CRA SRP guidance - AR Notification submission and update

The information on this page is provided according to our current best knowledge and may be subject to change. Please ensure that you consult the latest available guidance before applying these instructions. Last updated: 3/08/2026.

Submit a New Notification

Purpose: Follow these steps to submit a new notification for an Actively Exploited Vulnerability (AEV) or a Severe Incident (SI). The purpose of the notification is to inform the relevant users of the CSIRT Designated as Coordinator (CDaC) so they can review, disseminate and further process it.

Pre-conditions: your user status is “Active”, you are logged in into the SRP and you have opened the Dashboard.

Submit an Early Warning

Steps

• Click “Submit new notification”. A new notification will be automatically created and pre-filled with the user type (assigned representative, AR).

• Fill the mandatory fields and any optional fields needed to describe the notification under the Early Warning tab.

• Select an existing manufacturer (approved or pending validation) or add a new one.

• After filling in the required and optional fields, submit the notification or save it as a draft.
• Optionally, fill in the Additional Notes

 
The notification is listed on the Dashboard. 

Exceptions: If you omit mandatory data, the SRP will return an error informing you of the missing data that must be provided. 

Before CSIRT validation:

After CSIRT validation:

Submit a 72-hour Notification

Pre-conditions: 

• Your user status is “Active”, you are logged in into the SRP and you have opened the Dashboard
• An Early Warning has already been submitted.

Steps

• Click on an existing notification on the Dashboard.

• Fill in the mandatory fields and any optional fields needed to describe the notification under the 72-hour Notification tab.
• Submit the notification or save it as a draft.

The notification is listed on the Dashboard and is subject to be validated by the CSIRT.

Exception: If you omit mandatory data, the SRP will return an error informing you of the missing data that must be provided. 

Submit a Final Report

Pre-conditions: 

• Your user status is “Active”, you are logged in into the SRP and you have opened the Dashboard
• An Early Warning and a 72-hour Notification have already been submitted.

Steps: 

• Click on an existing notification on the Dashboard.

• Fill in the mandatory fields and any optional fields needed to describe the notification under the Final Report tab.
• Submit the Final Report or save it as a draft

Exceptions: If you omit mandatory data, the SRP will return an error informing you of the missing data that must be provided.

Expected results:

Draft: the state of a saved draft notification is updated to "Draft". The draft is visible only to you.

Early Warning: the notification is stored and is accessible to the CSIRT Designated as Coordinator (CDaC) and to ENISA. An email and an alert will be sent to this CSIRT. An email and an alert will also be sent to you and all other ARs of the selected manufacturer, confirming submission of the notification. An email and an alert will also be sent to the ENISA automatically. The state of a successfully submitted notification is updated to “Early Warning”. Concerned CSIRTs will receive the Early Warning only after manual dissemination by the CSIRT Designated as Coordinator. 

72-hour Notification: The state of a successfully submitted notification is updated to "72h Submitted". The dissemination state of a notification subject to Particularly Exception Circumstances (PEC) is updated to "72h Submitted under PEC ". An email and an alert will be sent to the CDaC. An email and an alert will also be sent to you and all other ARs of the selected manufacturer, confirming submission of the notification. An email and an alert will also be sent to ENISA. ENISA automatically receives the 72h Notification only when Particularly Exception Circumstances have not been invoked. Concerned CSIRTs will receive the 72-hour Notification only after manual dissemination by the CSIRT Designated as Coordinator. 

Final Report: the state of a successfully submitted notification is updated to "FR Submitted". The sub-state of a successfully submitted Final Report is updated to “Final Report”. ENISA automatically receives the Final Report only when Particularly Exception Circumstances has not been invoked. Concerned CSIRTs will receive the Final Report only after manual dissemination by the CSIRT Designated as Coordinator.

Update an Existing Notification 

Purpose: Follow these steps to update an existing notification for an Actively Exploited Vulnerability or a Severe Incident.

Pre-conditions:

• Your user status is “Active" and you are logged in the SRP
• A notification has been previously submitted or saved as a draft
• Notification is not closed - closed notifications cannot be updated
• The Final Report is not submitted - the notification becomes non‑editable after the submission of a Final Report

Steps

• Open a notification and update the necessary fields under the Notification tab
• Click ‘Update’ to save the updated notification information

Exceptions: If you omit mandatory data and click “Update”, the SRP will return an error informing you of the missing data that must be provided.

• The SRP automatically notifies the CDaC via an alert and an email
• The SRP automatically notifies ENISA and any concerned CSIRTs that previously received the notification through dissemination, via an alert and an email.