Finland's NCSC-FI publishes an operational manufacturer checklist for the EU Cyber Resilience Act's 24h/72h/14-day/1-month reporting clock, two weeks before the 11 September 2026 go-live
NCSC-FI supplies the CRA reporting deadlines the Commission's own guidance had left unstated
Analysis
The EU Cyber Resilience Act's reporting obligations bind from 11 September 2026, requiring manufacturers of "products with digital elements" placed on the EU market to report actively exploited vulnerabilities and severe incidents through ENISA's centralised Single Reporting Platform (SRP) (NCSC-FI / Traficom, 2026-08-28). On 2026-08-28, with two weeks left before the obligation binds, NCSC-FI published a manufacturer checklist supplying the concrete notification clock: an early warning within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or severe incident, supplemented within 72 hours; for a vulnerability, a final report within 14 days after a corrective or mitigating measure becomes available; for a severe incident, a final report within one month of the incident notification (NCSC-FI / Traficom, 2026-08-28). ENISA's own FAQ for the platform independently states the identical clock (ENISA, 2026-08-31). The SRP became operational on 11 September 2026, the same date the reporting duty started to apply, and is reached at portal.cra-srp.enisa.europa.eu through a personal EU Login account with multi-factor authentication (ENISA, updated 2026-09-17). NCSC-FI's checklist directs manufacturers to identify in-scope products now, noting that products past end-of-life and no longer receiving updates remain subject to the reporting obligation, appoint an Assigned Representative (AR) authorised to submit SRP notifications, document an internal report-intake and triage process, and rehearse it at least once before the first reportable case (NCSC-FI / Traficom, 2026-08-28). ENISA's own FAQ states a manufacturer may register one Primary AR and up to 20 Secondary ARs, and that a representative whose manufacturer association is not yet verified may still submit up to 20 notifications for that manufacturer before verification becomes mandatory, so an organisation does not have to wait for verification to complete before filing its first report under time pressure (ENISA, updated 2026-09-17). NCSC-FI's own checklist instead describes notifications as submittable only through two named representatives, a narrower figure than ENISA's; the two authorities have not been reconciled, and ENISA's FAQ is treated as the more current statement of the platform's own rules (NCSC-FI / Traficom, 2026-08-28). API-based submission is not expected until spring 2027 per NCSC-FI, and ENISA's own FAQ states only that "no Application Programming Interface (API) will be provided at the initial release of the SRP" and that one may follow in a later phase, without a target date, so any automated vulnerability-management or SBOM-correlation pipeline still has to terminate at a manual web-portal boundary for every notification filed before that changes (NCSC-FI / Traficom, 2026-08-28; ENISA, 2026-08-31). The reporting duty is not limited to products launched after 11 September 2026: legal analysis of Article 69(3) CRA confirms it applies from that date to every in-scope product already placed on the EU market (Hogan Lovells Cadwalader, 2026-06-10), and NCSC-FI's own checklist states products past end-of-life and no longer receiving updates remain subject to the obligation regardless (NCSC-FI / Traficom, 2026-08-28).
Cited evidence
For an actively exploited vulnerability or a severe incident, an early warning must be submitted within 24 hours of the manufacturer becoming aware of it. The notification must be supplemented within 72 hours.
For a vulnerability, the final report must be submitted within 14 days after a corrective or mitigating measure becomes available. For a severe incident, the final report must be submitted within one month of the incident notification.
Notifications are expected to be possible through APIs from spring 2027. After this, notifications can be submitted directly from the organisation's own system.
The platform has become operational on 11 September 2026, coinciding with the date on which the CRA reporting obligations under Art.14 are applicable.
However, no Application Programming Interface (API) will be provided at the initial release of the SRP, so notifications must be submitted through the platform interface.
ARs whose manufacturer association has not yet been verified may submit up to 20 notifications for that manufacturer before verification becomes mandatory.
In the current release, the 72-hour counter displays a due date/time 48hrs after submission of the 24-hour Early Warning.
Notably, the reporting obligations apply from 11 September 2026 to all products with digital elements within the CRA's scope that have been made available on the EU market before full CRA application (Art. 69(3) CRA).
As of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements.
ENISA has established the CRA Single Reporting Platform (SRP), operational as of 11 September 2026.
From 11 September 2026, manufacturers are required to submit these mandatory notifications through the SRP.
The EU Agency for Cybersecurity (ENISA) has deployed the initial operating capability of the Single Reporting Platform (SRP).
Der Bitkom kritisiert insbesondere, dass Unternehmen die Meldeplattform vor deren Start nicht registrieren und die Prozesse nicht erproben konnten. Die Plattform ging erst mit Beginn der Meldepflicht online. (translated from German: Bitkom specifically criticizes that companies could not register on the reporting platform or test their processes before its start. The platform only went online with the start of the reporting obligation.)
Updates4
ENISA's own Single Reporting Platform FAQ, updated 31 August 2026, now independently states the same 24-hour/ 72-hour/14-day/1-month notification clock this entry previously sourced to NCSC-FI alone (ENISA, 2026-08-31). The Assigned Representative cap this entry previously described as "two" is corrected: ENISA's FAQ states a manufacturer may register exactly one Primary AR and up to 20 Secondary ARs, and that a non-validated AR can submit up to 20 notifications before validation becomes mandatory (ENISA, 2026-08-31). Eight days before the 11 September go-live, the platform still has no published URL and the FAQ confirms no API will exist at launch, without stating a specific date for one; the spring-2027 API target remains NCSC-FI's own claim, not independently corroborated (ENISA, 2026-08-31). Legal analysis of Article 69(3) CRA confirms the reporting duty applies from 11 September 2026 to every in-scope product already on the EU market (Hogan Lovells Cadwalader, 2026-06-10), consistent with NCSC-FI's own checklist, which states products past end-of-life and no longer receiving updates remain subject to the obligation regardless (NCSC-FI / Traficom, 2026-08-28). The SRP will be available in English only at launch (ENISA, Single Reporting Platform (SRP) FAQ, 2026-08-31).
