![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2026\/09\/bsi-logo-400x300_TEXT.jpg\"){kind=logo}
<\/p>\n<\/p>\n
The requirement to report actively exploited vulnerabilities and security incidents is an important milestone in strengthening product security in line with the CRA. Reports are submitted uniformly across the EU via the Single Reporting Platform (CRA-SRP), which was developed and provided by the European Union Agency for Cybersecurity (ENISA). The recipients of these reports are the respective coordinating Computer Security Incident Response Team (CSIRT) of an EU member state and ENISA. In Germany, the CERT-Bund at the BSI serves as the coordinating CSIRT.<\/p>\n
For manufacturers with their principal place of business in the EU, the jurisdiction of the coordinating CSIRT is generally determined by the Member State in which the key decisions regarding the cybersecurity of the products are made. Manufacturers may become aware of actively exploited vulnerabilities in their products, for example, through IT security service providers or customers. In the case of serious security incidents affecting products with digital elements, this is also possible, for example, through external reports or the internal analysis of log data from applications and systems.<\/p>\n
If a manufacturer does not have its principal place of business in the EU, jurisdiction is determined according to the criteria set forth in Article 14(7) of the CRA. Relevant factors may include, among others, the location of an authorized representative, importer, or distributor, as well as the availability of the product in the respective EU member states.<\/p>\n
The CRA-SRP offers manufacturers a centralized, user-friendly, and confidential reporting channel. With a single report submitted via the coordinating CSIRT, the CSIRTs of those Member States in which the product in question, containing digital elements, is made available on the market can be reached simultaneously.<\/p>\n
Prior registration on the CRA-SRP is not required. If necessary, registration and submission of a report can be completed in just a few minutes. The platform is operated on a European IT infrastructure in compliance with state-of-the-art security measures.<\/p>\n
– – – – –<\/p>\n
\ud83d\udc49 www.bsi.bund.de<\/a> Photo: unsplash<\/i><\/p>\n","protected":false},"excerpt":{"rendered":" September 11, 2026. Starting September 11, 2026, manufacturers of products with digital elements will be subject to the reporting requirements of the Cyber Resilience Act (CRA) within the European Union (EU) single market. Manufacturers must report actively exploited vulnerabilities as well as serious security incidents that affect the security of their products. The Federal Office for Information Security (BSI) provides support in the form of step-by-step instructions.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[4809],"tags":[1942,2043,250,1982],"class_list":["post-545805","post","type-post","status-publish","format-standard","hentry","category-entrepreneurship","tag-data-security","tag-digitalization","tag-it","tag-resilience"],"acf":[],"yoast_head":"\n
\ud83d\udc49 www.enisa.europa.eu\/topics\/product-security\/single-reporting-platform-srp<\/a> <\/p>\n