The eight Annex I Part II process requirements manufacturers must meet for the whole support period, and the Article 14 duty to notify actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, in force since 11 September 2026.
Identifying and documenting vulnerabilities and components, including a software bill of materials in a commonly used machine-readable format covering at least top-level dependencies, and who may see the SBOM.
Addressing and remediating vulnerabilities without delay in relation to their risk, including through security updates delivered separately from functionality updates where technically feasible, and the latest-version rule for software.
Applying effective and regular tests and reviews of product security across the support period, with frequency and depth proportionate to risk and updated when new threats or vulnerabilities emerge.
Publicly disclosing information about fixed vulnerabilities once a security update is available (description, affected products, impact, severity and remediation guidance) and when publication may be delayed.
Putting in place and enforcing a coordinated vulnerability disclosure policy, telling users where to find it, and keeping it in place for all versions during the support period.
Making it easy to share information about potential vulnerabilities in the product and its third-party components, including a contact address for vulnerability reports and a single point of contact for users.
Mechanisms to securely distribute updates so vulnerabilities are fixed or mitigated in a timely manner, automatically where applicable for security updates, and how the chosen solution is documented.
Disseminating available security updates without delay and free of charge, with advisory messages telling users what to do, and the exception for tailor-made products agreed with business users.
Notifying actively exploited vulnerabilities through ENISA's Single Reporting Platform: the 24-hour early warning, 72-hour notification and 14-day final report, when a manufacturer becomes aware, third-party components, and the platform's access rules.
Notifying severe incidents that affect the security of a product: what makes an incident severe, the 24-hour early warning, 72-hour incident notification and one-month final report, and the duty to inform impacted users.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.