Since 11 September 2026, ENISA's Single Reporting Platform for the EU Cyber Resilience Act has accepted only mandatory manufacturer notifications. ENISA's FAQ says voluntary reporting under Article 15 is not implemented yet and that non-manufacturers should contact the relevant national CSIRT directly. A researcher who finds a hole in your product therefore has no EU portal to use, and your own policy is the only place that tells them whether reporting is safe.
That is what a safe harbor paragraph does. It states, in advance, that you will treat good faith research as authorized.
What's affected
Every company that publishes a VDP. The paragraph covers your own systems only. It has limits you should state honestly:
- It cannot bind a third party, such as your cloud host or a customer whose data a researcher touches.
- It cannot bind a prosecutor or regulator. In May 2022 the US Department of Justice revised its policy to say prosecutors should decline to charge good faith security research under the CFAA, but the policy leaves civil liability and state laws unaffected.
- CISA's BOD 20-01 asks federal agencies for "a commitment to not recommend or pursue legal action" against good faith research. That is the model wording, and it commits only the agency itself.
What to do now
- Adopt a short paragraph like this one, and have counsel review it:
Safe harbor
If you make a good faith effort to follow this policy, we consider your
research authorized. We will not recommend or pursue legal action
against you, and if a third party starts a claim over activity that
followed this policy, we will make it known that you acted within it.
This applies only to systems listed in scope. We cannot authorize
testing of systems we do not own, and you must follow the law that
applies to you.
- Define good faith in one sentence: you stop at proof of access, you avoid privacy harm and service disruption, you do not extort, and you keep any personal data you see to yourself.
- Say what voids it: testing out of scope, selling or leaking data, or demanding payment under threat of disclosure.
- Tell staff that a report is not an attack. Your support and legal teams should know the policy exists before the first email arrives.
- Link to the disclose.io project if you want a lawyer-reviewed starting framework. The project describes safe harbor as language that lets good faith actors report issues "without fear of legal repercussions."
Quick check
Can your VDP's safe harbor stop a prosecutor from bringing charges?
No. It states your own position and your commitment not to pursue claims. Prosecutors and regulators are not bound by it, and the 2022 DOJ policy covers federal CFAA charging only.
