As of: 11 Sep 2026
Summary
ENISA has launched the initial operating capability of the Single Reporting Platform for manufacturer reports.
What happened?
ENISA has launched the initial operating capability of the Single Reporting Platform. It supports manufacturers reporting actively exploited vulnerabilities and severe security incidents. The relevant manufacturer reporting obligations apply from 11 September 2026; the main further CRA requirements apply from 11 December 2027.
Why does it matter?
Under the Cyber Resilience Act, manufacturers of digital products face concrete reporting duties. The platform is the central reporting channel.
Who is most affected?
Manufacturers and distributors of products with digital elements – including small software vendors and device makers.
What does it mean for businesses?
Affected manufacturers should check responsibilities, reporting channels and deadlines against official guidance. This is not a blanket obligation for every business.
What can you do now?
- 1Check whether your products fall under the CRA
- 2Define an internal process for vulnerability reports
- 3Note 11 December 2027 for further obligations
Editorial assessment
Our conclusion
For small businesses that make digital products, the main takeaway is that reporting duties already apply and an internal reporting process is needed now. For pure users little changes immediately.
Source
ENISA · Source date
Status / reviewed on: