Art. 17 Other provisions related to reporting | CRA regulation | CRA

This article directly follows the notification and reporting obligations established in Articles 14 and 15, and deals with what happens after those notifications are made.

It covers the downstream use of reported vulnerability and incident information across the EU's cybersecurity infrastructure.

The article assigns roles to ENISA and the CSIRTs designated as coordinators in terms of sharing information with wider EU bodies, publishing vulnerability data, producing periodic trend reports, and supporting manufacturers in meeting their reporting obligations.

Importantly, it also provides a liability protection, confirming that the act of notifying does not in itself expose the notifying party to greater legal risk.

Important points:

ENISA is required to produce a technical report on emerging cybersecurity risk trends in products with digital elements every 24 months, submitted to the Cooperation Group.
The act of notification under Articles 14 and 15 shall not subject the notifying person or entity to increased liability.
CSIRTs designated as coordinators are required to provide helpdesk support to manufacturers regarding their reporting obligations under Article 14, with particular attention to microenterprises and small and medium-sized enterprises.

1. ENISA may submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established under Article 16 of Directive (EU) 2022/2555 information notified pursuant to Article 14(1) and (3) and Article 15(1) and (2) of this Regulation if such information is relevant for the coordinated management of large-scale cybersecurity incidents and crises at an operational level. For the purpose of determining such relevance, ENISA may consider technical analyses performed by the CSIRTs network, where available.
1. Where public awareness is necessary to prevent or mitigate a severe incident having an impact on the security of the product with digital elements or to handle an ongoing incident, or where disclosure of the incident is otherwise in the public interest, the CSIRT designated as coordinator of the relevant Member State may, after consulting the manufacturer concerned and, where appropriate, in cooperation with ENISA, inform the public about the incident or require the manufacturer to do so.
1. ENISA, on the basis of the notifications received pursuant to Article 14(1) and (3) and Article 15(1) and (2) of this Regulation, shall prepare, every 24 months, a technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555. The first such report shall be submitted within 24 months of the date of application of the obligations laid down in Article 14(1) and (3) of this Regulation. ENISA shall include relevant information from its technical reports in its report on the state of cybersecurity in the Union pursuant to Article 18 of Directive (EU) 2022/2555.
1. The mere act of notification in accordance with Article 14(1) and (3) or Article 15(1) and (2) shall not subject the notifying natural or legal person to increased liability.
1. After a security update or another form of corrective or mitigating measure is available, ENISA shall, in agreement with the manufacturer of the product with digital elements concerned, add the publicly known vulnerability notified pursuant to Article 14(1) or Article 15(1) of this Regulation to the European vulnerability database established pursuant to Article 12(2) of Directive (EU) 2022/2555.
1. The CSIRTs designated as coordinators shall provide helpdesk support in relation to the reporting obligations pursuant to Article 14 to manufacturers and in particular manufacturers that qualify as microenterprises or as small or medium-sized enterprises.

Article 17 Other provisions related to reporting

Relevant recitals