Topic

User notification

Telling users, separately from telling authorities.

After becoming aware of an actively exploited vulnerability or a severe incident, the manufacturer informs impacted users — and where appropriate all users — about it and about corrective measures F-032. This runs separately from the authority-facing track with its 24-hour and 72-hour clocks F-028.

Two audiences, two jobs

The authority notification is structured and platform-mediated; the user notification is a communication problem: reach the people running the product, tell them what to do F-032. Annex II quietly sets up the channel in advance — the user information includes a single point of contact for vulnerability reporting and manufacturer contact details F-020.

What good looks like

A pre-written notification template, a tested delivery channel, and a decision tree for "impacted users" versus "all users" F-032. None of that can be improvised well at hour 20 of an incident.

Verified facts this page relies on

F-032 After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer informs impacted users, and where appropriate all users, without undue delay, including risk-mitigating and corrective measures. Art. 14(8)
F-020 User information and instructions (Annex II): manufacturer identity and contact; single point of contact for vulnerability reporting; product identification; intended purpose and security environment; circumstances that may lead to significant cybersecurity risks; where fixed-vulnerability information is published; support period end date; update installation and opt-out; secure decommissioning; access to the SBOM where relevant. Annex II, Art. 13(18)
F-028 Actively exploited vulnerability: early warning within 24 hours of awareness; notification within 72 hours; final report within 14 days after a corrective or mitigating measure is available. Art. 14(1)–(2)

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

This area is still moving. Track changes with CEMarque Watch.