Which authority receives your report

Every report goes to two places: ENISA, and the CSIRT designated as coordinator in one member state.Art. 14⁠(1)⁠ Both are reached through the single reporting platform, and the platform routes on the member state you select. Select the wrong one and the notification may be invalidated and have to be resubmitted, on the same clock.

How the member state is decided

Article 14(7) fixes it, in order. Take the first line that applies to you and stop.Art. 14⁠(7)⁠

  1. 1

    Your main establishment in the EU

    If you have one, that member state. Nothing else in the list is consulted.

  2. 2

    Your authorised representative

    Failing an establishment, the member state where your appointed representative is.

  3. 3

    Your importer

    Failing a representative, where your importer is established.

  4. 4

    Your distributor

    Failing an importer, where your distributor is established.

  5. 5

    Your users

    Failing all of those, the member state where the largest number of your users are.

A product sold in ten member states still has one coordinating CSIRT. The other states are told through the platform, which is why it asks where the product is available.

The 27 coordinating CSIRTs

One per member state. The platform is where the report goes; these are the teams that receive it, and the contact page is where you go if the platform is down and you want the team to know you are coming.

These entries were transcribed from the designations published under NIS2 and have not yet been re-checked one by one against each team’s own site. Confirm the contact page before relying on it under a deadline; the platform, not the email address, is where the report is filed.

Work out yours before you need it

The scope check applies the cascade above to your answers and names the team. Five questions, no sign-up.

Run the scope checkHow the platform works

This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.