What happened
On 15 October 2026 ENISA updated the FAQ of the CRA Single Reporting Platform with two new answers and one revised answer. Only the CSIRT designated as coordinator, the CSIRT of the Member State where the notification was submitted, can close a report. ENISA may also add a publicly known vulnerability notified under Article 14(1) to the European Vulnerability Database, in agreement with the manufacturer (Article 17(5)).
What it means for machine builders
Add two steps to your 24-hour reporting procedure. You cannot close a report yourself on the platform: the coordinating CSIRT does. After a report, expect ENISA to ask whether and when the vulnerability can be published in the European Vulnerability Database. Decide now who answers. That answer sets when everyone learns about the flaw, so align it with your formal notice to the customer.
Where Shield Lifecycle fits
Shield Lifecycle keeps the report and the formal notice to the customer on the record of each machine, so your answer to ENISA starts from the same facts. Shield Lifecycle
Official source ENISA, Single Reporting Platform FAQ
Published 20 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.