SRP registration is user-based. ENISA uses Assigned Representatives to submit notifications for manufacturers. The Primary AR creates the initial manufacturer association, while Secondary ARs are added later by invitation. Validation of the association can continue in parallel with reporting and does not prevent an active Primary AR from submitting a notification.
The SRP Uses Assigned Representatives
Manufacturers do not interact with the Single Reporting Platform only through a generic corporate login. ENISA uses the role of Assigned Representative, abbreviated AR, for individuals who submit CRA notifications on behalf of a manufacturer. This platform role should not be confused with the authorised representative referred to elsewhere in the Cyber Resilience Act. An Assigned Representative is the person using the SRP. An authorised representative is a separate legal concept concerning a person or entity mandated by a manufacturer. A user can therefore be an SRP Assigned Representative without being the manufacturer's legal authorised representative under the CRA.
- Assigned Representative is an SRP user role.
- Authorised representative is a separate CRA legal concept.
- Do not use the two terms interchangeably.
- Assign SRP access to people with clear internal reporting authority.
Start With an EU Login Account and MFA
ENISA currently requires Assigned Representatives to authenticate through EU Login. The individual needs an active EU Login account with multi-factor authentication enabled before accessing the platform. If an existing EU Login account does not yet have MFA enabled, that should be configured before the first SRP access. Personal details such as first name, last name and email are obtained from EU Login during registration and are not entered independently as a second identity inside the SRP.
- Use an individual EU Login account.
- Enable multi-factor authentication.
- Make sure the EU Login email belongs to the intended reporting user.
- Do not rely on shared credentials for the reporting process.
A Primary AR Creates the Initial Manufacturer Association
The first Assigned Representative for a manufacturer registers as the Primary AR. ENISA's current registration workflow begins at the SRP portal, where the user selects the Assigned Representative role and then selects the CSIRT Designated as Coordinator. The user authenticates through EU Login, reads and accepts the legal agreement, confirms the personal details supplied from EU Login and enters the required manufacturer details. When registration is completed, the system creates the manufacturer entity and the association between the Primary AR and the manufacturer.
- Open the CRA SRP.
- Select Assigned Representative.
- Select the correct CSIRT Designated as Coordinator.
- Authenticate through EU Login.
- Accept the legal agreement.
- Confirm personal details.
- Enter the manufacturer details.
Select the Correct CSIRT During Registration
The registration workflow asks the Primary AR to select a CSIRT Designated as Coordinator. ENISA states that the manufacturer is responsible for identifying the correct CSIRT according to Article 14(7). This selection should therefore be treated as a legal routing decision rather than an administrative preference. For manufacturers with a main establishment in the Union, the analysis normally focuses on the Member State where decisions related to product cybersecurity are predominantly taken. Manufacturers without a main establishment in the Union use the ordered Article 14(7) fallback rules.
- Determine the coordinating CSIRT before registration where possible.
- Use the Article 14(7) rules.
- Do not simply select the Member State that appears most convenient.
- Document the basis for the selection.
Validation Happens After Registration
After registration, the AR-manufacturer association is submitted to the selected CSIRT Designated as Coordinator for validation. ENISA currently states that this validation is not a prerequisite for submitting a notification. Validation takes place after first platform access and can proceed in parallel with the reporting process. The detailed validation procedure can vary between CSIRTs. This is important for a manufacturer facing an active Article 14 deadline because an association that is still pending validation does not by itself prevent the Primary AR from making the required submission.
- Registration creates the user and manufacturer association.
- The coordinating CSIRT validates the association.
- Validation can proceed in parallel with reporting.
- A pending validation does not automatically block notification submission.
ENISA Advises Against Unnecessary Pre-Registration
ENISA's current September 2026 registration guidance advises manufacturers and open-source software stewards to register and initiate the validation process when they need to submit a specific notification rather than registering pre-emptively. This is a current platform-operating recommendation and could change as the SRP develops. Organisations can still prepare in advance by creating EU Login accounts, enabling MFA, identifying likely reporting users, understanding Article 14 routing and documenting the registration procedure internally. Preparation does not require creating unused manufacturer associations in advance.
- Follow ENISA's current registration guidance.
- Do not confuse readiness with unnecessary platform pre-registration.
- Prepare EU Login and MFA in advance.
- Prepare the CSIRT-routing analysis in advance.
- Recheck ENISA guidance before a real registration.
Secondary ARs Are Added by the Primary AR
Once the Primary AR's association with the manufacturer has been validated and is displayed as Verified, the Primary AR can invite Secondary Assigned Representatives. The prospective Secondary AR needs an active EU Login account with MFA and receives an SRP invitation by email. The invitation is tied to the manufacturer associated with the Primary AR. ENISA currently allows one Primary AR and up to 20 Secondary ARs for a manufacturer. Both Primary and Secondary ARs can submit and update notifications, subject to their access permissions.
- The Primary AR initiates the Secondary AR invitation.
- The Primary AR association must first be Verified.
- Secondary ARs authenticate through EU Login with MFA.
- ENISA currently allows up to 20 Secondary ARs.
- Use Secondary ARs to reduce single-person dependency.
Do Not Rely on One Person's Draft Notification
Primary and Secondary ARs associated with the same manufacturer can generally access and update the manufacturer's submitted notifications according to their permissions. Draft notifications are different. ENISA states that drafts are stored in the individual AR's account and are not visible to other ARs. A manufacturer should therefore maintain its regulatory evidence and reporting status in an internal system rather than treating a private SRP draft as the only working copy. This is especially important when a 24-hour or 72-hour deadline could continue while the original AR is unavailable.
- Maintain an internal Article 14 case record.
- Do not use an individual SRP draft as the only source of truth.
- Make reporting responsibilities transferable.
- Use Secondary AR coverage where appropriate.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.