CRA reports from Norway: where they go, and what changes

Today: an EU CSIRT, through ENISA’s SRP

Article 14 has applied since 11 September 2026 to every manufacturer that sells products with digital elements in the EU, wherever it is based. Reports go through ENISA’s Single Reporting Platform (SRP) to the CSIRT designated as coordinator in an EU member state.

The CRA is not part of the EEA Agreement, and Nkom says Norwegian manufacturers must, until further notice, send their reports to an EU country where the product is sold or represented (Nkom, 11 September 2026).

Which EU state is decided by Article 14(7): where the authorised representative acting for most of your products is established, else the importer placing most of them on the market, else the distributor selling the most, else where most of your users are. The test counts all your products, so it gives one CSIRT for the company. The route finder at the end of this page walks through it, and the table below it names the coordinating CSIRT in every member state.

Next: Nkom

The government has announced that Nkom will supervise the CRA in Norway, including receiving notifications of vulnerabilities and incidents. The 2027 budget proposal adds NOK 3.9 million for Nkom’s follow-up of the CRA (Nkom, 7 October 2026, in Norwegian).

In the EU most of the CRA applies from 11 December 2027. In Norway it applies once the regulation is part of the EEA Agreement and Norwegian law. 11 December 2027 is the aim, not a decided date. Until a date is decided, keep reporting to the EU CSIRT your route gives.

When a date is decided, Pharus routes Norwegian companies to Nkom from that day.

Already in force: cybersecurity for radio equipment

Since 1 August 2025, radio equipment placed on the EEA market must meet the cybersecurity requirements of the Radio Equipment Directive, Article 3(3)(d), (e) and (f): protecting the network, personal data and privacy, and against fraud. They cover internet-connected radio equipment, and radio equipment for childcare, toys and wearables. Nkom supervises them in Norway (Nkom).

The harmonised standards are EN 18031-1, -2 and -3. When the CRA applies in full on 11 December 2027, these RED requirements stop applying and the CRA takes over.

NIS2 and digitalsikkerhetsloven

Digitalsikkerhetsloven, Norway’s implementation of the first NIS directive, took effect on 1 October 2025. Businesses it covers report incidents that significantly affect their service, providers of essential services within 24 hours (NSM).

NIS2 is not yet part of the EEA Agreement or Norwegian law. NSM says it will be introduced together with the CER directive, without a date so far. Pharus shows NIS2 as “tracked” until then.

What to do now

• Map your Art. 14(7) route: one for the company, decided by who represents, imports and distributes most of your products. Check it again when one of them changes.
• Make sure two people can file in the SRP, each with an EU Login account and multi-factor authentication.
• If you make radio equipment, check your products against EN 18031 now: the same thinking carries into the CRA.
• Watch for the EEA decision. Pharus updates the route when a date is set.

The deadlines, and what each notification must contain, are in the CRA playbook for Norwegian manufacturers. The rest of the regulation is in the CRA guide.