The CRA Single Reporting Platform is a single electronic entry point. A manufacturer uses it to notify the coordinating CSIRT and ENISA simultaneously, subject to the Regulation’s narrow exceptional restrictions on ENISA access. The coordinating CSIRT ordinarily disseminates the notification to relevant CSIRTs where the product was made available.
“Single entry” describes the submission route. It does not remove the manufacturer’s responsibility to choose the correct coordinating CSIRT, identify the relevant Member States, or complete each reporting stage.
Prepare the route before an incident
Determine the main establishment rule that applies to the organisation and record the resulting Member State. Identify who is authorised to submit and how that person accesses the platform. Keep the platform guidance and account information under change control because operational details may evolve.
For each submission, preserve the exact payload, submission time, platform reference, and receipt. If the platform rejects or interrupts a submission, record the error and the actions taken rather than assuming the attempt was complete.
Build a provider-neutral route card
Keep the durable route in one controlled record: legal manufacturer, main-establishment analysis, coordinating CSIRT, Member States where the affected product was made available, authorised primary and backup reporters, internal approver, and evidence-retention owner. Link to current official operational instructions rather than copying interface steps into the rule itself.
Date every operational appendix. Account conventions, screens, or validation processes are provider-controlled details and must be rechecked against the official service before use. A third-party walkthrough can help a team form questions, but it should not be treated as authority for a current platform behaviour.
Distinguish an attempt from a submission
Define the evidence the organisation requires before it marks a stage filed. Keep the approved packet, the exact content entered, the completion time, the person acting, the external result, and any acknowledgement together. A saved internal draft or an interrupted attempt remains open work.
If the normal route is unavailable, preserve the observed failure and follow the organisation’s verified contingency and escalation instructions. Do not invent an alternative recipient or assume that an email recreates the statutory platform route.
Keep internal and external routing distinct
The platform handles regulatory routing after submission. Internal routing still needs to bring product security, incident response, legal, and accountable management to the same evidence record before the deadline. Design both routes, test them together, and give each handoff a named owner.
Exercise the internal chain without making a real notification. The reporter should be able to locate the current route card, identify the approving person, prepare the authorised content, and show where completion evidence would be retained. The exercise should stop at the controlled boundary before external action.
This framing keeps the article’s rule stable: one electronic entry point and a statutory routing chain. Volatile provider mechanics remain dated operational material rather than public claims presented as settled law.
Continue this workflow with the coordinating-CSIRT analysis and the single-submission evidence model.