The obligation this entry has tracked ahead of go-live is now in legal effect: the European Commission's own page states plainly, "as of 11 September 2026, manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements" (European Commission, 2026-07-31). This covers every in-scope product already placed on the EU market before today, not only new ones, consistent with Article 69(3) CRA as this entry already recorded. Neither the Commission's page nor ENISA's own SRP page states that the platform is confirmed live and accepting submissions today; the Commission's page says only that "the Single Reporting Platform will be operational by 11 September 2026 (date of entry into application of the CRA reporting requirements)" and that "functional and security testing are under way" (European Commission, 2026-07-31), while ENISA's own SRP page states that "from 11 September 2026, manufacturers are required to submit these mandatory notifications through the SRP" without an explicit operational-status confirmation (ENISA, 2026-09-10). This entry therefore scopes its claim to what is independently confirmed (the legal reporting obligation is in effect) rather than to platform operational status, which no source reached has confirmed either way as of today.
The open point above is resolved: ENISA confirmed on 2026-09-11 that "the EU Agency for Cybersecurity (ENISA) has deployed the initial operating capability of the Single Reporting Platform (SRP)" (ENISA, 2026-09-11), manufacturers and, from 11 December 2027, open-source software stewards submit once through the platform and the receiving CSIRT disseminates the notification to every other Member State CSIRT where the affected product is available, simultaneously to ENISA. A Bitkom survey of 1,003 German firms, relayed the same day by heise online, found only 29% know what the CRA means for their own organization and a further 38% have heard of it but cannot assess the impact; Bitkom specifically criticizes that manufacturers could not register on the platform or test their reporting process before today, "because the platform only went online with the start of the reporting obligation" (translated from German) (heise online, 2026-09-11). For a Swiss manufacturer or distributor placing networked products on the EU market, or a Swiss public-sector body procuring from an EU-regulated manufacturer now subject to this clock, the practical takeaway is that the 24-hour/72-hour/14-day-or-1-month reporting chain is a live obligation rather than a target date, and a first submission may hit friction precisely because pre-launch registration and testing were not possible.
The European Commission's own CRA reporting page now also confirms the launch: "ENISA has established the CRA Single Reporting Platform (SRP), operational as of 11 September 2026" (European Commission, updated 2026-09-11). The page previously gave 11 September 2026 as the target date with testing under way, which is the wording quoted in the 2026-09-11 section above.
ENISA's FAQ, revised on 17 September, now also answers the questions this entry left open before launch. The platform is at portal.cra-srp.enisa.europa.eu and each Assigned Representative signs in with a personal EU Login account with multi-factor authentication. No API exists at the initial release, and ENISA says only that one may be considered in a future phase. One operational detail matters for the reporting clock: "In the current release, the 72-hour counter displays a due date/time 48hrs after submission of the 24-hour Early Warning", so the platform can mark a notification overdue before 72 hours have passed since the manufacturer became aware. ENISA says a later release will count from the awareness time instead (ENISA, updated 2026-09-17).
Sources7
Revision history
- Published 2026-08-29T0409Z-intel
- Update 2026-09-03T0410Z-intel
ENISA's own Single Reporting Platform FAQ (updated 31 August 2026) independently confirms the 24h/72h/14-day/ 1-month notification clock this entry previously attributed to NCSC-FI alone, and corrects the Assigned Representative cap from "two" to one Primary plus up to 20 Secondary ARs. Eight days before the 11 September go-live, the FAQ still gives no published platform URL and confirms no API will exist at launch, so an automated reporting pipeline must still terminate at a manual web-portal boundary within the 24-hour window.
Changed: sources evidence sourcing_note summary body
- Update 2026-09-11T0410Z-intel
The reporting obligation this entry tracked ahead of go-live is now in legal effect: as of 2026-09-11, CRA Article 14 mandatory reporting binds every in-scope manufacturer, including products already on the EU market before this date. Neither the European Commission's own page nor ENISA's SRP page states the platform is confirmed live and accepting submissions today, only that this was ENISA's operational target, recorded as an open point rather than asserted.
Changed: summary sourcing_note body sources evidence tags
- Update 2026-09-12T0409Z-intel
ENISA confirmed on 2026-09-11 that the CRA Single Reporting Platform has deployed its initial operating capability, resolving the open point the prior update recorded. A Bitkom survey, relayed the same day by heise online, finds only 29% of German firms understand what the CRA means for their organization and that manufacturers could not register or test their reporting process before the platform went live with the reporting obligation itself.
Changed: sourcing_note sources evidence body
- Improvement 2026-09-29T2134Z-audit
The European Commission's CRA reporting page now states that ENISA has established the Single Reporting Platform, operational as of 11 September 2026, a second authority confirming the launch ENISA announced on 2026-09-11. ENISA's FAQ, revised on 17 September, now gives the platform address and the EU Login multi-factor requirement, rewords the no-API and unverified-representative answers, and warns that the platform's 72-hour counter currently shows the deadline 48 hours after the early warning. The main analysis and the cited evidence follow both pages' current text instead of the pre-launch wording. The sourcing note quotes the FAQ's current wording, and the Commission citation carries the page's 11 September update date.
Changed: evidence sourcing_note body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.