The general rule
ENISA explains that manufacturers are responsible for identifying the correct CSIRT designated as coordinator (CDaC). In general, this is based on the manufacturer's main establishment in the EU—the place where decisions related to product cybersecurity are predominantly taken.
If the main establishment cannot be determined
ENISA's current FAQ provides fallback criteria. If the main establishment cannot be determined, the next reference is the EU establishment with the highest number of employees. For manufacturers without a main EU establishment, further fallbacks include the Member State tied to the authorised representative, importer, distributor or, ultimately, the highest number of users.
Why the choice matters
ENISA notes that selecting the wrong CDaC may cause the notification to be invalidated and require resubmission. That makes the CSIRT decision something manufacturers should document before a real reporting event wherever possible.
Official guidance: ENISA SRP FAQ