Contractual and legal notice
This page reflects our reading of Cyber Resilience Act, Article 14 as of . It is not legal advice. Review process.
When an actively exploited vulnerability affects a product, a manufacturer can owe two kinds of notice at once. They look alike and are not alike.
Two different obligations
Article 14 is law. The manufacturer notifies its coordinating CSIRT and ENISA: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later (Art. 14(2), 14(4)). The deadlines are fixed. Declara computes them on the reporting clock.
A customer notice is a contract. An OEM that buys your product may have written into its agreement that you tell it within 12, 24 or 48 hours. The number is whatever you agreed, it can differ per customer, and nobody but the two parties enforces it.
Article 14(8) also asks you to inform affected users of a vulnerability and the measures they can take. A business customer's contractual notice is separate from that.
Why Declara keeps them apart
- Different clocks, different consequences. Missing a regulatory deadline is a matter for the authority. Missing a contractual one is a matter for your customer. Putting both in one countdown makes one read as the other.
- The contract window is yours to set. Declara records it per customer; it does not decide it and cannot know whether you agreed it.
- The regulatory filing must stay clean. A reporting packet carries the fields the platform asks for. Nothing about your customers belongs in it, and the code that builds the packet is not allowed to import the code that plans customer notices. A lint rule enforces that.
- The wording differs. The customer draft does not cite the regulation, because quoting it to a business customer invites them to treat it as the filing.
On the case page the notices have their own panel, Customer notices (contractual), and everywhere they appear they are labelled as not an Article 14 deadline.
What the two share
Both start from the awareness time recorded on the case, so a customer's 24-hour window and the 24-hour early warning begin together by default. A customer notice can be due earlier or later than the early warning, and sending one does not file the other.
Both are record-keeping, not sending. Declara does not submit to the reporting platform and does not send notices to customers.
What does not carry over
- Drills plan no customer notices.
- A customer notice does not appear in an SRP packet, a report draft or the platform's status record.
- The evidence pack for a case does list them, under their own heading, so an auditor can see what you owed customers and what you did.
Primary source
No article of the Cyber Resilience Act governs a notice you owe a business customer under a contract. Article 14 of Regulation (EU) 2024/2847 (EUR-Lex, checked 2026-10-10) is linked for the contrast: it sets the reports to the coordinating CSIRT and ENISA (Art. 14(1) to (4)) and the duty to inform impacted users (Art. 14(8)). The window in your supply agreement comes from the agreement, not from the Regulation.