On 23 September 2026, Aikido Security Published the First Public Account of Actually Using ENISA's SRP
Every account of the Single Reporting Platform we have covered so far, including our own, has come from reading ENISA's guidance rather than from filing through it. That changed on 23 September 2026, when Jens Gellynck of Aikido Security, a Belgian application-security vendor, published "Cyber Resilience Act is here! Myth busting and first impressions," describing what actually happened when his company registered as an Assigned Representative (AR) and went through CSIRT verification. In a search across primary sources and press coverage in English, German, French, Italian, Polish and Dutch, it is the first on-the-record account we have found of someone who has actually been through the process, rather than summarising ENISA's documents about it.
What he reports
- CSIRT verification took three business days. Gellynck writes that "getting my account verified as a real Aikido employee (the 'Assigned Representative association') took three business days for Belgium's CSIRT to verify."
- Launch day was not clean. "The platform had a few deployment issues on the 11th, but everything was online within a few hours," he reports, the first concrete, named account of the friction our own rapporteringsguide only inferred from ENISA quietly re-dating its pages that same day.
- Passkeys work, but keep a backup. The platform "supports passkey authentication," and he recommends "setting up a few backup devices so you don't get locked out," a practical warning about EU Login's mandatory multi-factor authentication that ENISA's own guidance does not spell out.
- Overall verdict: "mostly positive." Once account setup was done, he found the experience workable rather than frustrating.
The three-day wait does not cost you the 24-hour deadline
Read alongside a live-fire scenario, three business days sounds alarming next to a 24-hour early-warning clock. It is not, in practice: ENISA's own guidance, which we cover in detail on our reporting page, confirms that CSIRT validation of your Assigned Representative association is not a prerequisite for filing, and an unverified account may submit up to twenty notifications before validation becomes mandatory. Gellynck's account confirms the practical shape of that rule from the other side of the process: register and start validation before you need it, not during an incident, and the wait happens in parallel with your ability to report.
Read as one data point, not a verdict
Aikido sells vulnerability-management and CRA-compliance tooling, so a positive account from its own security lead is not disinterested; a vendor whose product helps customers prepare CRA evidence has a reason to describe the underlying regulatory process as manageable. That does not make the account inaccurate, but it is one company, in one Member State, run by a team that had already prepared. It is a genuine data point, not a survey, and we would treat a rockier account from an unprepared first-time filer as just as credible if one surfaces.
No Application Programming Interface is offered for the SRP at this stage, so the account above concerns the web-form registration and verification flow, not an automated integration. Voluntary reporting under Article 15 also remains unavailable, with no date attached.
What would make this a stronger picture
One account is a start, not a trend. If your organisation has been through AR registration or filed a notification and had a different experience, faster, slower, or rougher, that is exactly the kind of detail this site exists to track; the support-period planner och rapporteringsguide are built from primary sources precisely because first-hand accounts like this one are still rare three weeks after launch.