Compliance
Vulnerability disclosure is becoming a legal expectation
How the EU Cyber Resilience Act and similar rules are turning a disclosure policy into a requirement for many vendors.
For years, publishing a vulnerability disclosure policy was a sign of good practice. Increasingly, it is a legal expectation. Regulators have recognised that outside researchers find real flaws, and that vendors need a reliable way to hear about them.
The EU Cyber Resilience Act
The Cyber Resilience Act sets security requirements for products with digital elements sold in the EU. Among them, manufacturers must have a coordinated vulnerability disclosure policy, provide a contact address for reporting vulnerabilities, and handle reported issues without delay. The Act also introduces duties to report actively exploited vulnerabilities to the authorities, with obligations phased in over the coming years.
Other frameworks pointing the same way
The UK's Product Security and Telecommunications Infrastructure regime requires makers of consumer connectable products to publish how security issues can be reported. In the United States, federal agencies are required to maintain disclosure policies, and the international standards ISO/IEC 29147 and ISO/IEC 30111 describe how disclosure and vulnerability handling should work.
What a compliant program needs
At a minimum: a published policy that explains what is in scope and how to report; a monitored reporting channel; a commitment not to take legal action against good-faith researchers; and a defined internal process to assess, fix and communicate about reports. A security.txt file on your website helps researchers find the right contact.
Why a hosted program helps
Building intake in-house means staffing an inbox, filtering noise and tracking every report to resolution. A hosted disclosure program with managed triage handles intake and validation, and keeps a record of every report and response — the evidence auditors and regulators ask for.
Starting with disclosure also leaves room to grow. When you are ready to actively invite testing, adding rewards turns the same program into a bug bounty without changing your process.
This article is general information, not legal advice. Check the specific obligations that apply to your products and markets.