ENISA Published Step-by-Step Single Reporting Platform Instructions on 31 July 2026, Five Weeks Before Reporting Starts
When we last looked at the tArdán Tuairiscithe Aonair on 29 June 2026, there was an obligation with a date on it and very little else. That has changed. In July 2026 ENISA published a factsheet and two step-by-step guidance pages, both last updated on 31 Iúil 2026, and expanded its FAQ. A third page, covering the representative's interface, followed on 14 Lúnasa 2026, and a field-by-field Gluais SRP on 5 Meán Fómhair 2026. Together they set out the registration flow, the submission screens and the exact data fields, with interface screenshots. With 11 Meán Fómhair 2026 five weeks away, there is finally enough detail to rehearse a report on paper.
The platform is open and the flow described here is the one that went live. ENISA revised this material repeatedly in the interval. Two statements below were overtaken and are corrected in place: the list of designated CSIRTs has been published, and voluntary reporting did not open on 11 September as ENISA once said it would. A guidance page on Particularly Exceptional Circumstances, a rewritten FAQ, a new glossary, an AR User Manual and platform terms and conditions have also appeared, and the unverified filing cap has doubled. The registration flow and the 24-hour form described here still hold, with the field list corrected.
The registration flow, and a naming trap
Registration runs through EU Login, and the account can be created now. On first access you select your role, pick your CSIRT ainmnithe from a drop-down, accept the legal agreement, confirm pre-filled personal details and then enter the manufacturer's name, address and additional information. That last step creates the manufacturer entity in the platform. There are two seats: a Primary representative and a Secondary one who joins by email invitation and holds a backup role. The invitation link expires after 7 lá, after which the record is marked "Invitation Expired".
One point will cause confusion. ENISA's guidance is written for "Assigned Representatives", abbreviated AR. That is a platform account role, not the ionadaí údaraithe under Article 18 of the CRA. A company can have the former and not the latter, and an internal procedure should not conflate them.
The 24 hour form is shorter than people expect
The FAQ now sets out which fields are obligatory at each stage. At the 24 hour early warning the mandatory set is small. It grew slightly when ENISA rewrote the FAQ on 4 Meán Fómhair 2026, and now covers notification type and level, a title, a summary, the manufacturer name, the product name and product version, the date and time you became aware, and for incidents whether unlawful or malicious acts are suspected. Almost everything substantive, the nature of the vulnerability, the nature of the exploit and the corrective measures, becomes mandatory at 72 uair an chloig, with the full description, severity, impact and security-update detail at the tuarascáil dheiridh.
That shape matters for process design. The 24 hour clock is not asking for an investigation, it is asking for an alert. Teams building their triage around a complete picture in a day are solving a harder problem than the one they have. Our treoir tuairiscithe sets out the sequence.
Who sees what, and when
The early warning goes to the designated CSIRT and to ENISA at the same time, with an email and an alert to both. The 72 hour notification behaves differently. Where the manufacturer marks one of the conditions in Airteagal 16(2), exploitation confined to a single Member State, essential interests of that Member State, or an imminent high cybersecurity risk from further dissemination, ENISA receives only partial information until the receiving CSIRT releases the full notification. ENISA labels this "particularly exceptional circumstances".
This is often reported loosely, so it is worth being precise. The manufacturer cannot delay gcomhdú: the 24, 72 and 14 day windows run from awareness and nothing pauses them. What it can do is flag sensitivity, which restricts who sees the content. The decision to hold back onward dissemination stays with the receiving CSIRT, under Commission Delegated Regulation (EU) 2026/881, a glacadh ar an 11 Nollaig 2025. The final report likewise reaches other CSIRTs only after the coordinating CSIRT disseminates it manually, and once submitted the notification becomes non-editable.
Three gaps, and where they stand now
First, the public URL had not been published, and the registration screenshots said "URL to be provided at launch", so nobody could rehearse in the live system. That gap closed at the last moment: ENISA published the address, portal.cra-srp.enisa.europa.eu, in its FAQ on 10 Meán Fómhair 2026, the day before the platform opened.
Second, the liosta de CSIRTanna náisiúnta atá ainmnithe mar chomhordaitheoirí was still to come, which sat awkwardly with a registration flow that asks you to pick yours from a drop-down. ENISA published it on 4 September 2026, a chumhdaíonn na 27 Member States. That gap is closed.
Third, ENISA states that no reporting API will be provided at the initial release, though it may be considered in a future phase: internal workflow can be automated up to the point of submission, but a human will be typing into a browser at the end of it. That remains the position.
One line in this section has not aged well. We wrote that voluntary reporting is enabled tar éis 11 September 2026, which is what ENISA said at the time. The rewritten FAQ is firmer and later: on 11 September the platform accepts ach le fógraí éigeantacha faoi Airteagail 14 agus 24, agus bogann tuairisciú deonach faoi Airteagal 15 voluntary reporting moves to a future phase with no date attached.
An tArdán Tuairiscithe Aonair opened on schedule at portal.cra-srp.enisa.europa.eu, reached by selecting the Assigned Representative role and signing in through EU Login with multi-factor authentication. ENISA published the address in its FAQ on 10 Meán Fómhair 2026 and released the AR User Manual the same day; the tutorial videos promised alongside it have not appeared. ENISA still advises registering only when you actually need to file, since the coordinating CSIRT validates the account after first access and that validation does not block submission. The cap on filing while unvalidated stands at 20 notifications per manufacturer in the FAQ.
Two things the screenshots did not show
Both surfaced in September and both bear on the clock. ENISA's FAQ of 4 Meán Fómhair 2026 explains that the platform's cuntar 72 uair an chloig runs from submission of the 24-hour report, not from awareness, so a filing can display as thar téarma before the legal deadline has passed. And the Gluais SRP of 5 Meán Fómhair 2026 notes that the field recording when you became aware of an actively exploited vulnerability arrives only in a later release, while the severe-incident field records when the incident was detected. Since awareness, on the Commission's reading, follows an initial assessment reaching reasonable certainty, the platform will not hold the moment Article 14 measures from. Keep your own record.
What to do before 11 September
Three things still do not depend on the platform existing. Create the EU Login accounts for the primary and backup people now, because doing it mid-incident is a needless delay. Build the 24 hour early warning as a short internal form matching ENISA's mandatory fields, and name the two people who can complete it out of hours. And confirm which products are in scope, since the 72 hour stage asks for product type and Annex III or IV category: our uirlis aicmithe freagra air sin, agus tugann an staid reatha tracker keeps the dates current.