CLAIM-2026-08-05-02

Article 14(1)-(2) requires a manufacturer that becomes aware of an actively exploited vulnerability in its product with digital elements to notify the CSIRT designated as coordinator and ENISA simultaneously through the single reporting platform: an early warning within 24 hours indicating the Member States affected, a vulnerability notification within 72 hours with general information and any corrective measures, and a final report no later than 14 days after a corrective or mitigating measure is available.

Why it matters

Twenty-four hours is not enough time to go looking. It only works if 'which of our shipped releases contains this component' is already a query, which makes SBOM coverage — including code and dependencies chosen by an agent — an operational control rather than a compliance artefact.

Sources

europeancyb2024cyber
europeancom2026cyber

CLAIM-2026-08-05-02

Article 14(1)-(2) requires a manufacturer that becomes aware of an actively exploited vulnerability in its product with digital elements to notify the CSIRT designated as coordinator and ENISA simultaneously through the single reporting platform: an early warning within 24 hours indicating the Member States affected, a vulnerability notification within 72 hours with general information and any corrective measures, and a final report no later than 14 days after a corrective or mitigating measure is available.

Why it matters

Sources

europeancyb2024cyber
europeancom2026cyber