ENISA Published Step-by-Step Single Reporting Platform Instructions on 31 July 2026, Five Weeks Before Reporting Starts
When we last looked at the gemensamma rapporteringsplattformen on 29 June 2026, there was an obligation with a date on it and very little else. That has changed. In July 2026 ENISA published a factsheet and two step-by-step guidance pages, both last updated on 31 juli 2026, and expanded its FAQ. A third page, covering the representative's interface, followed on 14 augusti 2026, and a field-by-field SRP-ordlista on 5 september 2026. Together they set out the registration flow, the submission screens and the exact data fields, with interface screenshots. With 11 september 2026 five weeks away, there is finally enough detail to rehearse a report on paper.
The platform is open and the flow described here is the one that went live. ENISA revised this material repeatedly in the interval. Two statements below were overtaken and are corrected in place: the list of designated CSIRTs has been published, and voluntary reporting did not open on 11 September as ENISA once said it would. A guidance page on Particularly Exceptional Circumstances, a rewritten FAQ, a new glossary, an AR User Manual and platform terms and conditions have also appeared, and the unverified filing cap has doubled. The registration flow and the 24-hour form described here still hold, with the field list corrected.
The registration flow, and a naming trap
Registration runs through EU Login, and the account can be created now. On first access you select your role, pick your utsedda CSIRT from a drop-down, accept the legal agreement, confirm pre-filled personal details and then enter the manufacturer's name, address and additional information. That last step creates the manufacturer entity in the platform. There are two seats: a Primary representative and a Secondary one who joins by email invitation and holds a backup role. The invitation link expires after 7 dagar, after which the record is marked "Invitation Expired".
One point will cause confusion. ENISA's guidance is written for "Assigned Representatives", abbreviated AR. That is a platform account role, not the auktoriserade representant under Article 18 of the CRA. A company can have the former and not the latter, and an internal procedure should not conflate them.
The 24 hour form is shorter than people expect
The FAQ now sets out which fields are obligatory at each stage. At the 24 hour early warning the mandatory set is small. It grew slightly when ENISA rewrote the FAQ on 4 september 2026, and now covers notification type and level, a title, a summary, the manufacturer name, the product name and product version, the date and time you became aware, and for incidents whether unlawful or malicious acts are suspected. Almost everything substantive, the nature of the vulnerability, the nature of the exploit and the corrective measures, becomes mandatory at 72 timmar, with the full description, severity, impact and security-update detail at the slutliga rapporten.
That shape matters for process design. The 24 hour clock is not asking for an investigation, it is asking for an alert. Teams building their triage around a complete picture in a day are solving a harder problem than the one they have. Our rapporteringsguide sets out the sequence.
Who sees what, and when
The early warning goes to the designated CSIRT and to ENISA at the same time, with an email and an alert to both. The 72 hour notification behaves differently. Where the manufacturer marks one of the conditions in artikel 16(2), exploitation confined to a single Member State, essential interests of that Member State, or an imminent high cybersecurity risk from further dissemination, ENISA receives only partial information until the receiving CSIRT releases the full notification. ENISA labels this "particularly exceptional circumstances".
This is often reported loosely, so it is worth being precise. The manufacturer cannot delay inlämningen: the 24, 72 and 14 day windows run from awareness and nothing pauses them. What it can do is flag sensitivity, which restricts who sees the content. The decision to hold back onward dissemination stays with the receiving CSIRT, under Commission Delegated Regulation (EU) 2026/881, som antogs den 11 december 2025. The final report likewise reaches other CSIRTs only after the coordinating CSIRT disseminates it manually, and once submitted the notification becomes non-editable.
Three gaps, and where they stand now
First, the public URL had not been published, and the registration screenshots said "URL to be provided at launch", so nobody could rehearse in the live system. That gap closed at the last moment: ENISA published the address, portal.cra-srp.enisa.europa.eu, in its FAQ on 10 september 2026, the day before the platform opened.
Second, the förteckningen över nationella CSIRT som utsetts till samordnare was still to come, which sat awkwardly with a registration flow that asks you to pick yours from a drop-down. ENISA published it on 4 September 2026, som omfattar alla 27 Member States. That gap is closed.
Third, ENISA states that no reporting API will be provided at the initial release, though it may be considered in a future phase: internal workflow can be automated up to the point of submission, but a human will be typing into a browser at the end of it. That remains the position.
One line in this section has not aged well. We wrote that voluntary reporting is enabled efter 11 September 2026, which is what ENISA said at the time. The rewritten FAQ is firmer and later: on 11 September the platform accepts endast obligatoriska anmälningar enligt artiklarna 14 och 24, och frivillig rapportering enligt artikel 15 voluntary reporting moves to a future phase with no date attached.
Den gemensamma rapporteringsplattformen opened on schedule at portal.cra-srp.enisa.europa.eu, reached by selecting the Assigned Representative role and signing in through EU Login with multi-factor authentication. ENISA published the address in its FAQ on 10 september 2026 and released the AR User Manual the same day; the tutorial videos promised alongside it have not appeared. ENISA still advises registering only when you actually need to file, since the coordinating CSIRT validates the account after first access and that validation does not block submission. The cap on filing while unvalidated stands at 20 notifications per manufacturer in the FAQ.
Two things the screenshots did not show
Both surfaced in September and both bear on the clock. ENISA's FAQ of 4 september 2026 explains that the platform's 72-timmarsräknaren runs from submission of the 24-hour report, not from awareness, so a filing can display as försenad before the legal deadline has passed. And the SRP-ordlista of 5 september 2026 notes that the field recording when you became aware of an actively exploited vulnerability arrives only in a later release, while the severe-incident field records when the incident was detected. Since awareness, on the Commission's reading, follows an initial assessment reaching reasonable certainty, the platform will not hold the moment Article 14 measures from. Keep your own record.
What to do before 11 September
Three things still do not depend on the platform existing. Create the EU Login accounts for the primary and backup people now, because doing it mid-incident is a needless delay. Build the 24 hour early warning as a short internal form matching ENISA's mandatory fields, and name the two people who can complete it out of hours. And confirm which products are in scope, since the 72 hour stage asks for product type and Annex III or IV category: our Klassificeringsverktyget besvarar det, och läget just nu tracker keeps the dates current.