Skip to content
Can you sign an 8-hour vulnerability reporting clause?
Back to Blog
#EU Cyber Resilience Act#CRA reporting obligations#ENISA Single Reporting Platform#product security compliance#IoT device security#vulnerability disclosure#supplier notification clause#reshaped-v3

Can you sign an 8-hour vulnerability reporting clause?

Zohaib Masood

You can sign an eight-hour vulnerability notification clause, and you should expect to be asked for one. It becomes signable once three things are fixed: the clock starts when your own assessment gives you reasonable certainty that your component is being exploited, the window is a stated number of hours rather than a phrase, and the clause names the fields your notice has to carry. Leave any of the three open and the same clause turns every alert in your log into a potential breach of contract.

The number exists because your client is on a clock of its own. Since 11 September 2026 a manufacturer placing a product with digital elements on the EU market must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available — or within a month of the 72-hour notification, where it was an incident. Your hours are carved out of that first 24.

European Commission page section headed What are the main rules, setting out the 24-hour early warning, 72-hour notification and 14-day final report under the Cyber Resilience Act
From Cyber Resilience Act – Reporting obligations, European Commission, updated 11 September 2026.

You never file anything yourself. The manufacturer reports once, through ENISA's Single Reporting Platform, to the national incident response team where it has its main establishment, and ENISA receives it at the same time. Your obligation stops at telling the client, with enough in the message that their filing can be built from it. Say so in the clause: it keeps the choice of team, the platform account and the consequences of filing in the wrong place with the party that owns the product.

What the clock starts from

Tie the trigger to the regulator's own test, not to the client's opinion. The Commission's guidance of 27 July 2026 treats a manufacturer as aware once an initial assessment gives a "reasonable degree of certainty" that an actively exploited vulnerability exists or that a severe incident has compromised the product's security. Written into your clause, that means the window opens when your assessment reaches that standard for your component — not when a scanner fires, not when a researcher emails, and not when someone downstream forms a suspicion.

Strike "immediately" and "without undue delay". Both are unbounded, and an unbounded window is one you fail retrospectively, after the fact is known and the reasonable response looks obvious. A number you can staff is safer for both sides than a phrase that only gets interpreted during an argument. The deadlines run through weekends and public holidays, and they apply to products already on the market — including a controller whose firmware you delivered years ago and have not touched since.

What the notice has to carry

Attach the field list as a schedule so nobody drafts it from memory. ENISA's Single Reporting Platform glossary, version 1.3 of 10 September 2026, sets out what gets typed in, and the required ones are short: whether it is a vulnerability or an incident, a title under 255 characters, a summary under 4,000, the product name, the affected version or range written as a range, and the Member States where the product is available.

ENISA CRA Single Reporting Platform glossary table showing the notification type, title and summary fields with their formats and character limits
From the CRA SRP Glossary, version 1.3, ENISA, 10 September 2026.

Three more decide how useful your notice is, even though the platform marks them optional at the early-warning stage: the component name, the attack vector in 255 characters or fewer, and what users can do to reduce the impact before a fix ships. Supply those for your component, in the glossary's order, and the client's filing becomes a paste rather than a fortnight of email.

None of it works if you learn about exploitation from a phone call. An eight-hour window from awareness is only honest if awareness can reach you: a disclosure address a person actually reads outside office hours, and a telemetry channel from the deployed product that shows a build doing something it should not. That is the engineering the clause quietly assumes, and it is worth costing before the clause is signed rather than after.

Holding a draft notification clause, or building the telemetry that makes one workable? Send it to Vesprr's software team.

Sources