CRA Single Reporting Platform (SRP)

The Single Reporting Platform (SRP)

The Single Reporting Platform (SRP) is an online tool ENISA operates and maintains to receive the vulnerability and incident reports required under Articles 14 and 15 CRA, implementing the reporting mechanism specified in Article 16(2) CRA. Manufacturers of products with digital elements, and Assigned Representatives submitting on their behalf, use the SRP to report actively exploited vulnerabilities and severe incidents; the obligation applies to manufacturers from 11 September 2026 and extends to open-source software stewards from 11 December 2027. The platform operates on a single-entry model: a report submitted once is routed by a designated CSIRT coordinator to the relevant national CSIRTs and to ENISA, so it reaches all competent recipients across Member States without duplicate filings. Access is provided through a dedicated portal with access-control and confidentiality safeguards. Supporting materials include an Assigned Representative user manual, tutorial videos, registration and submission guidance, an explanation of interface functions, a glossary of SRP data fields, an FAQ section, and terms and conditions. The platform implements the reporting mechanism established by Articles 14, 15 and 16 CRA rather than creating new substantive reporting obligations of its own.