EU Cyber Resilience Act Art. 15: Voluntary reporting of vulnerabilities, threats, incidents and near misses

Manufacturers and any other person may voluntarily notify a coordinating CSIRT or ENISA of vulnerabilities, cyber threats that could change a product's risk profile, incidents affecting product security and near misses. Where someone other than the manufacturer reports an exploited vulnerability or severe incident, the CSIRT informs the manufacturer. Voluntary reports are kept confidential and create no extra obligations for the reporter.