ENISA SRP for the CRA: Registration, Roles and the Rules That Trip People Up
Updated 20 September 20264 min read
Since 11 September 2026, every Article 14 report under the Cyber Resilience Act goes through ENISA's Single Reporting Platform (SRP). Before anyone in your company can file, someone has to be registered as an Assigned Representative, or AR.
This page explains how the roles work and the platform rules that catch manufacturers out. Everything here comes from ENISA's own FAQ and registration guidance. For what the platform asks inside each report, see the SRP fields, stage by stage.
Two roles
| Role | How many | What to know |
|---|---|---|
| Primary AR | One per manufacturer | Can invite Secondary ARs, but only once its association with the manufacturer is verified |
| Secondary AR | Up to 20 | On screen, its system role is displayed as "AR Backup User" |
The documentation says Secondary AR; the platform says AR Backup User. Same role, two names. Write both into your procedure, so nobody hesitates during an incident.
Verification gates the whole team
- A Primary AR must first have a validated association with the manufacturer, shown as Verified, before it can invite any Secondary AR.
- Until that association is verified, an AR may submit up to 20 notifications for the manufacturer.
- The consequence: you cannot set up your backup on the day of an incident. Verification depends on the CSIRT, so start now.
Inviting a Secondary AR
- The invited person has 7 days to complete registration. After that, the invitation expires and the status becomes "Invitation Expired".
- Send invitations when the person is available to accept them, not the day before their holiday.
- A Secondary AR may claim the Primary role, subject to review and approval by the CSIRT. Useful if your Primary AR leaves the company.
Who sees what
- Submitted notifications are visible to every AR of the manufacturer, who can view and update them, whoever filed them.
- Drafts are the exception: they are stored in the individual AR's account, and no one else can see them.
- So draft outside the platform, in a document the whole team can reach, and use the platform to transcribe.
Choosing your coordinating CSIRT
Each notification goes to the CSIRT designated as coordinator — in principle, the CSIRT of the Member State where the manufacturer has its main establishment in the Union, which Article 14(7) ties to where decisions on the cybersecurity of its products are predominantly taken, with fallback rules for other cases.
Get this right before your first filing. ENISA warns that selecting the wrong coordinating CSIRT may get a notification invalidated — leaving you to resubmit while the clock keeps running.
Five rules worth knowing before the first incident
- One notification per event. Only one is required, even if the manufacturer has several EU branches or subsidiaries, or a parent company outside the EU. Decide in advance which entity files.
- English. The platform works in English: prepare your drafts in English.
- No API. Everything is entered by hand in the web interface — another reason to draft in advance.
- If the platform is down, ENISA asks you to submit once it is available again. Nothing in Article 14 suspends the deadlines, so keep a timestamped record of the outage.
- The 72-hour counter is not your deadline. It shows a due date 48 hours after your early warning is submitted, not 72 hours after you became aware. See the 24-hour early warning.
If you find a problem with the platform itself
ENISA publishes two contacts: cra-srp-security@enisa.europa.eu for security incidents affecting the platform, and responsible-disclosure@enisa.europa.eu for vulnerabilities found in it.
Keep your own copy
ENISA marks its platform guidance as reflecting its current best knowledge and subject to change. Keep dated copies of the pages your procedure relies on — and check them again before you rely on any figure.
ENISA's official pages: Single Reporting Platform (ENISA)
Sources
- ENISA, Single Reporting Platform — Frequently Asked Questions, updated 17 September 2026
- ENISA, CRA SRP Guidance — AR User Registration
- ENISA, CRA SRP Glossary, version 1.3, 10 September 2026
- Regulation (EU) 2024/2847, Article 14 — Official Journal of the European Union
Position as at 20 September 2026. ENISA updates its platform guidance frequently. General information, not legal advice.