ENISA Launches CRA Reporting Platform as Security and Privacy Oversight Expands
Summary
The roundup covers ENISA’s CRA incident-reporting platform, NIST guidance for protecting cloud identity tokens, expanded Polish healthcare inspections after a major medical-data breach, and new European and U.S. privacy and AI oversight developments.
Key points
- ENISA launched the initial capability of the CRA Single Reporting Platform on 11 September 2026, giving manufacturers a shared channel to report actively exploited vulnerabilities and severe incidents affecting products with digital elements.
- CISA and NIST issued guidance on protecting identity tokens and assertions, recommending short-lived tokens, protected signing keys, strict validation, scoped credentials, tamper-resistant event logging and token revocation measures.
- Poland’s data protection authority expanded healthcare inspections after the MyDr breach. The incident’s precise scale was not established; media reports cited potentially affected healthcare entities and patients.
- France’s CNIL issued GDPR guidance for mandatory electronic invoicing, emphasizing data minimization, appropriate controller-processor roles, access controls, authentication and security measures beyond infrastructure certifications.
- A JRC-Europol study examined privacy-enhancing technologies’ implications for law enforcement, including encrypted computing, privacy-preserving machine learning and potential effects on access to electronic evidence.
- California ordered work on independent oversight of advanced AI systems and recommendations on measures including verified audits, broader critical-incident reporting and a proposed frontier-model “kill switch.”
Article Details
- Event Type
- Multiple security, privacy, and technology-policy developments, including the launch of the CRA Single Reporting Platform, a healthcare data breach investigation, and new cloud identity token security guidance.
- Impact
- ENISA's platform provides a shared reporting mechanism for actively exploited vulnerabilities and severe incidents affecting products with digital elements. Following the MyDr cyberattack, UODO plans expanded healthcare inspections; media reports cited approximately 12,000 healthcare entities and nearly 19 million people potentially affected, while the precise scale was not initially established. CISA and NIST issued recommendations for protecting identity tokens and assertions from forgery, theft, and misuse.
People
Gavin NewsomCalifornia Governor who signed Executive Order N-9-26 on AI oversight.Ken PaxtonTexas Attorney General who issued a consumer alert about CIPA demand letters.Mirosław WróblewskiPresident of UODO who ordered additional inspections of healthcare organisations following the MyDr cyberattack and other reported breaches.Vivek ShahNamed in the Texas Attorney General's alert as a serial CIPA plaintiff; the alert says he was declared a vexatious litigant and is barred from filing certain claims in the U.S. District Court for the Central District of California without prior permission.