Cyber Resilience Act · Article 14
Where to report under the CRA: the CSIRT coordinator in each member state
Since 11 September 2026 an actively exploited vulnerability or a severe incident is reported on ENISA's single reporting platform within 24 hours of becoming aware, with the notification at 72 hours, and the CSIRT designated as coordinator for the member state where the manufacturer has its main establishment receives it; pick the state and the route is written below.
A manufacturer with no main establishment in the EU reports to the coordinator of the state of its authorised representative; the article below has the whole rule.
The three clocks, from the moment of awareness
24 hours
Early warning to the platform.
72 hours
Notification with the details the platform asks for.
14 days
Final report on a vulnerability, counted from the day a corrective measure is available, not from awareness; for a severe incident, one month from the notification.
Work out your dates in the deadline calculator
The coordinator in every member state
ENISA published the list of CSIRTs designated as coordinators on 10 September 2026; read on 12 September 2026. In Croatia, Czechia the coordinator is a different body from the national CSIRT of the CSIRTs Network. ENISA's list
| Member state | Coordinator | Contact page | National CSIRT |
|---|---|---|---|
| Austria | CERT.atComputer Emergency Response Team Austria | cert.atcert.at | The same body |
| Belgium | CCBCentre for Cybersecurity Belgium | ccb.belgium.be | The same body |
| Bulgaria | CERT BulgariaCERT Bulgaria | govcert.bg | The same body |
| Croatia | NCSC-HRNational Cyber Security Centre of Croatia | ncsc.hr | Different: CERT.hr |
| Cyprus | CSIRT-CYNational CSIRT-CY | csirt.cy | The same body |
| Czechia | NÚKIBNational Cyber and Information Security Agency | nukib.gov.cz | Different: CSIRT.CZ |
| Denmark | FE DDISDanish Defence Intelligence Service, formerly CFCS | fe-ddis.dk | The same body |
| Estonia | CERT-EECERT Estonia | ria.ee | The same body |
| Finland | NCSC-FINational Cyber Security Centre Finland | kyberturvallisuuskeskus.fi | The same body |
| France | CERT-FRCERT-FR | cert.ssi.gouv.fr | The same body |
| Germany | CERT-BundCERT-Bund at the BSI | bsi.bund.debsi.bund.de | The same body |
| Greece | EL-CSIRTNational Cyber Security Authority CSIRT | cyber.gov.gr | The same body |
| Hungary | NCSC HungaryNational Cyber Security Center of Hungary | ncsc.gov.hu | The same body |
| Ireland | CSIRT-IENational Cyber Security Centre Ireland | ncsc.gov.ie | The same body |
| Italy | CSIRT ItaliaComputer Security Incident Response Team Italia | acn.gov.it | The same body |
| Latvia | CERT.LVInformation Technologies Security Incident Response Institution | cert.lv | The same body |
| Lithuania | CERT-LTNational CERT of Lithuania | nksc.lt | The same body |
| Luxembourg | CIRCLComputer Incident Response Center Luxembourg | circl.lu | The same body |
| Malta | MT-CSIRTMT-CSIRT | mita.gov.mt | The same body |
| Netherlands | NCSC-NLNationaal Cyber Security Centrum | ncsc.nl | The same body |
| Poland | CERT PolskaCERT Polska | cert.pl | The same body |
| Portugal | CERT.PTCERT.PT at the CNCS | cncs.gov.pt | The same body |
| Romania | DNSCRomanian National Cyber Security Directorate | dnsc.ro | The same body |
| Slovakia | SK-CERTSK-CERT | sk-cert.sk | The same body |
| Slovenia | SI-CERTSlovenian Computer Emergency Response Team | cert.si | The same body |
| Spain | INCIBE-CERTINCIBE-CERT | incibe.esincibe.esincibe.esincibe.es | The same body |
| Sweden | CERT-SECERT-SE | cert.se | The same body |
In StandardOS the report is written before the clock runs out
StandardOS records the moment you became aware, runs the three clocks, and writes the early warning and the notification with the fields ENISA's platform asks for.
Which CSIRT do you report to under Article 14, and the rule that picks the stateWrite the incident response plan with the CRA clocks in itEvery member state, from the registers