CRA reporting checklist
What to have in place before an actively exploited vulnerability turns up in your product. Reporting has been mandatory since 11 September 2026.
Set up now
- Who reports. One person who submits reports, and at least one who stands in when they're away. On ENISA's platform these are the primary and secondary representatives.
- EU Login with multi-factor authentication for each of them. The reporting platform requires it.
- Your company on ENISA's Single Reporting Platform, linked to the CSIRT of the EU country where your company has its main establishment: NCSC for the Netherlands, CCB for Belgium.
- A component list per product: names and versions, as a spreadsheet or an SBOM. Without it you can't tell when you're affected.
- Where each product is sold. The early warning asks in which EU countries the product is available.
- How you reach your users: a channel and a short template. You also have to tell affected users what they can do.
When a component is actively exploited
The clock starts when, after a first assessment, you're reasonably certain the vulnerability is being exploited. Each report goes through the platform to your CSIRT and to ENISA at the same time.
- 24 hours
- Early warning. Say in which EU countries the product is available, as far as you know.
- 72 hours
- Vulnerability notification: the product, the general nature of the exploit and the vulnerability, what you have done about it, what users can do, and how sensitive you consider the information.
- 14 days
- Final report, at the latest 14 days after a fix or workaround is available: a description of the vulnerability with its severity and impact, what is known about the attacker, and details of the security update or other fix.
- Users
- Tell affected users about the vulnerability and what they can do about it, in a machine-readable format where that makes sense.
Severe incidents that affect your product's security follow the same 24-hour and 72-hour steps, with the final report within one month.
Sources
This page is general information, not legal advice.