What does the CRA require for coordinated vulnerability disclosure?

This is coordinated disclosure, not YOUR policy and not Article 14

Audience: a security lead, CISO, or product owner at an organisation that might be a manufacturer of products with digital elements under Regulation (EU) 2024/2847. This page is not legal advice. It does not start a clock. Reading it does not start a clock. Mapping a row is not a determination that the CRA applies, that you are a manufacturer, that a product with digital elements has been made available on the Union market, that a reporter submission has been received, that you have become aware, or that an Article 14 filing is due.

Coordinated vulnerability disclosure (CVD) on this page means the manufacturer's policy and contact channel for receiving vulnerability reports so the manufacturer can diagnose and remedy before detailed information is disclosed to third parties or to the public. That is Annex I Part II and Article 13(8). Article 14 is a different duty: notifying the CSIRT designated as coordinator and ENISA of an actively exploited vulnerability or a severe incident via the single reporting platform. A reporter email is not an Article 14 filing. Last verified 9 September 2026. Not legal advice.

• Statute versus guidance versus standards: Annex I Part II points (5) and (6), Article 13(6) and 13(8), Annex II point 2, and Annex VII are legal requirements only if the CRA applies. Recitals 63 and 76 aid interpretation; they are not operative articles. ENISA coordinated-vulnerability-disclosure pages and reports are agency guidance, not the regulation. ISO/IEC 29147:2018 and ISO/IEC 30111:2019 are international standards — best practice, not the CRA. This page quotes which kind of text it is relying on.
• The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The SaaS-scope guide on this site is the remote-processing versus service page. The CRA-cluster Article 14 overview on this site is how Article 14 sits in the cluster. The statute-clock Article 14 guide on this site is the ladder under breach reporting. The where-to-submit guide on this site is the Article 14 channel page. The ENISA-workflow guide on this site is the single-reporting-platform walkthrough. The CSIRT guide on this site is the coordinator-interaction page.
• A dedicated vulnerability-management, security-updates, and readiness-checklist guide is not on this site yet. Naming them is not a link.

What Annex I Part II actually requires — not a determination

Annex I Part II sets essential cybersecurity requirements relating to vulnerability handling. The CVD rows are point (5) and point (6). Article 13(8) points manufacturers at those policies for reports from internal or external sources. Annex II point 2 is user information about the single point of contact and where the policy can be found. Those texts apply from 11 December 2027 (Article 71(2), first subparagraph). Article 14 reporting applies from 11 September 2026. Those two dates are not one number. This table is not YOUR policy. Last verified 9 September 2026. Not legal advice.

Single point of contact — Annex II, Recital 63, and Annex I Part II point (6)

Three texts talk about how reporters reach the manufacturer. They are not the same kind of text. Annex I Part II point (6) is an essential requirement: a contact address. Annex II point 2 is user information: a single point of contact, and where the CVD policy can be found. Recital 63 explains that manufacturers should put in place a single point of contact so users can communicate easily, including to report and receive information about vulnerabilities, make it easily accessible, indicate availability, and keep it updated; where they choose automated tools, for example chat boxes, they should also offer a telephone number or other digital contact means, such as an email address or a contact form. Recital 63 is a recital, not an operative article. Last verified 9 September 2026. Not legal advice.

• This page does not name YOUR contact address, does not host YOUR public mailbox, and does not treat a signed-in product surface as the Annex II single point of contact.
• A security.txt file, a web form, or a mailbox may be how reporters find you. None of those formats is named as the exclusive CRA channel. Counsel maps YOUR facts to Annex I Part II point (6) and Annex II point 2.

Handling reporter submissions — structured process, not a filing

Recital 76: manufacturers of products with digital elements should put in place coordinated vulnerability disclosure policies to facilitate the reporting of vulnerabilities by individuals or entities either directly to the manufacturer or indirectly, and where requested anonymously, via CSIRTs designated as coordinators for the purposes of coordinated vulnerability disclosure in accordance with Article 12(1) of Directive (EU) 2022/2555. The policy should specify a structured process through which vulnerabilities are reported to a manufacturer in a manner allowing the manufacturer to diagnose and remedy such vulnerabilities before detailed vulnerability information is disclosed to third parties or to the public. Recital 76 also says manufacturers should consider publishing their security policies in machine-readable format, and that they should be able to use programmes as part of those policies to incentivise reporting by recognition and compensation — so-called bug bounty programmes. Recital 76 is a recital, not an operative article. Last verified 9 September 2026. Not legal advice.

