ENISA's single reporting platform takes shape towards 11 September

Less than a month before 11 September 2026 — the date the Article 14 reporting duty begins — attention shifts to the infrastructure that has to carry it: the single reporting platform set out in Article 16, run by ENISA, routing to the national coordinating CSIRTs.

It is the channel through which early warning (within 24 hours), notification (within 72 hours) and the final report (within 14 days) will flow for actively exploited vulnerabilities and severe incidents.

Why it matters. The duty also covers products already on the market, and the clock runs in hours: it is not something you stand up at the moment you need it. Anyone who has not yet decided who is authorised to notify, has no EU Login account ready, and has no minimal process for the first 24 hours, is exposed to a deadline that is already live.

How the channel works and what to have ready is in the guide on the single reporting platform; the status of the deadlines is in the state-of-play tracker.