Article 2 Definitions

This is a definitions article, establishing the precise meaning of two key terms used throughout the Regulation.

Rather than introducing substantive obligations, it sets the terminological foundation that underpins the operative provisions — particularly those in Articles 3, 4, and 5 — which govern when and how the dissemination of vulnerability notifications may be delayed.

Both definitions are anchored in existing legal frameworks, specifically Directive (EU) 2022/2555 and Regulation (EU) 2024/2847, ensuring consistency across the broader EU cybersecurity legislative landscape.

Important points:

• The "CSIRT initially receiving the notification" refers to the designated coordinator CSIRT that first receives a vulnerability notification under Regulation (EU) 2024/2847 — this is the body that holds the power to delay dissemination under the Regulation.
• The "relevant CSIRT" is defined as the designated coordinator CSIRT covering the territory where the manufacturer has indicated the product with digital elements has been made available — establishing which CSIRTs are entitled to receive disseminated notifications.
• Both definitions rely on the designation mechanism set out in Article 12(1) of Directive (EU) 2022/2555, tying this Regulation firmly to the broader NIS2 framework.