ENISA Published Step-by-Step Single Reporting Platform Instructions on 31 July 2026, Five Weeks Before Reporting Starts
When we last looked at the 단일 신고 플랫폼 on 29 June 2026, there was an obligation with a date on it and very little else. That has changed. In July 2026 ENISA published a factsheet and two step-by-step guidance pages, both last updated on 2026년 7월 31일, and expanded its FAQ. A third page, covering the representative's interface, followed on 2026년 8월 14일, and a field-by-field SRP 용어집 on 2026년 9월 5일. Together they set out the registration flow, the submission screens and the exact data fields, with interface screenshots. With 2026년 9월 11일 five weeks away, there is finally enough detail to rehearse a report on paper.
The platform is open and the flow described here is the one that went live. ENISA revised this material repeatedly in the interval. Two statements below were overtaken and are corrected in place: the list of designated CSIRTs has been published, and voluntary reporting did not open on 11 September as ENISA once said it would. A guidance page on Particularly Exceptional Circumstances, a rewritten FAQ, a new glossary, an AR User Manual and platform terms and conditions have also appeared, and the unverified filing cap has doubled. The registration flow and the 24-hour form described here still hold, with the field list corrected.
The registration flow, and a naming trap
Registration runs through EU Login, and the account can be created now. On first access you select your role, pick your 지정 CSIRT from a drop-down, accept the legal agreement, confirm pre-filled personal details and then enter the manufacturer's name, address and additional information. That last step creates the manufacturer entity in the platform. There are two seats: a Primary representative and a Secondary one who joins by email invitation and holds a backup role. The invitation link expires after 7일, after which the record is marked "Invitation Expired".
One point will cause confusion. ENISA's guidance is written for "Assigned Representatives", abbreviated AR. That is a platform account role, not the 공인 대리인 under Article 18 of the CRA. A company can have the former and not the latter, and an internal procedure should not conflate them.
The 24 hour form is shorter than people expect
The FAQ now sets out which fields are obligatory at each stage. At the 24 hour early warning the mandatory set is small. It grew slightly when ENISA rewrote the FAQ on 2026년 9월 4일, and now covers notification type and level, a title, a summary, the manufacturer name, the product name and product version, the date and time you became aware, and for incidents whether unlawful or malicious acts are suspected. Almost everything substantive, the nature of the vulnerability, the nature of the exploit and the corrective measures, becomes mandatory at 72시간, with the full description, severity, impact and security-update detail at the 최종 보고서.
That shape matters for process design. The 24 hour clock is not asking for an investigation, it is asking for an alert. Teams building their triage around a complete picture in a day are solving a harder problem than the one they have. Our 신고 안내 sets out the sequence.
Who sees what, and when
The early warning goes to the designated CSIRT and to ENISA at the same time, with an email and an alert to both. The 72 hour notification behaves differently. Where the manufacturer marks one of the conditions in 제16조(2), exploitation confined to a single Member State, essential interests of that Member State, or an imminent high cybersecurity risk from further dissemination, ENISA receives only partial information until the receiving CSIRT releases the full notification. ENISA labels this "particularly exceptional circumstances".
This is often reported loosely, so it is worth being precise. The manufacturer cannot delay 제출: the 24, 72 and 14 day windows run from awareness and nothing pauses them. What it can do is flag sensitivity, which restricts who sees the content. The decision to hold back onward dissemination stays with the receiving CSIRT, under Commission Delegated Regulation (EU) 2026/881, 즉 2025년 12월 11일. The final report likewise reaches other CSIRTs only after the coordinating CSIRT disseminates it manually, and once submitted the notification becomes non-editable.
Three gaps, and where they stand now
First, the public URL had not been published, and the registration screenshots said "URL to be provided at launch", so nobody could rehearse in the live system. That gap closed at the last moment: ENISA published the address, portal.cra-srp.enisa.europa.eu, in its FAQ on 2026년 9월 10일, the day before the platform opened.
Second, the 조정자로 지정된 각국 CSIRTs 목록 was still to come, which sat awkwardly with a registration flow that asks you to pick yours from a drop-down. ENISA published it on 4 September 2026을 공개했습니다. 이 목록은 EU 회원국 27 Member States. That gap is closed.
Third, ENISA states that no reporting API will be provided at the initial release, though it may be considered in a future phase: internal workflow can be automated up to the point of submission, but a human will be typing into a browser at the end of it. That remains the position.
One line in this section has not aged well. We wrote that voluntary reporting is enabled 이후에 11 September 2026, which is what ENISA said at the time. The rewritten FAQ is firmer and later: on 11 September the platform accepts 오직 제14조 및 제24조에 따른 의무 신고뿐이며, 제15조 voluntary reporting moves to a future phase with no date attached.
해당 단일 신고 플랫폼 opened on schedule at portal.cra-srp.enisa.europa.eu, reached by selecting the Assigned Representative role and signing in through EU Login with multi-factor authentication. ENISA published the address in its FAQ on 2026년 9월 10일 and released the AR User Manual the same day; the tutorial videos promised alongside it have not appeared. ENISA still advises registering only when you actually need to file, since the coordinating CSIRT validates the account after first access and that validation does not block submission. The cap on filing while unvalidated stands at 20 notifications per manufacturer in the FAQ.
Two things the screenshots did not show
Both surfaced in September and both bear on the clock. ENISA's FAQ of 2026년 9월 4일 explains that the platform's 72시간 카운터 runs from submission of the 24-hour report, not from awareness, so a filing can display as 기한 초과 before the legal deadline has passed. And the SRP 용어집 of 2026년 9월 5일 notes that the field recording when you became aware of an actively exploited vulnerability arrives only in a later release, while the severe-incident field records when the incident was detected. Since awareness, on the Commission's reading, follows an initial assessment reaching reasonable certainty, the platform will not hold the moment Article 14 measures from. Keep your own record.
What to do before 11 September
Three things still do not depend on the platform existing. Create the EU Login accounts for the primary and backup people now, because doing it mid-incident is a needless delay. Build the 24 hour early warning as a short internal form matching ENISA's mandatory fields, and name the two people who can complete it out of hours. And confirm which products are in scope, since the 72 hour stage asks for product type and Annex III or IV category: our 분류 도구 가 그 답을 제시하며, 진행 현황 tracker keeps the dates current.