Definition

72-hour notification

The second Article 14 stage, due within 72 hours of awareness, with general product information, an initial assessment and measures taken.

Due within 72 hours of becoming aware unless the information was already provided, the notification contains general information about the product with digital elements, the general nature of the exploit or incident, an initial assessment, and corrective or mitigating measures taken and that users can take, together with an indication of how sensitive the manufacturer considers the information. Vellaci prefills it from the early warning and the underlying vulnerability or incident record.

Reference: Art. 14(2)(b) and 14(4)(b) · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.