My assumption is that the involved parties will attempt to use reasonably self-interested common sense unless required otherwise. The text does not appear to sa

My assumption is that the involved parties will attempt to use reasonably self-interested common sense unless required otherwise. The text does not appear to say there must be immediate publication, therefore I'm assuming that won't happen, but it's legalese; it's possible I've misinterpreted this. The reason I think there's room for normal processes here is that they're talking about ENISA forwarding that notification to CSIRT (without the 24-hour deadline? possibly later?), and they talk of "unless for justified cybersecurity risk-related grounds", and even if CSIRT and ENISA have _notifications_ eventually (potentially well past that 24 hours), it doesn't say that requires immediate publication, merely that the notification is for _purposes_ of "coordinated vulnerability disclosure". It doesn't say that disclosure must be immediate, nor in fact does it even say it must _ever_ actually occur; simply that that's the aim. If anything, that constrains the organization; so it wouldn't be valid grounds to withhold forwarding to CSIRT if some intelligence agency for instance happened to find that convenient (not that I'm under any illusions that that is therefore inconceivable or that there aren't potentially 100 other loopholes). Sounds to me like both ENISA and CSIRT have the option to sit on things, as it is, and also as if the manufacturer can ask them to do so. Also, that word "justified" can mean pretty much anything. It might turn out to mean "we haven't finished our impact assessment yet", and therefore by default _all_ vulnerability notifications initially are not forwarded because of course they won't be assessed in that kind of time-frame, or if forwarded at least not published. Basically: this all sounds so vague that it doesn't appear (but IANAL) that the proposed rule requires YOLO style vulnerability notifications, so I'm going to presume they'll treat this with the necessary caution.