CLAIM-2026-08-05-04

Article 3(42) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner. Article 3(13) defines a manufacturer as a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark, whether for payment, monetisation or free of charge.

Why it matters

Two scope surprises in one article. The trigger is exploitation in any system, not necessarily the manufacturer's own, so a quiet internal estate is no defence. And 'free of charge' in the manufacturer definition pulls in free tiers and self-published tooling.

Sources

europeancyb2024cyberc

CLAIM-2026-08-05-04

Article 3(42) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner. Article 3(13) defines a manufacturer as a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its own name or trademark, whether for payment, monetisation or free of charge.

Why it matters

Sources

europeancyb2024cyberc