In the FAQ updated on 3 October 2026, ENISA specifies how to use the Single Reporting Platform, operational since 11 September. Manufacturers of products with digital elements must use it to report actively exploited vulnerabilities and serious incidents affecting product safety: a first alert must be sent within 24 hours of becoming aware of the event and a more complete notification within 72 hours, in both cases without undue delay. A single notification is sufficient even if the manufacturer has several companies or offices in the EU, but the relevant coordinating CSIRT must be selected.

ENISA warns that, in the current version, the platform's 72-hour counter may indicate an inaccurate deadline, because it calculates 48 hours from the sending of the first notice. The company must therefore independently keep track of when it became aware of the event. Voluntary notifications are not yet available on the platform; the corresponding obligations for open-source software stewards will apply from 11 December 2027