On 11 September 2026 the reporting obligations of the EU Cyber Resilience Act (CRA) began to apply. On the same day ENISA, the EU cybersecurity agency, put the CRA Single Reporting Platform (SRP) into service. This article summarizes what the official sources say, marks our own interpretation as such, and lists what they leave open.
What changed
According to ENISA, the SRP is an online tool for meeting CRA reporting duties. It has been deployed as an "initial operating capability", and ENISA says it plans to add functions over the coming months based on operational experience and user feedback. From 11 September 2026, manufacturers of products with digital elements must report two things: actively exploited vulnerabilities and severe incidents that affect the security of their products.
The European Commission's CRA reporting page sets out the timeline:
- Early warning: within 24 hours of the manufacturer becoming aware.
- Notification: within 72 hours.
- Final report for vulnerabilities: no later than 14 days after a corrective measure is available.
- Final report for severe incidents: within one month of the 72 hour notification.
How reports are routed
The Commission page says manufacturers report only once, through the SRP. The report goes to the CSIRT (computer security incident response team) of the country where the manufacturer has its main establishment. Unless exceptional circumstances apply, ENISA receives it at the same time. That CSIRT then passes it on without delay to the CSIRTs of the other member states where the product was made available. In exceptional cases, on justified cybersecurity grounds, a CSIRT may delay this dissemination. The Commission page refers to a delegated act of 11 December 2025 that specifies the conditions.
ENISA's FAQ, last updated 15 October 2026, adds practical details. Manufacturers pick the coordinating CSIRT themselves, and a wrong choice can invalidate the notification. Access is through named representatives with an EU Login account and multi-factor authentication. At launch there is no API and no voluntary reporting. The platform is available in English only, while ENISA is translating its factsheet and reviewing more platform languages.
Who is covered, and what comes later
Reporting by open-source software stewards, under Article 24(3), applies from 11 December 2027, and only to the extent they are involved in developing such products. ENISA's announcement states that the CRA's main cybersecurity requirements also apply from 11 December 2027. So only the reporting duty is in force today. The wider product requirements are not.
Why it matters in a plant
The following is our interpretation, not a statement from the sources. PLCs, gateways, edge devices and SCADA components are products with digital elements. Their vendors must now report exploited vulnerabilities, so operators can reasonably expect more advisories, possibly with short lead times. A 24 hour early warning goes to authorities, and the sources do not say when or how affected customers will be told. Operators should not assume the vendor notice reaches them automatically.
Practical steps that follow from this reading:
- Keep an asset inventory with vendor, product and firmware version, so an advisory can be matched quickly.
- Name who receives vendor advisories and who decides on patching or compensating measures.
- Add CRA clauses to procurement: how the vendor will notify you of exploited vulnerabilities, and how long it will support the product.
- Check your own role. A plant that builds its own gateway or data logger, or supplies software or hardware to others, may count as a manufacturer. The sources do not define this boundary for individual cases, so legal review is advisable.
The FAQ says non-manufacturers should contact a national CSIRT directly, as the SRP is for manufacturers' notifications.
What the sources do not say
They do not explain how manufacturers must inform users, how the duty applies to products already installed, or what penalties apply. They also do not state how an operator's own incident reporting duties under other EU rules interact with the CRA. Operators should check those points against the legal text and national guidance.