ENISA's 3 August 2026 Update Says CSIRT Validation Is Not a Precondition for Reporting, and Cross-Border Sharing Is a Manual Step

ENISA's 3 August 2026 Update Says CSIRT Validation Is Not a Precondition for Reporting, and Cross-Border Sharing Is a Manual Step

On 3 August 2026, ENISA re-dated both of its Single Reporting Platform guidance pages and its SRP FAQ, and moved the whole SRP section of its website to a new address under Topics, Product Security. There was no announcement, but the pages carry new text, and two of the changes matter. With mandatory reporting starting on 11 септември 2026 г., four weeks away, both go to questions manufacturers have been asking since July.

Validation by your CSIRT is not a gate

The registration guidance now carries a note that was not there on 31 July. Validation of an assigned representative's registration by the CSIRT, определен като координатор, which ENISA now abbreviates CDaC, is not a prerequisite for fulfilling the CRA reporting obligation. Validation happens after first access to the platform, runs in parallel with the reporting process, and does not affect the ability to submit notifications.

That answers a real worry. A manufacturer becoming aware of an actively exploited vulnerability on, say, 12 September faces a 24-hour clock that runs from awareness and that nothing pauses. Had approval been a precondition, an unprocessed account could have put a company in breach through no act of its own. ENISA has now said, in writing, that it will not.

ENISA is telling manufacturers not to register early

The same note repeats advice that had until now sat only in the FAQ: register and start validation only when you need to submit a specific notification, rather than creating an account pre-emptively. The reasoning is capacity. Every registration creates validation work for a national CSIRT, and those teams are staffing up for September.

It is sensible from ENISA's side and awkward from a manufacturer's. Taken literally, it means your first ever login to an unfamiliar system happens while a live incident clock is running. The workable middle path is the one the FAQ already permits: create the EU Login account now, since that involves no CSIRT, and leave the SRP registration until you need it.

Sharing with other Member States is a manual action

The submission guidance changed more substantially. It now states that concerned CSIRTs receive the early warning, 72-hour notification и тя final report only after manual dissemination by the CDaC. The 31 July text said this only of the final report. ENISA still receives the early warning automatically, and the later stages automatically unless particularly exceptional circumstances are invoked.

This does not change any legal duty. Article 16(2) requires the receiving CSIRT to disseminate without delay, and the only lawful reasons to hold a notification back are the cybersecurity-related grounds specified in Commission Delegated Regulation (EU) 2026/881, adopted on 11 December 2025. What it does tell you is that a human at one national CSIRT stands between your report and the other Member States where your product is sold. If you are counting on a market surveillance authority in another country learning of a fix quickly, that is a dependency worth understanding. Our ръководството за докладване sets out the sequence and the deadlines.

Two smaller changes worth noting

Confirmation emails and alerts now go to всички assigned representatives registered for a manufacturer, not only to the person who pressed submit. Route them to a monitored mailbox rather than an individual. And the role granted on completing registration is now called AR Primary User, with the backup seat named AR Backup User. As before, an invitation to a secondary representative expires after 7 дни.

One point from July still deserves repeating, because it is the mistake we see most often. ENISA's assigned representative is a platform account role. It is not the упълномощен представител under Article 18 of the CRA. A company can have the first without the second, and an internal procedure that treats them as one thing will eventually name the wrong person.

What to do in the next four weeks

Bookmark the new ENISA addresses, because the old ones still serve the 31 July text and will quietly drift out of date. Create your EU Login account. Confirm which CSIRT is your coordinator under Article 14(7), based on your main establishment. Decide who holds the primary and backup seats, and put a monitored mailbox behind both. Then write the 24-hour early warning you would file tomorrow, because that is the part no platform will do for you. Our timeline page tracks what is still outstanding.