Cybersecurity: terms and conditions for delaying the notification of incidents (delegated act)

European Commission · Have your Say · Initiative 14731

Delegated Regulation on the delayed dissemination of incident notifications under the Cyber Resilience Act · Statement of October 28, 2026

Core statement: Four narrowly defined grounds and hard time limits are a disciplined concept. But the authority to withhold security information must not rest with a single body that also measures the necessity of its own decision. For as long as it operates, a delayed dissemination is a single point of control over the security of 27 Member States – and structure protects only if the decision to delay is as transparent and verifiable as the notification itself.

What Delegated Regulation (EU) 2026/881 provides

Under the Cyber Resilience Act (Regulation (EU) 2024/2847), manufacturers report actively exploited vulnerabilities and severe incidents; the CSIRT initially receiving the notification disseminates it to the CSIRTs of all affected Member States. The delegated act, adopted by the Commission on 11 December 2025 following the feedback period of 16 October to 13 November 2025, specifies the exception: dissemination may be delayed only where the cybersecurity risks of dissemination outweigh its security benefits in light of the sensitivity of the information, where those risks cannot be mitigated through handling protocols such as TLP or PAP, and where one of four grounds applies – a fix expected within 72 hours; information sufficient to create an exploitation technique even for actors with limited skills and resources; partial information sufficient for the other CSIRTs to take adequate risk mitigation measures; or an ongoing coordinated vulnerability disclosure (CVD) procedure in which the receiving CSIRT acts as a trusted intermediary, with dissemination requiring the consent of the parties involved. Any delay is limited to what is strictly necessary; if no fix is delivered within 72 hours, dissemination becomes mandatory. Reporting obligations under the CRA have applied since 11 September 2026, with manufacturers reporting once through ENISA’s Single Reporting Platform.

Recognition: the expiry logic is the right idea

GISAD acknowledges that the act does not create a discretionary embargo, but a single-step logic: every ground for delay has a clearly defined end point – at the latest when a fix becomes available, the CVD process concludes, or the 72-hour window lapses without a fix, dissemination becomes mandatory. This expiry-date logic corresponds to the principle of the Finder-KI-Escape-Schalter: no release without a defined, enforced next step. The fourth variant in particular – dissemination in a CVD procedure only with the consent of the parties involved – is structurally exemplary, because it does not leave the decision to the office that is withholding, but to the parties whose trust the procedure depends on. The EU-D-S knows this separation of roles structurally: the trustees of a discipline organise the founding competition and may act as investors – they are in no way involved in day-to-day operations. That responsibility lies with the Primus of the respective category. Applied to the delay rule, this means: whoever carries operational responsibility must also have the information from which that responsibility arises.

Criticism: who measures „strict necessity“?

The weakness of the act lies not in its substantive grounds but in its measurement order. Whether the risks of dissemination outweigh its benefits, whether TLP/PAP are insufficient, whether partial information is „adequate“ – all of this is assessed solely by the CSIRT that is withholding. The body that benefits from the delay (control over the distribution of information) simultaneously measures the legitimacy of that delay. This is precisely the constellation the EU-D-S prevents: measurement outside the manipulable area. Every delay decision must therefore be logged, time-stamped, justified and disclosed to the CSIRTs Network and ENISA – reviewable independently after the fact, under the zero-tolerance rule that an unjustified delay is sanctioned like a failure to notify.

Structure instead of secrecy

Decentralised digitalisation does not replace a single cable – but it takes the catastrophic effect away from every cable break. The same applies to information: a delay decision taken by one body alone turns the knowledge about an actively exploited vulnerability into a cable that can lie at exactly one point. Decentralised redundancy here does not mean scattering sensitive details, but distributing the availability check: dissemination with delayable details (TLP/PAP) as the default, full withholding only as a logged, time-limited, externally measurable exception.

GISAD’s recommendations

1. Refrain from full withholding wherever partial information plus handling protocols suffice – the act already permits this; practice must make it the rule.
2. Complete logging of every delay with time stamp, applicable ground and justification; automatic notification of the delay itself (not only of the content) to the CSIRTs Network and ENISA.
3. Independent review of delay decisions within the framework of the concept-fidelity audit – not by the withholding CSIRT itself.
4. The consent logic of the CVD ground (Article 16(6) CRA) as a model: wherever a delay affects third parties whose day-to-day operations depend on the information, the one who withholds does not decide alone – just as in the EU-D-S, where the Primus of a category holds responsibility and information in one hand.
5. Secure the Single Reporting Platform with decentralised mirror structures, so that the reporting infrastructure itself does not become a single point of failure.