One CRA report now reaches every member state where the product is available

Somebody has to hold the login. ENISA's FAQ, updated 12 September 2026, covers the platform's purpose, reporting process, registration and use ^[15][20], and the routing question inside it is answered by corporate structure: the submitter selects a CSIRT designated as coordinator, and in general that is the national CSIRT determined by the manufacturer's main location of establishment under Article 14(7) ^[5]. A group with a Dutch sales entity and engineering in Poland has to decide which one is the manufacturer of record. Then it has to make sure named people hold working credentials for that account. That is work for legal and for whoever runs access reviews, and it is due before the first report.

The trigger is narrower than a bug queue. ENISA describes an actively exploited vulnerability as one for which there is reliable evidence that it has been exploited by a malicious actor ^[13], and a severe incident as one having a severe impact on a product's security, for example compromising its availability, authenticity, integrity or confidentiality ^[14]. Where the line falls in a specific case is not a platform question; the page points readers to the European Commission's FAQs on CRA implementation for interpretation and implementation guidance ^[16].

Article 16(1), quoted on the page, says that for notifications under Articles 14 and 15 "a single reporting platform shall be established by ENISA", and that the architecture "shall allow Member States and ENISA to put in place their own electronic notification end-points" ^[8][9]. Live today is the Article 14 mandatory half. Voluntary reporting under Article 15 is named in the legal basis and deferred to a future phase of the platform ^[10][18]. The one timing lever already written down is a Commission Delegated Regulation from December 2025, which sets the conditions under which dissemination of a notification may be delayed ^[12].

For open-source stewards the same clock starts later. From 11 September 2026 to 11 December 2027 is fifteen months ^[17]. In that window an exploited vulnerability in an open-source component shipped inside a commercial product is the manufacturer's to notify under Article 14, while the steward upstream has nothing due through the platform ^[19].

So: four fields, one row per product line you place on the EU market. The legal entity that is the manufacturer. Its main establishment. The coordinating CSIRT that follows from it. The two or three named people who can file on a Sunday. Any cell still empty is one you will be filling in when you already have reliable evidence of exploitation in hand.