The 24-hour clock is not the moment to be working out who you're supposed to notify. The CRA's routing is deterministic — the answer exists before any incident — so the task is simply to find it once and write it down.
Who receives your report
You file once, through the Single Reporting Platform, and it routes the notification to the CSIRT designated as coordinator in a specific member state, with ENISA receiving it simultaneously. You don't choose the CSIRT per report; it's fixed by where your business sits. So the real question is which member state's CSIRT is yours.
Main establishment decides it
The coordinating CSIRT is the one in your member state of main establishment — broadly, where the decisions about the security of your products are principally taken, or where you carry out most of your relevant EU activity. For a company operating in one member state this is obvious; for one spread across several, it's a determination worth making deliberately and documenting, because it fixes your regulatory point of contact.
Identifying your coordinating CSIRT
Once you know your member state of main establishment, its coordinating CSIRT is a matter of record — each member state designates one. Find it, capture its contact details and any registration or onboarding it expects ahead of the reporting date, and note how the Single Reporting Platform expects you to be identified to it. If you're established outside the EU, resolve how your reporting point of presence works early, as it's the fiddliest case to sort out under time pressure.
Why to settle it in advance
The routing is knowable today. The 24-hour clock is not the time to discover it.
None of this is hard — it's a lookup and a note in your incident runbook. But left undone, it becomes a scramble stacked on top of an actual incident, which is exactly when you have no spare capacity. Identifying your coordinating CSIRT is one of the concrete readiness steps in the reporting pillar, alongside drafting report templates and — the hard part — making the affected-or-not assessment fast and defensible.
Frequently asked
Which CSIRT does a CRA report go to?
The CSIRT designated as coordinator in the member state where the manufacturer has its main establishment. The Single Reporting Platform routes the notification there, and makes it available to ENISA at the same time.
What is a manufacturer’s "main establishment" under the CRA?
Broadly, where the decisions about the security of your products are principally taken, or failing that where you carry out most of your relevant activity in the EU. It determines which member state’s coordinating CSIRT is your point of contact.
What if I’m established outside the EU?
Manufacturers outside the EU must generally act through arrangements that give them a point of presence for obligations like reporting; the coordinating CSIRT is determined accordingly. Identify this early — it is harder to resolve mid-incident.