ENISA's new reporting platform lets manufacturers seal incident timelines

The platform is live, and the clock is ticking

ENISA has launched its Single Reporting Platform for manufacturers of products with digital elements. The platform enables manufacturers to fulfil their Cyber Resilience Act obligations to report actively exploited vulnerabilities and severe incidents ^[1].

The CRA's reporting requirements apply from 11 September 2026 ^[2]. That's months before the product security requirements in Annex I take effect on 11 December 2027, so manufacturers need to be ready to report incidents well before their products need to meet the full security standards.

The platform is the mechanism. The hard part is the clock.

The 24-hour rule works like a lost bank card

Article 14 of the CRA sets out a three-step reporting process with tight deadlines ^[2]:

1. An early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident.
2. A notification within 72 hours, including an initial assessment.
3. A final report within 14 days, or a progress report if the investigation isn't finished.

The 24-hour clock starts when the manufacturer becomes aware, not when the legal team has finished its review or when the incident response plan is complete. It works like reporting a lost bank card: the clock starts when you notice it's gone, not when it suits you.

ENISA's platform provides the submission route. What it doesn't provide is proof of when you knew.

What counts as becoming aware

Becoming aware means the moment someone in the organisation with responsibility for product security learns that a vulnerability is being actively exploited, or that an incident has happened and is severe enough to trigger reporting ^[2].

It doesn't mean the moment the board is told, or the moment a full investigation confirms every detail. It means the moment the information reaches someone who should act on it.

That's a factual question, and in a dispute it's one that turns on records: emails, alerts, meeting notes and logs. If a supervisor asks why the early warning went out after 30 hours instead of 24, the answer needs to be supported by something you can show.

What this means for you

If you manufacture products with digital elements, here are four questions worth asking now:

1. Who in your organisation is responsible for knowing when a vulnerability is being exploited or an incident is severe, and do they know that the 24-hour clock starts with them?
2. How will you record the moment you became aware, in a way that will hold up if questioned later?
3. Can you submit an early warning within 24 hours, even outside office hours, and does everyone who needs to know about the platform have access to it?
4. What happens if someone later claims you knew earlier than you say you did?

The penalties for failing to report are up to 15 million euros or 2.5 per cent of global annual turnover ^[2]. That makes getting the timeline right worth the effort.

How a sealed timeline would work

Here, the thing to seal is each step of the incident as it happens: the first detection note, the decision to escalate, and each report as it is sent to ENISA's platform.

Sealing takes a fingerprint of each record, not the record itself, so the content never leaves your systems. You seal at each step: when the vulnerability is first logged, when the early warning is prepared, when it's submitted, and so on through the 72-hour notification and the final report.

Anyone you share the timeline with—your auditor, your insurer, a supervisor—can check that each record is exactly what was recorded at that time. If it's changed, even by someone with administrator rights, the fingerprint won't match.

What a sealed timeline doesn't do is make the report complete, prove that the response was adequate, or decide whether the deadlines were met. It shows when each step was recorded, unchanged.

You can seal incident records through WitniumChain's REST API, the SDK or the MCP server, and the first 2,000 witnesses a month are free. Start at witniumchain.com.

How it would work

1. Seal the first detection note when it's written, before escalation.
2. Seal the early warning as it's submitted to ENISA's platform.
3. Seal each subsequent report (72-hour notification, final report) as it's sent.

What to watch

The CRA's reporting obligations apply from 11 September 2026, so manufacturers have until then to set up their processes and get familiar with ENISA's platform ^[2].

The product security requirements in Annex I, including logging and vulnerability handling, apply from 11 December 2027 ^[3]. That's the date when products placed on the market need to meet the full set of essential requirements.

ENISA's platform is live now, which means manufacturers can start testing their reporting workflows well before the deadlines arrive. If you wait until the first incident, you'll be learning the platform under pressure.