Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform (SRP), including for products already on the market. Ten points a manufacturer's team should have in place.
Before anything happens
- Product inventory. Every product with digital elements made available in the EU, with the versions that are still supported.
- SBOM per product and version. A machine-readable software bill of materials (CycloneDX or SPDX), generated automatically in the build pipeline, not maintained by hand. It covers every layer that ships: application dependencies, operating system packages and firmware.
- Exploitation monitoring. Someone or something checks those components at least daily against sources of actively exploited vulnerabilities, such as the CISA Known Exploited Vulnerabilities catalogue and ENISA's EU Vulnerability Database.
- When the clock starts. An internal agreement on what "becoming aware" means, and a record of the time. The deadlines run from that moment, weekends and holidays included.
- Named people and SRP access. A primary and a backup person who decide, and who submit on the SRP. Each needs an EU Login account with multi-factor authentication. Registration on the SRP is worth doing early: one primary and up to 20 secondary representatives, whose association the CSIRT has to validate. Validation does not block submitting a notification; the EU Login account and multi-factor setup cannot be skipped. None of it can be done quickly at 2 a.m.
- The responsible CSIRT. Which national CSIRT is responsible: the one in the Member State of the main establishment in the EU. Without an EU establishment it follows the authorised representative, then the importer, then the distributor, and, failing those, the Member State with the most users of the product.
- Intake channel. A published way for researchers and customers to report
vulnerabilities: a security contact, a disclosure policy, a
security.txt.
When it happens
- The three deadlines. Early warning within 24 hours · notification within 72 hours · final report no later than 14 days after a corrective or mitigating measure is available (for severe incidents: within one month of the notification).
- Informing users. Affected users are told about the vulnerability and the mitigations or fixes they can apply.
Proving it works
- A drill. One real component in one product, treated as though it were exploited on a Saturday morning, with points 3 to 9 walked through against a stopwatch.
At launch the SRP has no programming interface: a person submits each report through a web form. Text prepared in advance beats text written under time pressure.