Vulnerability disclosure policy for firmware under the CRA

Short answer: Manufacturers in scope must have and enforce a coordinated vulnerability disclosure policy and a contact address for reports. For a firmware, publish it where researchers actually look: security.txt, a PSIRT email, and a contact in your component datasheets.

What a CVD policy for a firmware should cover

• Where and how to report (email/form/platform), languages, encryption.
• What you promise: acknowledgement time, status updates, target fix timelines.
• Safe-harbour wording for good-faith research.
• How you coordinate disclosure and credit reporters.
• Link to your support period and how fixes reach users.

Related: Is my firmware in scope? · 24h reporting

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30