Re: [open-regulatory-compliance] Fwd: CRA updates - SMEs, reporting plat

[Steffen Zimmermann <steffen.zimmermann@xxxxxxx>]

Dear Dave,

Public info can be found here, although the „electronic submission“ is cryptic wording for a webform 😉

https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp

How does the Single Reporting Platform operate?

Manufacturers submit notifications electronically through the platform, which automatically routes them to the designated CSIRT coordinator (based on the manufacturer's main establishment) and ENISA simultaneously. The CSIRT then disseminates the information without delay to other relevant CSIRTs in Member States where the product is available, and to market surveillance authorities as needed. For sensitive reports, dissemination may be delayed on security grounds, with ENISA informed and able to recommend broader sharing if risks are systemic. The platform incorporates security measures to protect confidentiality. 

Who receives the reports submitted to the platform?

As a general rule, when a manufacturer submits a report to the CRA SRP, it is simultaneously notified to:

• The CSIRT (Computer Security Incident Response Team) designated as the coordinator in the Member State where the manufacturer is established.
• ENISA (unless particularly exceptional circumstances apply).

The CSIRT designated as coordinator that initially receives the notification is then responsible for disseminating it without delay to other relevant CSIRTs across the EU via the platform.

Viele Grüße,

 

Steffen Zimmermann

Industrial Security @ VDMA

 

 

 

Von: open-regulatory-compliance <open-regulatory-compliance-bounces@xxxxxxxxxxx> im Auftrag von Dave Russo via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx>
Datum: Freitag, 13. Februar 2026 um 18:14
An: open-regulatory-compliance@xxxxxxxxxxx <open-regulatory-compliance@xxxxxxxxxxx>
Cc: Dave Russo <drusso@xxxxxxxxxx>
Betreff: Re: [open-regulatory-compliance] Fwd: CRA updates - SMEs, reporting platform and FOSS attestations

Thank you for this additional information - has this been stated anywhere publicly?

Thanks,
Dave

On 2/13/26 12:04 PM, Steffen Zimmermann via open-regulatory-compliance wrote:

Dear all,

Most interesting point is about the Single Reporting Platform. After talking with ENISA, is is clear that in September we will only have a web dashboard secured with the EU Login where manufacturers (or others) can report vulnerabilities manually via a standardized form.

An API is under construction but will not be ready before 2027.

Anyhow, the good news is that there will only be one reporting system, not many. So, no national portals for reporting vulnerabilities. This will be handled by the SRP.

Viele Grüße,

 

Steffen Zimmermann

Industrial Security @ VDMA

 

 

 

Von: open-regulatory-compliance <open-regulatory-compliance-bounces@xxxxxxxxxxx> im Auftrag von Juan Rico via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx>
Datum: Freitag, 13. Februar 2026 um 17:51
An: Open Regulatory Compliance Working Group <open-regulatory-compliance@xxxxxxxxxxx>
Cc: Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>
Betreff: [open-regulatory-compliance] Fwd: CRA updates - SMEs, reporting platform and FOSS attestations

Dear ORC Community,

find below the email sent to the CRA Network by the European Commission. It includes very useful information for SMEs and the single reporting platform, as well as the link to the survey shared few days ago by our colleagues of FSFE.

Have a great weekend,

Juan

---------- Forwarded message ---------
From: CNECT-CRA@xxxxxxxxxxxx <CNECT-CRA@xxxxxxxxxxxx>
Date: Fri, 13 Feb 2026 at 17:45
Subject: CRA updates - SMEs, reporting platform and FOSS attestations
To: CNECT-CRA@xxxxxxxxxxxx <CNECT-CRA@xxxxxxxxxxxx>

Dear CRA Network,

 

Please find below some updates that may be of interest in relation to the implementation of the Cyber Resilience Act (CRA).

 

ENISA SME Cyber Resilience Act Survey

A few days ago, ENISA launched a survey for SMEs with the aim to understand the overall level of CRA awareness amongst SMEs, how ready and mature they feel for it, and what kind of support they would find most useful. The results will provide input to ENISA and the Commission on measures to best support SMEs in their CRA implementation efforts. Please participate in the survey where relevant and / or share it with you contacts!

https://url.avanan.click/v2/r02/___https://ec.europa.eu/eusurvey/runner/CRASMESurvey___.YXAxZTp2ZG1hOmE6bzpjZGQ4MGJlOTdhM2MwMGE5NmNhYzQ5YjU1ZjQ3MWExYjo3OjkwYzM6OWMxOGRiNWU2ZmMwNTRlY2ZiNjg0ZWE0OWQ4Mzk4ZjM4MmZkZGEyYzA5N2JhZjk2ZGY3M2VjNGYwNjQ2NWM3ODp0OlQ6Rg

 

ENISA CRA SRP

Under the CRA, ENISA is responsible for establishing and operating the CRA Single Reporting Platform. Today, ENISA launched a new webpage with frequently asked questions on reporting obligations and the development of the Single Reporting Platform.

Single Reporting Platform (SRP) | ENISA

 

Survey on voluntary attestations for free and open-source software

The German Federal Office for Information Security (BSI) and the Free Software Foundation Europe (FSFE) have put together a survey to gather input on how voluntary security attestation programmes for open-source software could work under Article 25 of the Cyber Resilience Act. The survey is open until 28 February.

CRA Article 25 — Attestation for Open-Source Software

 

We take the occasion to wish you a pleasant weekend.

 

Best wishes,
CRA Team

_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org