Single point of contact for vulnerabilities
Users should be able to reach the manufacturer directly and rapidly, including to report vulnerabilities. Article 13(17) requires a single point of contact for this that is easy to find and is included in the information for users. What it looks like is up to the manufacturer.
The single point of contact for vulnerabilities (SPoC) is the contact point designated by the manufacturer under Article 13(17), through which users can communicate with it directly and rapidly and report vulnerabilities in the product.
Definition in the Regulation
Article 13(17) of Regulation (EU) 2024/2847 requires a single point of contact that enables users "to communicate directly and rapidly" with the manufacturer, "including in order to facilitate reporting on vulnerabilities of the product with digital elements". It must be easily identifiable and included in the information and instructions to the user under Annex II. Users must be able to choose their means of communication, and the contact point must not be limited to automated tools. In addition, Annex I, Part II, point (6) requires a contact address for reporting discovered vulnerabilities. Under Article 71(2), both obligations apply from 11 December 2027.
What it means for manufacturers
A contact form does not count as an automated tool: recital 63 names it explicitly, alongside a phone number and an e-mail address, as a means of contact that should complement a chat box. On its own, however, it is still unlikely to be enough, because under Article 13(17) users should be able to choose their means of communication, and a choice requires more than one channel. BSI TR-03183-3 goes into more detail: role mailboxes psirt@ and csirt@, a web form that allows anonymous reports, e-mail and phone as contact channels, handling in at least English, and a central reporting page that is linked from the home page and usable without logging in. The address belongs in the security.txt file, in the product documentation and in the information for users under Annex II. The contact point should not be confused with the CSIRT designated as coordinator, to which the manufacturer itself reports; this is about the route from outside to the manufacturer. What matters is that someone reads what comes in, including at weekends, because a report received through this channel can turn into a reporting obligation under Article 14 within hours.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- security.txt
- Information and instructions to the user (Annex II)
- PSIRT
- Coordinated vulnerability disclosure (CVD)