Informing users of vulnerabilities and incidents
Notifying the authorities is only half of it. Under Article 14(8), the manufacturer also has to inform its users, in a timely manner and with guidance on what they can do. If it fails to, the CSIRT may step in.
Informing users of vulnerabilities and incidents is the manufacturer's obligation under Article 14(8) to inform impacted users of an actively exploited vulnerability or a severe incident and to tell them which measures they can take.
Definition in the Regulation
Article 14(8) of Regulation (EU) 2024/2847 provides that, after becoming aware, the manufacturer "shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures that the users can deploy", "where appropriate in a structured, machine-readable format". If the manufacturer fails to do so in a timely manner, the CSIRT designated as coordinator may provide the information itself. The paragraph sets no deadline in hours. Recital 67 envisages publishing the information on the manufacturer's website or, where possible and justified, contacting users directly. As part of Article 14, the obligation has applied since 11 September 2026.
What it means for manufacturers
The Commission guidance C(2026) 5252 interprets the obligation in paragraph 220 as risk-based and proportionate. The manufacturer does not have to make everything public and may limit details to the customers concerned, especially where the details would make further attacks easier. In practice this means two stages: first a targeted message to those affected with an immediate measure, such as switching off a function, without exploit details; then, with the update, a security advisory at a stable address. If you do not know your users because you sell through distributors, inform the distribution chain and publish on your website. Who was informed, when and how belongs in your log, because that is the evidence for market surveillance.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Security advisory
- Information and instructions to the user (Annex II)
- Awareness (start of the deadlines)
- CSIRT designated as coordinator