These applied before everything else
What triggers a report
Voluntary reporting of other vulnerabilities, near misses and threats is provided for separately in Article 15, and does not carry the same clocks.
- An actively exploited vulnerability contained in one of your products. Not any vulnerability — one being exploited.
- A severe incident having an impact on the security of the product.
The three stages
| Stage | Deadline | What it must contain |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | That the event has happened, and where applicable whether you suspect unlawful or malicious acts. Short. It is a heads-up, not an analysis. |
| Notification | Within 72 hours of becoming aware | General information about the vulnerability or incident, its severity and impact, and where available any corrective or mitigating measures taken or advised. |
| Final report | 14 days for a vulnerability, one month for a severe incident | For a vulnerability: a description, the affected products, the severity and impact, and the security update or corrective measures. For an incident: a detailed description, the type of threat or root cause, and the mitigations applied. |
The clocks run from awareness
Every deadline is measured from the moment you became aware — not from when the vulnerability was introduced, not from when you opened a ticket, and not from when you finished investigating.
That makes the awareness timestamp the single most important fact to record accurately. Getting it wrong in your favour is not a strategy: the surrounding evidence — your support inbox, your monitoring, the reporter’s own email — will establish it.
Who you report to
Simultaneously to the CSIRT designated as coordinator for the relevant member state and to ENISA, through the single reporting platform established under Article 16.
Separately, and often forgotten: where there is a severe incident affecting the security of the product, you must inform the impacted users, and where necessary the public, about the incident and any corrective measures they can take.