• Receiving a reporter submission is not becoming aware of an actively exploited vulnerability under Article 3(42). Counsel maps YOUR facts. This page does not start a clock.
• Indirect or anonymous reporting via a NIS2 CSIRT designated as coordinator is Recital 76 plus NIS2 Article 12(1). It is not the CRA Article 14 filing desk. The CSIRT guide on this site is Article 14 coordinator interaction. The NIS2 incident-reporting guide on this site is Article 23 — a different instrument.

How CVD sits next to Article 14 — two duties, two dates

A reporter submission to the manufacturer's CVD channel is intake. Article 14 is a manufacturer notification to the CSIRT designated as coordinator and to ENISA via the single reporting platform, of an actively exploited vulnerability or a severe incident. Those two duties can meet on the same facts. They are not the same filing. This page does not start an Article 14 clock. Last verified 9 September 2026. Not legal advice.

• If a reporter submission contains, or later becomes, reliable evidence that a malicious actor has exploited a vulnerability in a system without permission of the system owner, Article 3(42) and Article 14(1) may be in play. This page does not find that. A named human still files. The statute-clock Article 14 guide on this site is the ladder.
• Article 16(2) lets the CSIRT designated as coordinator delay dissemination of an Article 14 notification on justified cybersecurity-related grounds, including where a vulnerability is subject to a coordinated vulnerability disclosure procedure as referred to in NIS2 Article 12(1). That is a CSIRT decision after a filing, not the manufacturer's CVD policy. The CSIRT guide on this site is that delay. A manufacturer CVD process is not an Article 16(2) delay.
• Article 15 voluntary reporting of vulnerabilities is a different stream from both the manufacturer's CVD channel and the Article 14 mandatory ladder. This page does not treat a reporter email as an Article 15 notification.

ISO/IEC 29147 and 30111 are best practice, not the CRA

ISO/IEC 29147:2018 (Information technology — Security techniques — Vulnerability disclosure) provides requirements and recommendations to vendors on receiving reports about potential vulnerabilities and disclosing remediation information. ISO/IEC 30111:2019 (Information technology — Security techniques — Vulnerability handling processes) provides requirements and recommendations for how to process and remediate reported potential vulnerabilities; it is intended to be used with ISO/IEC 29147. Those documents are international standards. They are best practice. They are not Regulation (EU) 2024/2847. Last verified 9 September 2026. Not legal advice.

The CRA does not say that complying with ISO/IEC 29147 or ISO/IEC 30111 is the legal requirement. Annex I Part II point (5) is the CRA text: put in place and enforce a policy on coordinated vulnerability disclosure. A later harmonised standard under the CRA may cite those ISO/IEC documents; as of last verification this page does not treat a cited ISO/IEC standard as a rewrite of Annex I. Counsel maps YOUR facts.

Legal requirement versus Commission, ENISA, and ISO/IEC materials

The table below labels each text. Do not treat an ISO/IEC standard as the article, and do not treat the article as optional because a standard exists. Last verified 9 September 2026. Not legal advice.

Policy checklist — not a template of record

This is a question list distilled from the cited CRA text. It is not a legal template, not YOUR policy, and not a finding that a hosted document meets Annex I Part II point (5). Walk it with counsel. ISO/IEC 29147 and 30111 may structure a draft; they are best practice, not the CRA.

• Does the CRA apply? Manufacturer of a product with digital elements made available on the Union market — Articles 2 and 3. This page does not run that test. Marking CRA in an obligation map is not that determination.
• Is there a coordinated vulnerability disclosure policy, put in place and enforced — Annex I Part II point (5)? Hosting a draft is not enforcement.
• Is there a contact address for reporting vulnerabilities in the product, including in third-party components — Annex I Part II point (6)?
• Do the information and instructions to the user name the single point of contact and where the CVD policy can be found — Annex II point 2?
• Do the policies and procedures process reports from internal and external sources — Article 13(8)?
• Does the technical documentation include the CVD policy and evidence of the contact address — Annex VII?
• Is the structured process (Recital 76 — recital, not an operative article) clear enough that a reporter can submit, and the manufacturer can diagnose and remedy, before detailed public disclosure?
• If a report is, or becomes, an actively exploited vulnerability under Article 3(42), is Article 14 in play? This page does not start that clock. The statute-clock Article 14 guide on this site is the ladder. The where-to-submit guide on this site is the channel.
• Do not treat ISO/IEC 29147 as the CRA. Do not treat a NIS2 CSIRT CVD path as an Article 14 filing. Do not treat this product as publishing YOUR policy to users.
• Document the assessment, including a not-in-scope decision. This page does not keep YOUR file.

What to do now

As of last verification on 9 September 2026, Article 14 applies from 11 September 2026 — two days from that verification date. The Annex I Part II CVD-policy essential requirement applies from 11 December 2027. The list below is operational preparation. It is not a determination that the CRA applies to YOU, that you are a manufacturer, or that a reporting clock has started. Walk it with counsel.

