CLAIM-2026-09-12-05

Article 3(13) defines a manufacturer as a person who develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark; Article 3(42) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.

Why it matters

Two consequences: software given away under your own name still makes you the manufacturer, and the reporting trigger is exploitation in any system, not an incident in yours.

Sources

• europeancyb2024definitio