Skip to content
CRA Reporting Desk

CRA Article 16(2) particularly exceptional circumstances: delay ≠ skip the SRP

Teams hear “particularly exceptional circumstances” (PEC) in the ENISA Single Reporting Platform and invent a pause button: withhold the filing, wait out the 72 hours, or treat limited ENISA visibility as “not reported.” Article 16(2) is a dissemination rule for sensitive actively exploited vulnerability notifications — not a rewrite of Article 14’s clocks.

The short version

  • Still file: 24h early warning + 72h notification + final via the SRP to your coordinating CSIRT (Article 14).
  • PEC is narrow: manufacturer flags one of Article 16(2)(a)–(c) on the 72-hour AEV notification (Article 14(2)(b)).
  • ENISA gets a stub first: notification made + general product + general exploit nature + that security grounds were raised — not “file nowhere.”
  • CSIRT delay ≠ PEC: ordinary Article 16(2) delay of cross-MS dissemination (Delegated Reg (EU) 2026/881) is a separate limb; CSIRT informs ENISA of the delay.
  • Clocks unchanged: awareness still starts 24h / 72h; finals still follow Article 14(2)(c) / 14(4)(c).
  • Live now: Article 14 / SRP from 11 September 2026 (Article 71(2)).
Track your Article 14 clockOpen the deadline calculator

What Article 16(2) actually does

After a notification arrives, the coordinating CSIRT shall, without delay, disseminate it via the Single Reporting Platform to the CSIRTs of Member States where the manufacturer indicated the product has been made available. That is the default. Article 16(2) then builds two related exceptions around sensitivity and cybersecurity risk — neither cancels the manufacturer's duty to submit through the Single Reporting Platform to the right coordinating CSIRT.

Limb 1: CSIRT-delayed dissemination (exceptional circumstances)

In exceptional circumstances — in particular upon manufacturer request and in light of the sensitivity indicated under Article 14(2)(a) — dissemination to other relevant CSIRTs may be delayed on justified cybersecurity-related grounds for a period that is strictly necessary, including where a vulnerability is in a coordinated vulnerability disclosure procedure under NIS2 Article 12(1). If the CSIRT withholds, it must immediately inform ENISA, justify the withhold, and indicate when it will disseminate. ENISA may support the CSIRT on applying those grounds.

The Commission's Delegated Regulation (EU) 2026/881 (delegated act of 11 December 2025 under Article 14(9) / Article 16(2)) specifies the terms and conditions for those cybersecurity-related grounds. Recital material and the delegated act itself stress that this delay track is about further dissemination to other CSIRTs — not about denying ENISA access except under the stricter PEC case below. Confirm the current OJ text before you rely on a specific ground in a live case.

Limb 2: particularly exceptional circumstances (PEC)

In particularly exceptional circumstances, where the manufacturer indicates in the notification referred to in Article 14(2)(b) that:

  • (a) the notified vulnerability has been actively exploited by a malicious actor and, according to the information available, it has been exploited in no other Member State than the one of the CSIRT designated as coordinator to which the manufacturer has notified the vulnerability;
  • (b) any immediate further dissemination of the notified vulnerability would likely result in the supply of information the disclosure of which would be contrary to the essential interests of that Member State; or
  • (c) the notified vulnerability poses an imminent high cybersecurity risk stemming from the further dissemination;

then only the information that a notification was made by the manufacturer, the general information about the product, the information on the general nature of the exploit and the information that security related grounds were raised are to be made available simultaneously to ENISA until the full notification is disseminated to the CSIRTs concerned and ENISA. If ENISA sees a systemic internal-market risk on that stub, it shall recommend full dissemination to the recipient CSIRT.

ENISA's SRP guidance and FAQ 21 map this third subparagraph to the platform's PEC toggle on the 72-hour AEV notification: assess during the first 72 hours where applicable; flag the limb; the CSIRT designated as coordinator remains responsible for whether and when full sharing (including full ENISA access) happens. Status may show as “72h Submitted under PEC.” That is still a submitted Article 14(2)(b) notification — not a draft you kept offline.

What PEC does not change

Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). The mandatory cascade stays: early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final — for an AEV, no later than 14 days after a corrective or mitigating measure is available (Article 14(2)(c)); for a severe incident, within one month after the 72-hour incident notification (Article 14(4)(c)). Detail: reporting deadlines, 72-hour notification contents, when the measure starts the AEV final. Sensitivity marking on the early warning (Article 14(2)(a)) feeds the CSIRT's delay assessment; it is not a substitute for filing.

