What happened
Commission Delegated Regulation (EU) 2026/881, adopted on 11 December 2025 and published in the Official Journal on 20 April 2026, specifies the terms and conditions under which the CSIRT that receives a manufacturer's notification may delay passing it on to the other CSIRTs, on cybersecurity-related grounds (Article 16(2) of the CRA).
What it means for machine builders
When you notify an actively exploited vulnerability through the Single Reporting Platform, the notification normally reaches the CSIRTs of every Member State where your machines are on the market and ENISA. This act sets when the coordinating CSIRT may hold it back, for example while a fix is not yet available. Your after-sales team should know this when deciding what to tell customers and when: the dissemination rules and your own customer notice under Article 14(8) are two different clocks.
Where Shield Lifecycle fits
Shield Lifecycle keeps the notification record and the formal notice to the customer in one place, so the two clocks are visible side by side. Shield Lifecycle
Official source EUR-Lex, Commission Delegated Regulation (EU) 2026/881
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.