Terms and conditions for delaying dissemination of notifications

Commission Delegated Regulation (EU) 2026/881 of 11 December 2025 supplementing Regulation (EU) 2024/2847 of the European Parliament and of the Council by specifying the terms and conditions for applying the cybersecurity-related grounds in relation to delaying the dissemination of notifications

The Delegated Regulation supplements the Cyber Resilience Act (Regulation (EU) 2024/2847) by specifying the terms and conditions under which a coordinating CSIRT may delay dissemination of notifications received via the single reporting platform. Under the CRA, manufacturers must notify the CSIRT designated as coordinator of actively exploited vulnerabilities and severe incidents affecting products with digital elements; these notifications are normally shared without delay with the CSIRTs coordinating in the Member States where the product is made available. This Regulation sets out three grounds on which the CSIRT initially receiving a notification may instead delay dissemination for a period strictly necessary: the sensitivity of the notified information based on an evaluation of its nature, the inability of a receiving CSIRT to ensure the confidentiality of the information, and concerns about the security of the reporting platform itself. It specifies that a delay may apply only where the cybersecurity risks of further dissemination outweigh the security benefits to the Union and cannot be adequately mitigated by restricting handling and further sharing instead. Where a CSIRT invokes these grounds, it must immediately inform ENISA of the decision to delay, its reasons, and when it intends to further disseminate the notification. ENISA's own access to delayed notifications is limited to general information and the stated grounds, except in specified exceptions.