In rare cases, a coordinating CSIRT may delay onward sharing. The delay needs a valid cyber security reason. It can last only as long as strictly needed. Delegated Regulation (EU) 2026/881 sets the conditions.
This route changes what an authority does after it receives a notice. It does not extend the manufacturer’s Article 14 deadline.
Treat a request as evidence, not an outcome
A manufacturer may flag sensitive details and ask for a delay. The coordinating CSIRT makes the decision. It decides whether the legal conditions are met.
Record the exact request and its cyber security reason. Identify the details it covers. Keep any response from the authority.
Do not assume the request will succeed. Prepare each filing stage for the normal deadline. Handle sensitive content under the current platform guidance.
Build a bounded request packet
Name the exact information that should not be shared yet. State the cyber security harm and the proof for it. Describe the handling you seek. Name the person allowed to make the request.
Leave unrelated sensitive material out. A reviewer should be able to assess one bounded issue.
Keep the manufacturer’s request separate from the authority’s decision. Record the time and content of both. Note any conditions and the information they cover. Name the person responsible for follow-up.
Keep the state unresolved until there is proof of an authority decision.
Commercial sensitivity is not enough on its own. Neither are concern about reputation nor a wish to fix the issue in private. Counsel should test the stated reason against the Regulation and delegated act.
Keep separate clocks
Track the manufacturer’s filing clock on its own. Do not tie it to the authority’s sharing period.
The CSIRT may announce a delay or a later release. Add that event to the case record. Do not change the original filing time.
Use separate fields for each key event. Record when the filing is due and when it was made. Record when the delay was requested and when the authority replied. Add the delay state and any later release.
One timeline can display all these events. Do not calculate one clock from another without a legal basis.
Run a drill where the request is refused. Also test a case with no reply before the filing limit. The team must still complete the normal manufacturer handoff. Keep the open request, but do not treat it as permission to wait.
This separation keeps a narrow safeguard from becoming an informal extension. Counsel should review any use of the exceptional route.
Continue this workflow with the onward-dissemination map and the sensitivity review.