Where are Cyber Resilience Act vulnerability reports submitted?

Through the single reporting platform that ENISA operates for the Cyber Resilience Act. Under Article 14 of Regulation (EU) 2024/2847, manufacturers of products with digital elements notify actively exploited vulnerabilities in their products, and severe incidents affecting the security of those products, through that platform; the notification goes to the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. designated as coordinator in the Member State of the manufacturer's main establishment and to ENISA. For the stages, deadlines and contents, see Regulation (EU) 2024/2847, Article 14. These duties concern manufacturers, including software companies that place products on the EU market, not businesses that only use the products. Users may still have their own NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. or GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). reports to make after the same event. If you develop software, set up a vulnerability-handling process and decide who has access to the platform before you need it.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

This answer also appears, with more context, here: Incident reporting deadlines

← All 35 questions on Incident reporting deadlinesAll topics