How to report to CIRCL under the CRA

1. Who receives your notification: CIRCL and GOVCERT.LU

Luxembourg separates the recipients by type of entity: CIRCL for the private sector and municipalities, GOVCERT.LU for the State. CIRCL operates from Luxembourg City, and its technical reputation far exceeds the size of the country it serves.

The chain is exactly this: the authority as the institution, CIRCL as the operational team that reads your notification and, together with ENISA, forms the recipient set out in Art. 14.

CIRCL is Luxembourg's incident response centre for the private sector, municipalities and non-governmental entities, run by SECURITYMADEIN.LU. GOVCERT.LU serves the State instead. The split is by type of entity, not by type of event.

2. The national channel, in practice

The language of the notification can be French, English or German: Luxembourg works in three languages as a matter of course, and CIRCL publishes most of its technical material in English.

CIRCL is also the author of open tools used across Europe for sharing indicators — MISP above all. For a manufacturer it is a technically equipped counterpart that expects structured reports and knows what to do with them.

CIRCL · official website

3. The landscape around it

Luxembourg has a small, dense ecosystem built around a handful of organisations that know each other. That is an operational advantage: response times are short and the administrative path is brief.

For the CRA, the designation of the CSIRT receiving manufacturers' notifications follows the national implementation of the Regulation. Check which of the two teams is designated for your case before you file, and do not infer it from the size of your company.

One last practical point: Luxembourg has an unusual concentration of financial operators and digital service providers, and CIRCL's practice reflects that clientele. If your product serves that sector, expect high expectations on the quality of the technical report and on the use of structured formats.

4. How filing works, in short

Filing is not an email to the authority: it goes through the single reporting platform established by Art. 16, and access requires EU Login credentials validated beforehand.

The chain of deadlines — 24 hours, 72 hours, final report — is the same across the Union and is set out in full on the Art. 14 page. For the article’s other trigger the final deadline changes: it is on the severe incident page.

5. What to prepare before an incident

Five things, arranged calmly, make the difference between a report filed in time and one filed too late. The first is the contact point to CIRCL, designated and validated, with a named substitute: on the day of the case you do not go looking for whoever holds the credentials.

In Luxembourg it pays to exploit the short chain: a contact established beforehand, with a verified name and address, cuts to a few hours what elsewhere takes a procedure.

And a note on time: Luxembourg runs on CET/CEST and has a high share of cross-border workers whose holiday calendars do not coincide. Art. 14's twenty-four hours fit none of the three calendars: plan on-call cover accordingly.

This guide describes our reading of the regulatory text and the public procedures; it does not constitute legal advice, and the platform's operational details may evolve.