In exceptional circumstances, a coordinating CSIRT may delay onward dissemination on justified cybersecurity grounds and for no longer than strictly necessary. Delegated Regulation (EU) 2026/881 supplies the governing conditions.
The mechanism concerns authority-side dissemination after notification. It does not extend the manufacturer’s Article 14 submission deadlines.
Treat a request as evidence, not an outcome
A manufacturer can identify sensitivity and may request a delay, but the coordinating CSIRT decides whether the legal conditions are satisfied and whether to delay. Record the exact request, the cybersecurity rationale, the affected information, and any authority response.
Do not write an incident plan that assumes a request will be granted. Prepare the staged submission on the ordinary deadline and control sensitive content according to the current platform guidance.
Build a bounded request packet
Identify the exact information for which delayed dissemination is sought, the cybersecurity harm asserted, the supporting evidence, the requested handling, and the person authorised to make the request. Keep unrelated sensitive material outside the rationale so the reviewer can assess the bounded issue.
Separate the manufacturer’s request from the authority’s decision. Record the time and content of each, any conditions communicated, the information affected, and the person responsible for follow-up. Until an authority outcome is evidenced, keep the dissemination state unresolved.
Do not use commercial sensitivity, reputational concern, or a preference for private remediation as shorthand for the legal cybersecurity conditions. Counsel should review the exact basis against the controlling Regulation and delegated act.
Keep separate clocks
Track the manufacturer’s submission clock independently from any authority-side dissemination period. If the CSIRT communicates a delay or later release, append those events to the case record without changing the original submission timestamp.
Use separate fields for submission due, submission completed, dissemination request made, authority decision received, delay state, and later release event. Displaying them on one timeline is useful; calculating one from another without the governing basis is not.
Exercise a case in which the delay request is refused or receives no response before the submission limit. The reporting team should still complete the ordinary manufacturer-side handoff and preserve the unresolved request without treating it as permission to wait.
This distinction prevents a narrow protective mechanism from becoming an informal reporting extension. Counsel should review any reliance on the exceptional conditions.
Continue this workflow with the onward-dissemination map and the sensitivity review.