nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".

▲

imtringued 3 hours ago | parent | next [-]

They have literal 24 hour and 72 hour deadlines. Obviously, they might put a blind eye to it if you are reliable but delayed the reporting by a day, but the 24 hour and 72 hour deadlines are a fact. You have to initiate the reporting immediately.

	▲	arghwhat 2 hours ago \| parent \| next [-]
		You are mixing unrelated requirements together here. > The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours. These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.
	▲	alerighi 3 hours ago \| parent \| prev [-]
		This is impossible to happen. Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense. Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices. And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches. I think that we are fortunate if the whole process takes less than a month, not a day.

▲

izacus 3 hours ago | parent | prev [-]

> nit: "without undue delay" does not mean "immediately" under any legal interpretation, only that the timeline should not be longer than necessary. This leaves a lot of wiggle-room in favor of the manufacturer, and mainly rules out that they go "eh, we'll look at all these in half a year maybe".

Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)

	▲	arghwhat 2 hours ago \| parent [-]
		I do not believe that any corporate lawyer would think that. It does not read like that in neither plain english nor legalese. Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"? A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.