The CRA reporting chain assigns different responsibilities to different actors. Manufacturers submit the required notifications. ENISA manages the Single Reporting Platform. Coordinating CSIRTs receive and assess reports and ordinarily disseminate them to other relevant CSIRTs.

The chain can be easier to operate when the internal record mirrors those boundaries.

Manufacturer responsibilities

The manufacturer owns trigger assessment, timely staged submissions, product and Member State scope, and the accuracy of the information it provides. It should retain evidence of the decision and each successful submission.

Platform and authority responsibilities

ENISA establishes, manages, and maintains the platform. The coordinating CSIRT receives the report, assesses it, and handles onward dissemination under the CRA rules. Other relevant CSIRTs receive information for their territories.

Do not treat those authority-side responsibilities as a substitute for manufacturer readiness. The reporting team still needs an authorised submitter, a resolved coordinating-CSIRT route, and a reliable list of Member States in which affected products were made available.

Assign one accountable person for trigger assessment, awareness, deadline control, product scope, Member State scope, drafting, approval, submission, and evidence retention. Several tasks may belong to one person in a small organisation, but each responsibility still needs an explicit owner and backup.

Distinguish accountability from assistance. A supplier, external adviser, or service provider may contribute evidence or drafting support. The manufacturer should still retain the legal-entity decision, approved statement, named human submission, and completion evidence.

Create a handoff rule for every change of owner. The outgoing person provides the current decision state, evidence index, deadline, unresolved questions, and next required action. The receiving person acknowledges custody, rather than allowing a message sent to a team channel to count as transfer.

Keep the handoff evidence

Record which actor was expected to receive the submission and what the platform confirmed. If a later authority contact changes the scope or requests clarification, append it to the same case trail with an owner and response time.

Keep authority contact separate from internal approval. A request for clarification may reopen technical or legal review, but it should not silently modify the filed snapshot. Retain the request, response owner, approved answer, external result, and relationship to the earlier submission.

Test the chain with two scenarios: an absent primary reporter and a disagreement over product scope. The exercise passes only when the deadline remains visible, authority limits remain clear, the packet changes through review, and a read-only colleague can reconstruct every handoff.

Continue this workflow with the platform-route overview and the access-continuity plan.