meta_id 3076667

On December 11, 2025, the European Commission adopted Commission Delegated Regulation (EU) 2026/881, which specifies the terms and conditions for delaying the dissemination of cybersecurity notifications under the Cyber Resilience Act (Regulation (EU) 2024/2847). The regulation establishes when computer security incident response teams (CSIRTs) designated as coordinators may delay notification dissemination to other relevant CSIRTs regarding actively exploited vulnerabilities or severe incidents affecting products with digital elements. The European Union Agency for Cybersecurity (ENISA) retains access to notified information in all cases, except in particularly exceptional circumstances involving 72-hour vulnerability notifications, where only limited information is shared. The regulation permits delays based on three primary grounds: the nature of reported information, specific CSIRT concerns, and single reporting platform compromises. For information-based delays, CSIRTs may postpone dissemination when cybersecurity risks outweigh security benefits and cannot be mitigated through protocols such as the Traffic Light Protocol or Permissible Actions Protocol. Specific conditions include: manufacturers expecting to provide security updates within 72 hours; information sufficient to create exploitation techniques; partial notifications enabling adequate risk mitigation; or coordinated vulnerability disclosure procedures where the CSIRT acts as a trusted intermediary. CSIRTs may also delay dissemination to specific relevant CSIRTs when those entities have experienced cybersecurity incidents affecting confidentiality capabilities or demonstrate inadequate capabilities. Additionally, delays are permitted when the single reporting platform has been compromised. The regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union, scheduled for April 20, 2026. Reference: http://data.europa.eu/eli/reg_del/2026/881/oj