Article 14 · submission channel
Prepare the reporting case before you open ENISA’s SRP.
The Single Reporting Platform is the manufacturer’s channel for CRA Article 14 notifications. Vellaci connects the affected product and evidence to a timed, reviewable case; the manufacturer submits through ENISA.
Direct answer · official guidance
Where does a manufacturer submit CRA Article 14 reports?
Manufacturers submit Article 14 notifications through ENISA’s Single Reporting Platform (SRP). Vellaci can prepare and track a case but does not submit on the manufacturer’s behalf.
- Applicability
- Article 14 reporting has applied since 11 September 2026 to manufacturers of in-scope products with digital elements when the relevant actively exploited vulnerability or severe incident conditions are met. The CRA’s general application date remains 11 December 2027.
- Operational workflow
- Identify the affected product and versions, confirm awareness with a named reviewer, preserve the supporting evidence, prepare each stage, then record the manufacturer’s SRP submission and receipt.
Before reporting
- Confirm the manufacturer and affected product scope from the facts available.
- Identify product versions and components involved; keep the SBOM and advisory evidence attached.
- Record who confirmed awareness, the time and timezone, and the basis for that record.
- Assign the representative and alternates who can access the platform and coordinate internal review.
- Prepare the current stage’s information; update later when further facts or a corrective measure become available.
What Vellaci supports
- Versioned rules calculate stage deadlines from the confirmed awareness time.
- Case drafts can use structured product, incident, vulnerability and contact records.
- Review state, owners, corrections and supporting evidence stay in the case history.
- The manufacturer submits through ENISA and records the submission details in Vellaci.
Vellaci is an operational system. It does not determine legal reportability, contact ENISA, or submit a report for the manufacturer.
Read the Article 14 reporting guide, or use the deadline calculator without signing in.
Keep the report connected to product evidence.
Vellaci links the reporting timeline to products, versions, vulnerability decisions and retained evidence.