record |
| Named submitter and deputy | RACI entry with contact review date |
| Access created and tested via permitted onboarding | Dated access confirmation |
| Credential protection and out-of-hours cover | Access management policy reference |
| Path from internal record to authorised submitter | One-page handoff diagram |