Kilde › Guides › CRA › Who reports under the CRA — and which …

Who reports under the CRA — and which CSIRT receives it

Current to 26 August 2026 · updates land in the changelog.

The Article 14 reporting duty sits on the manufacturer. Importers and distributors carry their own obligations elsewhere in the regulation, but the 24-hour/72-hour/final-report machine is the manufacturer's to run.

You may be a manufacturer without noticing

The definition (Article 3(13)) covers anyone who develops or manufactures products with digital elements — or has them developed or manufactured — and markets them under their own name or trademark. That last clause is the white-label catch: selling a third party's product under your brand makes you the manufacturer for CRA purposes, reporting duty included. The developer behind the label does not carry Article 14 for those units; you do.

Which CSIRT: the main-establishment rule

Reports go simultaneously to ENISA and to the CSIRT designated as coordinator of the Member State of the manufacturer's main establishment — the Member State where cybersecurity-related decisions for the product are predominantly taken. For a group with entities across the EU, that is a determinable fact worth deciding and writing down before an incident, not during one.

Non-EU manufacturers: the Article 14(7) cascade

A manufacturer with no EU establishment still reports — the Member State is determined by a cascade: the Member State of the authorised representative; failing that, the importer; failing that, the distributor; failing that, the Member State with the highest concentration of users. Each step only applies if the previous one yields no answer, so most non-EU manufacturers with an EU footprint resolve at the first or second step. Working this out under time pressure is exactly the kind of thing a pre-filled routing worksheet exists to prevent.

One terminology trap on the platform

The ENISA reporting platform uses “Assigned Representative” for a platform user seat. That is a login role — not the CRA's “authorised representative” under Article 18, which is a legal appointment. Conflating the two produces genuinely wrong org charts.

Quick answers

Do importers or distributors file CRA vulnerability reports?

No — the Article 14 reporting duty is the manufacturer's. Importers and distributors have separate obligations, and they appear in the routing cascade for non-EU manufacturers, but the reports are filed by the manufacturer.

Does white-labelling make us the manufacturer under the CRA?

Yes. Marketing a product developed by someone else under your own name or trademark makes you the manufacturer (Art 3(13)) — including for the reporting duty.

Which CSIRT does a non-EU manufacturer report to?

The Member State is determined by the Art 14(7) cascade: authorised representative, then importer, then distributor, then highest user concentration — the first step that yields an answer wins.

General information only — not legal advice, and never a conformity assessment. Whether a specific product falls in a listed category is decided against the binding technical descriptions in Implementing Regulation (EU) 2025/2392, and reporting-platform mechanics are ENISA-published material marked subject to change. Sources are Regulation (EU) 2024/2847 (CELEX 32024R2847; Annex III/IV item texts read verbatim from EUR-Lex) and our audited kit research. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com