A cyber incident needs a reporting owner.

Executive summary

ENISA launched the initial operating capability of the CRA Single Reporting Platform on 11 September 2026. Manufacturer reporting obligations apply from that date; the main cybersecurity requirements follow on 11 December 2027.

For a Turkish manufacturer, the first questions concern the product, the EU market and its role in the supply chain. Our practical recommendation is to assign an incident owner and deputy, record when information first arrives, and test the route from technical assessment to notification. A general cooperation clause does not explain who answers a supplier at midnight.

These are EU product-related obligations, not a new general reporting regime for every business in Türkiye.

Sources

ENISA · CRA Single Reporting Platform, 11.09.2026

https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched