Machine readable customer notification means giving users advisory information in a structured file their tools can process, not only in prose. The EU Cyber Resilience Act says manufacturers should inform users of exploited vulnerabilities and measures, where appropriate in a structured, machine readable format that is easily automatically processable.
What the text says
Article 14(8) of Regulation (EU) 2024/2847 says that, after becoming aware of an actively exploited vulnerability or severe incident, a manufacturer shall inform the impacted users, and where appropriate all users, and where necessary of risk mitigation and corrective measures. It adds that this should be done, where appropriate, in a structured, machine readable format that is easily automatically processable. If the manufacturer fails to inform users in a timely manner, the notified CSIRTs may do so when proportionate and necessary.
The words "where appropriate" matter. The regulation does not name a format. Choosing one is a decision you make, and should be able to explain.
Candidate formats
| Format | What it carries | Good for |
|---|---|---|
| CSAF advisory | Advisory text, product tree, remediation, status | Vendors with an advisory process |
| CSAF VEX profile | Status per product, impact statement, action statement | Vendors who publish status at scale |
| OpenVEX | Status, justification, action statement | Small teams generating from triage |
| CycloneDX with vulnerability data | Analysis state alongside the BOM | Vendors who already ship CycloneDX |
CycloneDX describes VEX as conveying the exploitability of vulnerable components in the context of the product in which they are used.
Making a notice processable
- Use stable identifiers for products, such as package URLs or product identifiers, so tools can match.
- Use the standard status words, not free text.
- Give versions as ranges tools can parse, and say which are fixed.
- Include an action statement for affected products.
- Date and version the document, and increase the version on every change.
- Publish at a stable address, discoverable from your security contact page.
- Test with a customer's tooling, not only a validator.
Human text still needed
A machine readable file does not replace a message to a person. Your exposed customers need a clear email or notice. The file serves their automation. The two must agree.
Why it helps you
Customers with tooling can triage your notice in minutes. Customers without it can still read the same facts on your advisory page. And a structured file is easier to keep consistent across many products than prose.
Before relying on this
This post summarises one paragraph of a long regulation. Whether it applies to your product, and what counts as appropriate, is a matter for your legal advice. The date on which Article 14 applies is 11 September 2026.
Quick check
Does the CRA require CSAF specifically?
The text quoted here does not name a format. It speaks of a structured, machine readable format that is easily automatically processable, where appropriate.
Is a PDF advisory machine readable?
Not in the sense used here. A PDF is hard for tools to process reliably.
Safeguard's compliance and evidence automation and SBOM scanning help keep product and component records consistent. A free scan shows an example.
Sources
- Regulation (EU) 2024/2847, EUR-Lex, Article 14 and Article 71
- CycloneDX VEX capability
Last reviewed: 19 October 2026.
