Who receives the notification?

The report goes simultaneously to the CSIRT designated as coordinator and to ENISA. This is not sequential and not a choice — both receive the same notification at the same time.

Submission takes place via the single reporting platform under Article 16 of the regulation. It is designed as a single entry point: one submission, distribution to the competent bodies from there.

What matters is the Member State of the manufacturer's main establishment. For manufacturers established outside the Union, the Member State in which the authorised representative is established is decisive. Anyone who has not clarified this allocation had better do so before the first real case rather than during it.

The reporting assistant deliberately states the recipient logic in the abstract and does not maintain a country list of specific CSIRT addresses. Such a list goes stale between maintenance cycles — and a stale recipient in a real case would be worse than none.

In addition to the authority notification, affected users must be informed without delay, with sufficient information to protect themselves. This expressly includes mitigating measures for the period before a patch is available.

This information is not optional and not a marketing text. The reporting assistant produces a dedicated template for it in German and English, fed from the same entries as the authority notification.