A severe-incident track under Article 14(3)–(4) still goes through the SRP. Do not invent a “PEC for severe” that the Regulation's particularly-exceptional ENISA-stub limb attaches to Article 14(2)(b) AEV notifications. Cross-check track choice on AEV vs severe incident.

The trap: “we’ll withhold until PEC clears”

Two failure modes show up in triage. First: the team treats PEC as permission to miss the 24-hour early warning while legal debates Article 16(2)(a)–(c) — inventing a dissemination pause that Article 14 does not grant. Second: the team assumes limited ENISA visibility means “not reported,” or that a CSIRT delay of cross-border dissemination closed the SRP case. File the early warning and 72-hour notification on time; record any PEC limb and justification in the evidence log; keep the SRP fields checklist and report template aligned with what you actually toggled. Official filing still goes through ENISA's portal — see also notifying an actively exploited vulnerability.

Questions people ask

Does marking particularly exceptional circumstances (PEC) mean I can skip CRA Article 14 reporting?
No. Article 14 still requires the early warning, the 72-hour notification and the final report through ENISA’s Single Reporting Platform to your coordinating CSIRT. Article 16(2)’s particularly exceptional circumstances limb only changes what is made available simultaneously to ENISA for a 72-hour actively exploited vulnerability notification under Article 14(2)(b), and how cross-Member-State dissemination may be handled — it is not a reporting holiday.
When can a manufacturer invoke PEC?
In the Article 14(2)(b) vulnerability notification (the 72-hour AEV filing), where the manufacturer indicates one of the three Article 16(2) limbs: (a) exploitation confined, on available information, to the Member State of the coordinating CSIRT that received the notification; (b) immediate further dissemination would likely disclose information contrary to that Member State’s essential interests; or (c) the notified vulnerability poses an imminent high cybersecurity risk stemming from further dissemination. ENISA’s SRP guidance treats the PEC toggle as applying to that 72-hour AEV notification — not as a free-standing excuse to withhold the early warning.
What does ENISA receive if PEC is invoked?
Until the full notification is disseminated to the CSIRTs concerned and ENISA, only: that a notification was made by the manufacturer; general information about the product; information on the general nature of the exploit; and that security-related grounds were raised. The coordinating CSIRT still receives the filing via the SRP; PEC is not “file nowhere.”
Is PEC the same as the CSIRT delaying dissemination to other Member States?
Related, not identical. Article 16(2) first lets the coordinating CSIRT delay dissemination to other relevant CSIRTs on justified cybersecurity-related grounds (including on manufacturer request and sensitivity indicated under Article 14(2)(a)), for a period that is strictly necessary — with Delegated Regulation (EU) 2026/881 spelling out those grounds. Particularly exceptional circumstances are the stricter third-subparagraph case that also limits simultaneous full ENISA access for the 72-hour AEV notification. A CSIRT delay of cross-border dissemination does not, by itself, cancel your duty to file.
Does PEC pause the 24-hour or 72-hour clock?
No. Article 14(2)(a)–(b) still run from becoming aware without undue delay and in any event within 24 and 72 hours. Assessing whether a PEC limb fits is work inside that window — ENISA’s FAQ says to assess PEC during the first 72 hours where applicable — not a reason to miss the early warning while counsel debates dissemination.
Can ENISA still push for full dissemination?
Yes. Article 16(2) says that where, based on the limited information, ENISA considers there is a systemic risk affecting security in the internal market, it shall recommend to the recipient CSIRT that it disseminate the full notification to the other CSIRTs designated as coordinators and to ENISA itself. Treat PEC as narrow and reviewable, not as permanent secrecy.

Track the clocks — decide PEC inside the 72-hour window

The free desk and deadline calculator count the 24-hour, 72-hour and final-report deadlines from the right triggers. Use that window to record sensitivity and any PEC limb with counsel — not to invent a filing pause. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a concrete organisation is a CRA manufacturer of an in-scope product with digital elements, whether a case is an actively exploited vulnerability, whether any Article 16(2) limb or Delegated Regulation (EU) 2026/881 ground applies on your facts, and what you submit — are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Article 16(2) (including the particularly exceptional circumstances third subparagraph and ENISA-stub fields), Article 14(1)–(2)/(4)/(7)/(9), Articles 69(3) and 71(2) for application timing, and ENISA SRP FAQ / PEC guidance for platform behaviour. Confirm against the Official Journal text (CRA on EUR-Lex), the current text of Delegated Regulation (EU) 2026/881, and current Commission / ENISA guidance before relying on this for a live case.