| Re: [orc-ai-sig] CRA reporting, SRP & ENISA advisory |
Dear ORC Community,In the email below you can find some news recently shared by the European Commission. Some of them we already knew them like the modifications in the guidance clarifying the stewards obligations. Some others can be especially relevant for the AI Policy and Compliance SIG and the interplay between the CRA and the AI Act.I kindly invite you to take a look to the resources and share your views or feedback.Best regards,Juan---------- Forwarded message ---------
From: CNECT-CRA@xxxxxxxxxxxx <CNECT-CRA@xxxxxxxxxxxx>
Date: Thu, 17 Sept 2026 at 17:32
Subject: CRA reporting, SRP & ENISA advisory
To: CNECT-CRA@xxxxxxxxxxxx <CNECT-CRA@xxxxxxxxxxxx>Dear CRA Network,
Please find below some updates of relevance for the implementation of the CRA.
Entry into application of CRA reporting obligations & ENISA Single Reporting Platform
On 11 September 2026, reporting obligations pursuant to Article 14 of the CRA entered into application. To this end, ENISA – working in close cooperation with the CSIRT Network - launched the CRA Single Reporting Platform. All the information about the SRP, including user guidance, FAQs, and training materials are available at this link: Single Reporting Platform (SRP) | ENISA. We would like to warmly thank ENISA for the work that went into this endeavour.
In line with ENISA’s advice, manufacturers are advised to register on the CRA SRP only when they need to submit a specific notification, rather than registering pre-emptively. Pre-registration is not a prerequisite for submitting a notification.
Further clarifications on reporting obligations are also contained in Section 9.1 of the Commission guidance on the CRA, as well as in Section 5 of the Commission's Frequently Asked Questions on the CRA implementation. The Commission webpage on reporting has also been updated accordingly. We draw your attention in particular to the following clarification, added in FAQ 5.5:
5.5 Are open-source software stewards subject to reporting obligations under the CRA?
Article 24(3) of the CRA establishes that reporting obligations laid down in Article 14, paragraphs (1), (3) and (8), apply to open-source software stewards under certain circumstances. In accordance with Article 71(2) of the CRA, Article 24(3) shall apply from 11 December 2027.
ENISA’s Draft Technical Advisory on AI-assisted software development
ENISA published for public consultation a draft Technical Advisory on AI-assisted software development: as they put it, AI-assisted software development is becoming standard practice, but functional code should not be confused with secure code. ENISA’s advisory also includes an agentic skill to help AI assistants make safer decisions when recommending, installing, updating, reviewing, or managing software packages and dependencies.
Please do not hesitate to provide feedback to ENISA. Deadline: 15 October 2026.
Best wishes,
CRA Team
Have you been forwarded this email? Sign up here.
You no longer wish to receive these updates? Please reply to this email and we will delete you from our database.