> Sure, but a vulnerability report isn’t an active exploit. First off, it can be. Obviously you should check whether the vulnerability is being actively exploi

> Sure, but a vulnerability report isn’t an active exploit. First off, it can be. Obviously you should check whether the vulnerability is being actively exploited or was in the past. For web applications that keep request-level logs you can ascertain this quite often. Depending on the complexity of the search and the amount of logs/storage you're dealing with, this can take hours of work, and then days of running the actual search though. Secondly, the law doesn't just concern itself with actively exploited vulnerabilities. It continues: > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements.