How to report to CERT-FR under the CRA

1. Who receives your notification: ANSSI and CERT-FR

The Agence nationale de la sécurité des systèmes d'information (ANSSI) is the national authority, and CERT-FR is its operational centre. ANSSI is based in Paris and is known for a detailed regulatory apparatus and a strict use of the French language.

The chain is exactly this: the authority as the institution, CERT-FR as the operational team that reads your notification and, together with ENISA, forms the recipient set out in Art. 14.

ANSSI is France's national authority for information systems security, sitting under the General Secretariat for Defence and National Security. CERT-FR is its operational centre: it receives, qualifies and disseminates. The chain of command is short and avowedly governmental.

2. The national channel, in practice

The language of the notification is French. ANSSI publishes advisories and bulletins in French and holds a known position on the use of the language in dealings with the administration: technical documentation written only in English may require a French summary.

CERT-FR distinguishes between reports from regulated operators and spontaneous third-party reports. A manufacturer that is not an operator of vital importance goes through the general channel, and it pays to check in advance which form applies.

CERT-FR · official website

3. The landscape around it

France transposed NIS2 confirming ANSSI as the competent authority and widening the perimeter of regulated entities. The model stays centralised: one authority, one national CERT, broad powers.

For the CRA, the designation of the CSIRT receiving manufacturers' notifications still follows the national implementation of the Regulation, which is distinct from the NIS2 perimeter. Check the one in force before you file.

One last practical point: ANSSI also runs the French qualification and certification schemes and takes part in the European framework. If your product falls among the critical ones, the body receiving your notifications is also the one that knows the certification route. In France the two worlds talk more than the formal structure suggests.

4. How filing works, in short

Filing is not an email to the authority: it goes through the single reporting platform established by Art. 16, and access requires EU Login credentials validated beforehand.

The chain of deadlines — 24 hours, 72 hours, final report — is the same across the Union and is set out in full on the Art. 14 page. For the article’s other trigger the final deadline changes: it is on the severe incident page.

5. What to prepare before an incident

Five things, arranged calmly, make the difference between a report filed in time and one filed too late. The first is the contact point to CERT-FR, designated and validated, with a named substitute: on the day of the case you do not go looking for whoever holds the credentials.

In France it pays to prepare a French summary of the technical content you will have to send. Translating under pressure, inside twenty-four hours, is the simplest way to introduce an error into a document that stays on record.

And a note on time: France runs on CET/CEST and has a dense spring holiday calendar. Art. 14's twenty-four hours do not stop. A named deputy, not merely an assumed one, is what separates a rota that holds from one that exists only on the org chart.

This guide describes our reading of the regulatory text and the public procedures; it does not constitute legal advice, and the platform's operational details may evolve.