|
|
Reporting obligations in force since 2026-09-11
|
CRA Watch
Monthly CRA briefing, verified against official sources · Issue 2 · 2026-09-30
|
| |
|
This issue at a glance
On 11 September the CRA reporting obligations took effect and ENISA, the EU Agency for Cybersecurity, opened its Single Reporting Platform (SRP). Here are three things to know this month:
| 1 | The SRP's 72-hour deadline is calculated differently from the legal one.
The law counts 72 hours from when you became aware of the incident or exploited vulnerability, while the screen counts 48 hours from when you submitted the early warning. If you submitted the early warning within 24 hours, the on-screen deadline is the same as or earlier than the legal one.→ Submit by whichever deadline comes first, and keep your own record of when you became aware. |
| 2 | To add backup reporters, your CSIRT must first verify your main reporter.
Before you can add a backup reporter (Secondary AR), your national CSIRT must verify that the main reporter represents your company ("Verified"). How long that takes varies by CSIRT, and registering itself can wait until you have something to report.→ If you want several people able to report — to cover holidays or staff changes — register early and get verified. |
| 3 | Which country you report to is set by an order laid down in the law.
If you have a main establishment in the EU, it is that country; if not, look in turn at where your authorised representative, importer and distributor are established, and finally at where most users are (CRA Art 14(7)). Pick the wrong one and the notification may be invalidated and need to be resubmitted.→ Before registering on the platform, confirm your company's CSIRT and write down your reasoning. |
|
|
|
24 hours
Early warning
|
72 hours
Notification
|
Final report
Vulnerabilities: within 14 days after a corrective or mitigating measure is available
Incidents: within 1 month after the 72-hour notification
|
The 24- and 72-hour clocks start the moment you become aware (CRA Art 14). The platform itself is in English only.
|
| This issue's lead |
TOP STORY |
Don't take the SRP's 72-hour deadline on screen at face value
The platform shows the deadline for the 72-hour notification as "early warning submitted + 48 hours", not "became aware + 72 hours". ENISA says so itself in its FAQ and plans to fix it, but has given no date.
So the screen can flag a notification as overdue before the legal 72 hours are up, and ENISA states the display does not replace your responsibility to meet the legal deadline.
What to do now
| – | Record the time you became aware of the incident or exploitation in your own records. The legal deadlines count from there. |
| – | Set the 72-hour notification against whichever comes first: 72 hours after awareness, or 48 hours after you filed the early warning. Ireland's CSIRT makes the second one a must (see Headlines). |
| – | There is no on-screen counter yet for a vulnerability's final report. Calculate the 14 days from when a corrective or mitigating measure is available yourself. |
Source: ENISA SRP FAQ (2026-09-17 version) Q26 · Ireland NCSC guidelines (2026-08-31) · CRA Art 14 — checked against the originals 2026-09-28
|
|
ENISA calls the person who files notifications on the platform an "Assigned Representative" (AR) — a platform term distinct from the "authorised representative" under CRA Art 18: the staff member who logs in and enters notifications for the company. Each manufacturer can have one Primary AR and up to 20 Secondary ARs. From ENISA's FAQ (17 September version, 32 questions):
Can another AR pick up a notification someone else filed?
→ Yes. ARs of the same manufacturer can view and update it whoever filed it. Drafts, however, are visible only to their author, so write the pre-submission text in an internal template. We have not checked the live screen.
When can a Secondary AR be invited?
→ Only once the Primary AR's association with the manufacturer shows as "Verified". An AR can also only remove an association themselves after verification; a misspelt manufacturer name is fixed by registering again.
Should we register in advance?
→ ENISA advises registering when you need to notify. Registration takes minutes, and an AR not yet verified can file up to 20 notifications for that manufacturer. But if you want more than one AR, registering early works in your favour.
What if we pick the wrong CSIRT?
→ The notification may be invalidated and need to be resubmitted to the correct one.
Do we report exploitation we knew about before 11 September?
→ No. But if you become aware after 11 September, even an old vulnerability is reportable.
If the platform is down, does an email do instead?
→ No. If urgent you may contact your CSIRT directly, but you must still submit through the platform once it is back.
Is the interface available in other languages?
→ No, English only.
Source: ENISA SRP FAQ (2026-09-17 version) Q9·Q13·Q18·Q24·Q25·Q32 · ENISA AR User Manual v1.1 4.6.1 · Note: ENISA "AR Interface functions" (2026-09-12 version) describes pick-up differently — checked against the originals 2026-09-28
|
🇮🇪 Ireland's CSIRT publishes CRA reporting guidelines 31 Aug · 11 Sep
Ireland's National Cyber Security Centre (NCSC) has published guidelines on the CRA reporting obligations. Once the early warning is filed, the detailed notification must follow within 48 hours of it, and pre-registration on the platform is not necessary.
