ENISA Launches Single Reporting Platform for Actively Exploited Vulnerabilities Under Cyber Resilience Act
The EU Agency for Cybersecurity (ENISA) has launched its Cyber Resilience Act (CRA) Single Reporting Platform, centralizing the reporting of actively exploited vulnerabilities and severe incidents for products with digital elements.
The European Union Agency for Cybersecurity (ENISA) has officially launched its Cyber Resilience Act (CRA) Single Reporting Platform, a crucial new tool designed to streamline the reporting of cybersecurity threats impacting products with digital elements sold within the EU. The platform went live on September 11, 2026, coinciding precisely with the effective date of the CRA's new binding reporting obligations for manufacturers.
This centralized portal, built and operated by ENISA as mandated by Article 16(1) of the CRA, serves as a single point of contact for reporting actively exploited vulnerabilities and severe cybersecurity incidents. Manufacturers, importers, and distributors of products with digital elements are now required to use this platform to notify authorities about such events, ensuring a more unified and timely response to emerging threats across the European market.
The Cyber Resilience Act itself, which came into force earlier in 2026, aims to enhance the security of digital products throughout their lifecycle. It places significant responsibilities on manufacturers to ensure their products meet stringent cybersecurity requirements, including secure design, development, and maintenance practices. The reporting obligations are a key component of this framework, designed to provide regulators and security researchers with critical information about real-world threats.
Under the new regulations, manufacturers must report any actively exploited vulnerability or severe incident within 24 hours of becoming aware of it. This rapid reporting requirement is intended to allow for swift analysis and dissemination of threat intelligence, enabling other companies and end-users to take necessary protective measures. The platform's design emphasizes ease of use and efficient data submission to facilitate compliance.
The launch of the Single Reporting Platform is a significant step towards a more coordinated cybersecurity posture within the EU. By consolidating incident and vulnerability reports, ENISA can gain a clearer overview of the threat landscape affecting digital products, identify trends, and develop more effective strategies to mitigate risks. This centralized approach is expected to improve the overall resilience of the EU's digital economy.
While the platform focuses on products placed on the EU market, its implications extend globally. Companies that export digital products to the EU will need to ensure their products comply with the CRA's requirements and that their reporting mechanisms are aligned with the new platform. This initiative underscores the EU's commitment to bolstering cybersecurity standards and fostering a more secure digital environment for consumers and businesses alike.
The successful implementation and adoption of the CRA Single Reporting Platform will be critical in achieving its objectives. ENISA will likely play a key role in analyzing the data received, providing guidance to industry, and collaborating with national cybersecurity authorities to address the reported vulnerabilities and incidents effectively. The agency's ongoing efforts will be vital in ensuring the platform contributes meaningfully to the EU's cyber resilience.