Security advisory
After the update comes publication. A security advisory tells users which versions are affected, what the flaw does and what to do. The CRA requires one after every security update, ideally also in machine-readable form.
A security advisory is a manufacturer's publication about a fixed vulnerability, with a description, the affected products and versions, impact, severity and guidance for users. The Regulation requires one once a security update has been made available.
Definition in the Regulation
The Regulation does not define the term, but it does set out the obligation. Under Annex I, Part II, point (4), of Regulation (EU) 2024/2847, manufacturers publish information about fixed vulnerabilities once a security update is available: a description, the affected products, impact, severity and guidance helping users to remediate. Publication may be delayed until users have had the chance to apply the update, where the risk outweighs the benefit. The obligation applies from 11 December 2027. In addition, since 11 September 2026 Article 14(8) has required manufacturers to inform impacted users of actively exploited vulnerabilities, "where appropriate in a structured, machine-readable format that is easily automatically processable".
What it means for manufacturers
The Regulation does not say what machine-readable means. The state of the art is CSAF 2.0, a JSON format for security advisories with a product tree, CVE, CVSS, status and remediation, which the German BSI recommends and supports with free tools. BSI TR-03183-3 provides for a reference to the CSAF metadata in the security.txt file. For a small or medium-sized manufacturer without a tool chain, a page with a stable address for each advisory is enough to start with: product and versions, CVE where assigned, severity, description, workaround, fixed version, date and change history. A human-readable version remains mandatory, because Annex I requires clear and accessible information. An advisory sent only in a newsletter without a permanent address is a common mistake, as are exploit details published before the update.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit