Cyber Resilience Act · Article 14
Where to report under the CRA: the CSIRT coordinator in each member state
- Who it applies to
- Any manufacturer or steward filing under Article 14: the report goes to the CSIRT designated as coordinator in the member state, and to ENISA.
- The dates
- From 11 September 2026, on the single reporting platform.
- The one thing to do
- Find your member state in the list, and where it has named a body other than its national CSIRT, use the one the Commission's list names.
Since 11 September 2026 an actively exploited vulnerability or a severe incident is reported on ENISA's single reporting platform within 24 hours of becoming aware, with the notification at 72 hours, and the CSIRT designated as coordinator for the member state where the manufacturer has its main establishment receives it; pick the state and the route is written below.
A manufacturer with no main establishment in the EU reports to the coordinator of the state of its authorised representative; the article below has the whole rule.
The three clocks, from the moment of awareness
24 hours
Early warning to the platform.
72 hours
Notification with the details the platform asks for.
14 days
Final report on a vulnerability, counted from the day a corrective measure is available, not from awareness; for a severe incident, one month from the notification.
Work out your dates in the deadline calculator
The coordinator in every member state
ENISA published the list of CSIRTs designated as coordinators on 10 September 2026; read on 12 September 2026. In Croatia, Czechia the coordinator is a different body from the national CSIRT of the CSIRTs Network. ENISA's list
| Member state | Coordinator | Contact page | National CSIRT |
|---|---|---|---|
| Austria | CERT.atComputer Emergency Response Team Austria | cert.atcert.at | The same body |
| Belgium | CCBCentre for Cybersecurity Belgium | ccb.belgium.be | The same body |
| Bulgaria | CERT BulgariaCERT Bulgaria | govcert.bg | The same body |
| Croatia | NCSC-HRNational Cyber Security Centre of Croatia | ncsc.hr | Different: CERT.hr |
| Cyprus | CSIRT-CYNational CSIRT-CY | csirt.cy | The same body |
| Czechia | NÚKIBNational Cyber and Information Security Agency | nukib.gov.cz | Different: CSIRT.CZ |
| Denmark | FE DDISDanish Defence Intelligence Service, formerly CFCS | fe-ddis.dk | The same body |
| Estonia | CERT-EECERT Estonia | ria.ee | The same body |
| Finland | NCSC-FINational Cyber Security Centre Finland | kyberturvallisuuskeskus.fi | The same body |
| France | CERT-FRCERT-FR | cert.ssi.gouv.fr | The same body |
| Germany | CERT-BundCERT-Bund at the BSI | bsi.bund.debsi.bund.de | The same body |
| Greece | EL-CSIRTNational Cyber Security Authority CSIRT | cyber.gov.gr | The same body |
| Hungary | NCSC HungaryNational Cyber Security Center of Hungary | ncsc.gov.hu | The same body |
| Ireland | CSIRT-IENational Cyber Security Centre Ireland | ncsc.gov.ie | The same body |
| Italy | CSIRT ItaliaComputer Security Incident Response Team Italia | acn.gov.it | The same body |
| Latvia | CERT.LVInformation Technologies Security Incident Response Institution | cert.lv | The same body |
| Lithuania | CERT-LTNational CERT of Lithuania | nksc.lt | The same body |
| Luxembourg | CIRCLComputer Incident Response Center Luxembourg | circl.lu | The same body |
| Malta | MT-CSIRTMT-CSIRT | mita.gov.mt | The same body |
| Netherlands | NCSC-NLNationaal Cyber Security Centrum | ncsc.nl | The same body |
| Poland | CERT PolskaCERT Polska | cert.pl | The same body |
| Portugal | CERT.PTCERT.PT at the CNCS | cncs.gov.pt | The same body |
| Romania | DNSCRomanian National Cyber Security Directorate | dnsc.ro | The same body |
| Slovakia | SK-CERTSK-CERT | sk-cert.sk | The same body |
| Slovenia | SI-CERTSlovenian Computer Emergency Response Team | cert.si | The same body |
| Spain | INCIBE-CERTINCIBE-CERT | incibe.esincibe.esincibe.esincibe.es | The same body |
| Sweden | CERT-SECERT-SE | cert.se | The same body |
Next: the clocks from the moment of awareness, and the notification drafted.
7 days free, no card.
Or the CRA Readiness Toolkit, €199, files by email
Or have it done with you: CRA readiness, €1,500, 10 working days
Which CSIRT do you report to under Article 14, and the rule that picks the stateWrite the incident response plan with the CRA clocks in itEvery member state, from the registers