One Report, Many Authorities

The CRA’s Single Reporting Platform is designed to solve a coordination problem: a manufacturer may sell one connected product across several Member States, but a qualifying vulnerability or incident can affect users and authorities in all of them. This chapter explains how the platform chooses a national entry point, how one submission reaches the relevant parts of the Union’s cybersecurity network, and why controlled dissemination can be delayed without delaying the manufacturer’s initial duty. The practical judgment is to understand what “report once” removes—and what it leaves the manufacturer responsible for.

One route, not one recipient

Article 16 establishes a single reporting platform for mandatory Article 14 notifications and voluntary Article 15 notifications. ENISA establishes the platform and manages its day-to-day operation. The architecture allows Member States and ENISA to put in place their own electronic notification endpoints. The result is a shared route with distributed responsibility, not a single office that replaces national cybersecurity teams.

For a manufacturer with a main establishment in the Union, Article 14(7) selects the endpoint of the designated coordinator CSIRT in the Member State where that main establishment is located. A coordinator CSIRT is the national computer security incident response team designated to coordinate these matters. The notification is submitted through the platform using that endpoint and is simultaneously accessible to ENISA.

The CRA gives “main establishment” a functional meaning. It is the Member State where decisions related to the cybersecurity of the manufacturer’s products are predominantly taken. If that Member State cannot be determined, the main establishment is considered to be where the manufacturer has the establishment with the highest number of employees in the Union. The legal answer therefore does not necessarily follow the address of the group headquarters, the place where a sales contract was signed, or the location of the server receiving an alert. It follows product-security decision-making, with an employee-count fallback.

That rule is an interface between corporate organization and regulatory coordination. A manufacturer may have security engineers in one country, legal and product leadership in another, and customers throughout the Union. The endpoint question asks which Member State is the proper first coordinator, not which country has the largest customer population. The manufacturer needs a documented answer before an urgent event, because deciding the endpoint during the first 24 hours consumes time that should be spent describing the event.

The platform does not require the manufacturer to send a separate initial notification to every Member State where a product is available. After the coordinator CSIRT initially receives a report, it disseminates the notification without delay through the platform to the coordinator CSIRTs in the Member States where the manufacturer has indicated that the product with digital elements has been made available. Those national teams can then provide the necessary information to their market-surveillance authorities.

This is the useful meaning of a single submission. It reduces duplicated filings and gives the notification a coordinated path. It does not reduce the need to identify the product accurately, state where it was made available, update the staged notification, communicate with users, or respond to requests from the coordinating authorities. “Report once” is about the route across authorities, not about sending one message and closing the case.

When there is no Union main establishment

The CRA also provides an ordered route for a manufacturer without a main establishment in the Union.