A maker makes one Article 14 filing on the EU platform. It does not make one filing for the main CSIRT and a second for ENISA.
The site routes the notice to the main CSIRT. It makes the notice open to ENISA at the same time, apart from narrow limits in Article 16(2). “One filing” describes this route to both readers. The 24-hour, 72-hour, and final stages are still distinct events.
Design one submission record
Give each report stage one in-house ID. Link the approved data, files, filing person, send time, site ID, and receipt to it. Do not have two teams draft separate ENISA and CSIRT copies. They can drift and create needless work.
If a State authority asks a later question, link it to the first site case. Do not call that contact a new filing or edit the saved data with no trace.
Use a stage ID under one stable case ID. The early warning, 72-hour notice, and final report are different filing events. Each uses the same entry route. Keep their approvals, data, end proof, and later fixes apart.
Prevent duplicate work upstream
Give legal, product security, message staff, and the filing person access to one draft pack. A team may need its own work view. Link that view to the pack and send approved changes through one review. Do not keep an “ENISA copy” and a “CSIRT copy.”
Before handoff, compare the maker name, product scope, awareness time, track, States, secret facts, and response steps. A second review copy may help. A second outside filing plan does not.
Distinguish delivery from acknowledgement
The filing person should check what the site took and save the proof. A saved draft, ended review, and button click are not a proved filing. Define the site state or receipt that closes the task.
If the site fails, save the error, time, and data tried. Use the current EU help route. The response owner must keep the legal clock in view while the fault is raised.
Set a rule for a late receipt from an old try after a new try is ready. Compare IDs and data before closing either one. Keep both tries. The filing owner should decide which outside event is the filed stage.
Keep internal stakeholders aligned
Legal, product security, and message staff may each need a work copy. One controlled data set should feed the legal report. Record each approved change before it enters the site.
This model cuts repeat work. It does not invent a short cut. Each stage has one online filing and one proof trail. The legal route reaches more than one reader.
Continue this workflow with the platform-route overview and the staged evidence trail.