ENISA's Single Reporting Platform: where onboarding actually stands (July 2026)

What's confirmed

• ▸The SRP is the single place manufacturers file Art. 14 reports — you report once, the platform routes to your national CSIRT and ENISA.
• ▸It must be operational by 11 September 2026, when the reporting obligations start applying.
• ▸ENISA has committed to registration instructions, training material and dry-run support ahead of the deadline.

What's still open

• ▸Self-serve registration is not broadly available yet — onboarding is rolling out gradually.
• ▸No public API so far; assume manual submission through the portal at launch.
• ▸How strictly 'becoming aware' will be interpreted in practice remains untested — plan for the conservative reading (a credible report starts the clock).

What to do while you wait

The clock does not pause for registration problems, so the preparation is procedural, not technical:

• ▸Name the reporter and a backup — the person with authority to declare 'actively exploited' at 3 a.m.
• ▸Pre-draft your early-warning template (our free deadline calculator generates one).
• ▸Watch ENISA's SRP page monthly; register the day your national CSIRT opens the flow.
• ▸Rehearse once: a tabletop run of detect → decide → file finds the broken assumption before a real incident does.