→ If Ireland is your CSIRT, set the 72-hour notification deadline at "early warning + 48 hours".
Source: Ireland NCSC, "Guidelines on reporting obligations under Article 14 of the CRA" (2026-08-31) · the guidelines state they may not be cited as evidence of compliance — checked against the original 2026-09-25
📘 Commission CRA implementation FAQ, version 1.4 4 Sep
The Commission FAQ that ENISA points to for interpreting the reporting obligations has been revised (adding an item on open-source stewards). Products placed on the market before 11 December 2027 must also be notified (other obligations are not required by the CRA, but the duty to inform users remains), and a component vulnerability that cannot be exploited in your own product is not subject to mandatory reporting (the duty to tell the component's maker remains).
→ Include products already on the market in your reporting scope.
Source: European Commission, "FAQs on the Cyber Resilience Act" v1.4 (2026-09-04) 5.3·5.4·5.5 · CRA Art 14(8) · Art 13(6) · the document states it is not the Commission's official position — checked against the original 2026-09-24
📍 Coordinator CSIRTs for all 27 Member States published 4 Sep · 10 Sep
ENISA has published contacts for the national CSIRTs (coordinators) of all 27 Member States. Your CSIRT is the one where your EU main establishment is; without one, it is ① where the authorised representative acting for the most products is established ② where the importer placing the most products on the market is established ③ where the distributor making the most products available is established ④ where most users are.
→ Document the result and your reasoning.
Source: ENISA, "List of CSIRTs Designated as Coordinators" (updated 2026-09-10) · CRA Art 14(7) · ENISA SRP FAQ (2026-09-17 version) Q18 — checked against the originals 2026-09-28
🗂️ One new field in the glossary — same version number 25 Sep
ENISA's glossary kept version number 1.3 but added a field, "Date and time when the Actively Exploited Vulnerability occurred (UTC)". It is required in the 72-hour notification (optional in the early warning) and differs from the time you became aware, but ENISA's example also describes it as when the vulnerability began to exist, so what to enter is not yet clear.
→ Add a line for when the exploitation or vulnerability arose to your incident record.
Source: ENISA SRP Glossary Version 1.3 (last update 2026-09-25, compared with the 2026-09-10 version) · not checked on the live entry screen — checked against the originals 2026-09-28
|
|
Once a harmonised standard is cited in the EU Official Journal, products that follow it are presumed to meet the CRA security requirements (Annex I).
| CRA harmonised standards cited in the OJ |
🔴 0 |
Assess directly against Annex I |
| Notified Bodies (third-party conformity assessment) list |
🔴 none yet |
Member States to strive for a sufficient number by 11 December 2026 (Art 35(2)) |
| Horizontal standards FprEN 40000-1-1·1-2 |
🟡 under approval (FprEN) |
Next stage expected 2026-10-01 |
| Vulnerability handling prEN 40000-1-3 |
🟡 under approval |
— |
→ The requirements are already fixed without harmonised standards. Risk assessment, vulnerability handling and documentation can be prepared today.
Source: EC "CRA standardisation" and "CRA conformity assessment" pages (updated 2026-07-31, checked 2026-09-28) · CEN/CLC/JTC 13/WG 9 work programme (checked 2026-09-03) · CRA Art 35(2)
|
|
The next issue follows next month — if nothing changed, we won't send.
If you found this briefing useful, forward it to a colleague.
|
|
Get this briefing by email
Monthly · free · no tracking pixels — if nothing changed, we won't send.
Subscribe to CRA Watch →
|
|
|
CRA Watch is published by ACE LABS Co., Ltd. — an independent advisory firm supporting Korean manufacturers with CRA compliance.
|
|
This page is the web edition of CRA Watch, our email briefing.
This newsletter is provided for general information and is not legal advice.
Its content is verified against official sources (EUR-Lex · EC · ENISA · CEN official DB · national CSIRTs) as of the publication date.
ACE LABS Co., Ltd. · CEO Minseok Ro · Business reg. no. 273-81-03550
17, Gukjegeumyung-ro 2-gil, Yeongdeungpo-gu, Seoul (Citiplaza #444) · ceo@acelabs.co.kr · www.acelabs.co.kr
© 2026 ACE LABS. All rights reserved.
|
|