• Ask counsel whether YOU are a manufacturer of a product with digital elements made available on the Union market. This page does not run that test.
• If counsel says Annex I Part II may apply, draft and enforce a coordinated vulnerability disclosure policy and a contact address. This page is not that policy. ISO/IEC 29147 and 30111 are best-practice structure, not the CRA.
• If counsel says Article 14 may apply to a reporter submission that is an actively exploited vulnerability, open the statute-clock Article 14 guide on this site for the 24-hour / 72-hour / 14-day ladder and the where-to-submit guide on this site for the channel. This page does not start that clock.
• Do not treat an ISO/IEC standard as Annex I. Do not treat a recital as an operative article. Do not treat this product as publishing YOUR CVD policy or filing Article 14.
• A dedicated vulnerability-management, security-updates, and readiness-checklist guide is not on this site yet. Naming them is not a link.

Where this shows up in ShipReady Metrics

The signed-in app does not decide that the CRA applies, does not decide that you are a manufacturer, does not publish YOUR coordinated vulnerability disclosure policy to users, does not write Annex II user information, does not host YOUR public reporter mailbox, does not start an Article 14 clock, does not file with a CSIRT or ENISA, and does not affix a CE mark. None of the surfaces below is 'CRA applies', 'this policy is enforced', 'this clock has started', or an instruction to submit a filing.

If you already have a session: signed-in app → Compliance → Policies Library can host a coordinated vulnerability disclosure policy the organisation authors. The CRA starter set lists Vulnerability & Patch Management as a must-have template; the library also accepts another policy type the organisation creates. Hosting a document is not publishing it to users, not Annex II point 2, not the single point of contact, not enforcement of Annex I Part II point (5), and not CE marking. The template is a starter outline, not a CRA-conformant CVD policy, and not legal advice. signed-in app → Compliance → CRA reporting tracks the Article 14 24-hour / 72-hour / 14-day ladder from recorded awareness for findings the organisation classified as CRA-in-scope. That tracker does not start an Article 14 clock, does not decide that a reporter submission is an actively exploited vulnerability, and does not file. A named human still publishes the policy and still submits Article 14 notifications. The obligation map lists frameworks marked in-scope, including cra if that mark is set. That mark is not a determination that the CRA applies.

Signed-in Security → Findings is vulnerability-management intake from scanners the organisation connected (Dependabot, code scanning, DAST, secret scanning). Signed-in admin Compliance Ops can record Vulnerability Disclosure Program reports the organisation already received (reporter contact stored as a hash) when that module is on. Neither surface is a public reporter mailbox for YOUR product, neither publishes the CVD policy, neither starts an Article 14 clock, and neither files with a CSIRT or ENISA. This page does not document a public demo URL. There is no public CRA demo path.

Primary sources (last verified 9 September 2026)

Every regulatory or guidance claim on this page is taken from one of these. If a later revision of a source changes the rule, the date above is how you can see we have not re-checked yet.

Regulation (EU) 2024/2847 of 23 October 2024 (Cyber Resilience Act), Annex I Part II points (4), (5) and (6), Article 13(6) and 13(8), Annex II point 2, Annex VII, Recitals 63 and 76, and Articles 14, 15, 16 and 71(2), is a legal requirement only if it applies. Recitals are not operative articles. Article 14 applies from 11 September 2026; Annex I essential requirements and Article 13 apply from 11 December 2027 (Article 71(2)). Directive (EU) 2022/2555 Article 12(1) is NIS2 — a different instrument; the NIS2 incident-reporting guide is on this site. The European Commission's CRA policy page (updated 7 September 2026) and CRA summary page are Commission materials, not the regulation. ENISA's vulnerability-disclosure topic page and Coordinated Vulnerability Disclosure Policies in the EU (April 2022) are agency materials, not the regulation. ISO/IEC 29147:2018 and ISO/IEC 30111:2019 are international standards — best practice, not the CRA. These are not a complete world list. Not legal advice.

The statute-clock Article 14 guide on this site is the live ladder under breach reporting. The CRA-cluster Article 14 overview on this site is how Article 14 sits in the cluster. The CRA overview on this site is the pillar page. The who-is-covered guide on this site is the economic-operator roles page. The SaaS-scope guide on this site is the remote-processing versus service page. The where-to-submit guide on this site is the Article 14 channel page. The ENISA-workflow guide on this site is the single-reporting-platform walkthrough. The CSIRT guide on this site is the coordinator-interaction page. A dedicated vulnerability-management, security-updates, and readiness-checklist guide is not on this site yet. Naming them is not a link.

Frequently asked questions