Notify business customers

Supply agreements often oblige a manufacturer to tell an OEM customer within a set number of hours of an actively exploited vulnerability or a severe incident. That is a term of a contract. It is not an Article 14 deadline, and Declara keeps the two apart: see Contractual and legal notice.

Declara sends nothing to your customers. It plans the notice, drafts the text and reminds your own team. You send it from your own address and record that you did.

Before you start

• A Growth or Partner plan. Without it, no new notices are planned.
• A member, admin or owner role (products.write) to manage customers; cases.write to work a notice on a case.

Add a customer

1. Open Settings, then Customers.
2. Under Add a customer, enter the Customer, the Notice window (hours) from 1 to 720, and an optional Contract reference.
3. Under Notify about, choose Actively exploited vulnerabilities, Severe incidents, or both.
4. Add up to ten contacts, then press Add customer.
5. On the customer's page, tick the products they use and press Save products.

Changing a window applies to cases opened afterwards. A notice already planned keeps the due time it was planned with. Archive a customer to stop planning for them.

When a notice is planned

A notice is planned for each active customer when a real case opens that:

• is of a kind the customer asked about (vulnerability or incident), and
• names a product the customer uses, and
• has an awareness time recorded.

That happens when you decide report on an alert, record an incident, or open a case from a received report. The due time is the case's awareness time plus the customer's window, in elapsed hours.

Drills are excluded. A practice case plans nothing, sends no reminder and shows no panel. The daily repair looks at open cases whose awareness is within the last 30 days: it picks up a customer linked after a case opened and backfills a case whose planning failed. Closed and withdrawn cases are not repaired. Planning can never stop an Article 14 case from opening: if it fails, the case still opens.

Work a notice

On the case, the panel Customer notices (contractual) lists each customer, its window, the due time, and whether it is Due, Overdue, Sent or Skipped.

1. Check Recipients. They start as the customer's contacts, up to 20.
2. Edit the Draft. It is written for the customer and does not quote the regulation. What only you know (the fix, the action you ask of them) is left as a visible [TODO: …].
3. Press Copy text or Open in your mail client, and send it yourself.
4. Under How did you send it?, say how, then press Mark as sent and confirm. The record cannot be edited afterwards.
5. If it is not owed, give a reason and press Skip this notice.

Reminders

The hourly job emails your workspace's own recipients, never the customer, when a notice is due in four hours, due now, and overdue, once each. The mail says it is a contractual commitment and not an Article 14 deadline. Because the job is hourly, a reminder can arrive up to an hour after its time. A late run sends the rung that applies now and skips the earlier ones. Sent and skipped notices get no reminder, and neither does a notice on a closed or withdrawn case.

In the evidence pack

A case's evidence pack lists the contractual notices under their own heading, with customer, window, due time, and whether and how each was sent or why it was skipped. They are never part of an SRP packet.

Primary source

No article of the Cyber Resilience Act governs a notice you owe a business customer under a contract. Article 14 of Regulation (EU) 2024/2847 (EUR-Lex, checked 2026-10-10) is linked for the contrast: it sets the reports to the coordinating CSIRT and ENISA (Art. 14(1) to (4)) and the duty to inform impacted users (Art. 14(8)). The window in your supply agreement comes from the agreement, not from the Regulation.

Related

• Contractual and legal notice
• Answer a customer's supplier questionnaire
• Run an Article 14 drill