CLAIM-2026-08-05-03

Article 14(3)-(4) applies the same notification route to a severe incident having an impact on the security of the product, with an early warning within 24 hours noting whether unlawful or malicious acts are suspected, an incident notification within 72 hours with an initial assessment, and a final report within one month. Article 14(8) requires the manufacturer to inform impacted users of the vulnerability or incident and of risk mitigation measures, and permits CSIRTs to disseminate that information where the manufacturer does not act in time.

Why it matters

The duty to inform impacted users, and the CSIRT's power to do it for you if you are late, means the disclosure decision is no longer entirely the vendor's to time.

Sources

europeancyb2024cyber

CLAIM-2026-08-05-03

Article 14(3)-(4) applies the same notification route to a severe incident having an impact on the security of the product, with an early warning within 24 hours noting whether unlawful or malicious acts are suspected, an incident notification within 72 hours with an initial assessment, and a final report within one month. Article 14(8) requires the manufacturer to inform impacted users of the vulnerability or incident and of risk mitigation measures, and permits CSIRTs to disseminate that information where the manufacturer does not act in time.

Why it matters

The duty to inform impacted users, and the CSIRT's power to do it for you if you are late, means the disclosure decision is no longer entirely the vendor's to time.

Sources

europeancyb2024cyber