ENISA Published Step-by-Step Single Reporting Platform Instructions on 31 July 2026, Five Weeks Before Reporting Starts
When we last looked at the Vienotā ziņošanas platforma on 29 June 2026, there was an obligation with a date on it and very little else. That has changed. In July 2026 ENISA published a factsheet and two step-by-step guidance pages, both last updated on 2026. gada 31. jūlijā, and expanded its FAQ. Together they set out the registration flow, the submission screens and the exact data fields, with interface screenshots. With 2026. gada 11. septembris five weeks away, there is finally enough detail to rehearse a report on paper.
The registration flow, and a naming trap
Registration runs through EU Login, and the account can be created now. On first access you select your role, pick your izraudzīto CSIRT from a drop-down, accept the legal agreement, confirm pre-filled personal details and then enter the manufacturer's name, address and additional information. That last step creates the manufacturer entity in the platform. There are two seats: a Primary representative and a Secondary one who joins by email invitation and holds a backup role. The invitation link expires after 7 dienām, after which the record is marked "Invitation Expired".
One point will cause confusion. ENISA's guidance is written for "Assigned Representatives", abbreviated AR. That is a platform account role, not the pilnvarotā pārstāvja under Article 18 of the CRA. A company can have the former and not the latter, and an internal procedure should not conflate them.
The 24 hour form is shorter than people expect
The FAQ now sets out which fields are obligatory at each stage. At the 24 hour early warning the mandatory set is small: notification type, notification level, manufacturer or steward name, product, a title, and for incidents whether unlawful or malicious acts are suspected. Almost everything substantive, the nature of the vulnerability, the nature of the exploit and the corrective measures, becomes mandatory at 72 stundas, with the full description, severity, impact and security-update detail at the final report.
That shape matters for process design. The 24 hour clock is not asking for an investigation, it is asking for an alert. Teams building their triage around a complete picture in a day are solving a harder problem than the one they have. Our ziņošanas rokasgrāmata sets out the sequence.
Who sees what, and when
The early warning goes to the designated CSIRT and to ENISA at the same time, with an email and an alert to both. The 72 hour notification behaves differently. Where the manufacturer marks one of the conditions in 16. panta 2. punktā, exploitation confined to a single Member State, essential interests of that Member State, or an imminent high cybersecurity risk from further dissemination, ENISA receives only partial information until the receiving CSIRT releases the full notification. ENISA labels this "particularly exceptional circumstances".
This is often reported loosely, so it is worth being precise. The manufacturer cannot delay iesniegšanu: the 24, 72 and 14 day windows run from awareness and nothing pauses them. What it can do is flag sensitivity, which restricts who sees the content. The decision to hold back onward dissemination stays with the receiving CSIRT, under the delegated act the Commission adopted on 2025. gada 11. decembrī. The final report likewise reaches other CSIRTs only after the coordinating CSIRT disseminates it manually, and once submitted the notification becomes non-editable.
Three gaps, five weeks out
First, the public URL has not been published, and the registration screenshots say "URL to be provided at launch", so nobody can rehearse in the live system yet. Second, the par koordinatoriem izraudzīto nacionālo CSIRT saraksta is still to come, which sits awkwardly with a registration flow that asks you to pick your designated CSIRT from a drop-down. Third, and most consequential for larger manufacturers, ENISA states that no reporting API will be provided at this stage: internal workflow can be automated up to the point of submission, but a human will be typing into a browser at the end of it. Voluntary reporting, separately, is only enabled pēc 11 September 2026.
Šis Vienotā ziņošanas platforma is vēl nedarbojas. ENISA has scheduled it to be operational by 2026. gada 11. septembris, the date the Article 14 reporting obligations start to apply, with user and security testing beforehand. The public access URL has not been published and will be posted on ENISA's SRP page before go-live. Short instructional videos are still to come, and ENISA intends to hold a vebinārs divas nedēļas pirms the platform enters service. The guidance published so far is expressly marked as subject to change. ENISA advises registering only when you actually need to file, since the coordinating CSIRT validates the account after first access rather than before, and that validation does not block submission.
What to do in the next five weeks
Three things do not depend on the platform existing. Create the EU Login accounts for the primary and backup people now, because doing it mid-incident is a needless delay. Build the 24 hour early warning as a short internal form matching ENISA's mandatory fields, and name the two people who can complete it out of hours. And confirm which products are in scope, since the 72 hour stage asks for product type and Annex III or IV category: our klasifikācijas rīks sniedz atbildi uz to, un norises stāvokļa tracker keeps the dates current.