Vulnerability notification (72-hour notification)
Within 72 hours of awareness, the actual notification is due, counted from the same moment as the early warning. It describes the product, the vulnerability, the exploitation and the measures taken.
The vulnerability notification is the second of the three reporting stages under Article 14. It is due within 72 hours of awareness and contains general information about the product, the nature of the vulnerability and of the exploit, the corrective measures taken and the measures users can take.
Definition in the Regulation
Under Article 14(2)(b) of Regulation (EU) 2024/2847, the manufacturer submits a vulnerability notification "without undue delay and in any event within 72 hours" of becoming aware. As far as available, it contains general information about the product concerned, the general nature of the exploit and of the vulnerability, any corrective or mitigating measures taken and corrective or mitigating measures that users can take and, where applicable, an indication of how sensitive the manufacturer considers the notified information to be. For severe incidents, Article 14(4)(b) provides for the corresponding incident notification, including an initial assessment. Under Article 14(6), the CSIRT may then request an intermediate report.
What it means for manufacturers
The 72 hours run from awareness, in parallel with the 24-hour deadline, not after the early warning. The counter on ENISA's reporting platform currently shows the notification as due 48 hours after the early warning is submitted; if you send the early warning early, it shows a due date that is too early, and if you send it late, one that is too late. What counts is the law, not the counter. On the platform, the 72-hour notification is a tab within the same report; the mandatory fields are general information and the time of occurrence. Only at this stage can the manufacturer invoke particularly exceptional circumstances under Article 16(2) so that the CSIRT delays passing the notification on to other Member States.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Early warning notification
- Final report
- Awareness (start of the deadlines)
- CSIRT designated as coordinator