A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.

第1項の届出のために、製造者は以下の書類を提出しなければならない：

(a) 活発に悪用されている脆弱性について、過度の遅滞なく、いかなる場合でも製造者がそれを認識してから24時間以内に、早期警告通知を行うこと；

(b) unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

(c) 関連情報がすでに提供されている場合を除き、是正措置または緩和措置が利用可能になってから14日以内に、少なくとも以下を含む最終報告書を提出する：

(i) 脆弱性の説明（その重大性と影響を含む）；

(ii) 利用可能な場合、脆弱性を悪用した、または悪用している悪意のある行為者に関する情報；

(iii) 脆弱性を是正するために提供されたセキュリティアップデートまたはその他の是正措置の詳細。

A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that incident via the single reporting platform established pursuant to Article 16.

第3項の届出のために、製造者は以下を提出しなければならない：

(a) an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

(b) unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;

(c) 関連情報が既に提供されている場合を除き、(b)に基づく事故通知書の提出後1ヶ月以内に、少なくとも以下を含む最終報告書を提出すること：

(i)その重大性と影響を含む、事故の詳細な説明；

(ii) インシデントの引き金となったと思われる脅威の種類または根本原因；

(iii) 適用済みおよび継続中の緩和策。

The notifications referred to in paragraphs 1 and 3 of this Article shall be submitted via the single reporting platform referred to in Article 16 using one of the electronic notification end-points referred to in Article 16(1). The notification shall be submitted using the electronic notification end-point of the CSIRT designated as coordinator of the Member State where the manufacturers have their main establishment in the Union and shall be simultaneously accessible to ENISA.

For the purposes of this Regulation, a manufacturer shall be considered to have its main establishment in the Union in the Member State where the decisions related to the cybersecurity of its products with digital elements are predominantly taken. If such a Member State cannot be determined, the main establishment shall be considered to be in the Member State where the manufacturer concerned has the establishment with the highest number of employees in the Union.

Where a manufacturer has no main establishment in the Union, it shall submit the notifications referred to in paragraphs 1 and 3 using the electronic notification end-point of the CSIRT designated as coordinator in the Member State determined pursuant to the following order and based on the information available to the manufacturer:

(a) 当該製造事業者のデジタル要素を搭載した製品の数が最も多い製造事業者を代理する公認代理人が設立されている加盟国；

(b) 当該製造業者のデジタル要素を搭載した製品を最も多く市場に出している輸入業者が設立されている加盟国；

(c) 当該製造業者のデジタル・エレメントを搭載した製品を最も多く市販している販売業者が設立されている加盟国；

(d) the Member State in which the highest number of users of products with digital elements of that manufacturer are located. In relation to the third subparagraph, point (d), a manufacturer may submit notifications related to any subsequent actively exploited vulnerability or severe incident having an impact on the security of the product with digital elements to the same CSIRT designated as coordinator to which it first reported.

After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product with digital elements, the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures that the users can deploy to mitigate the impact of that vulnerability or incident, where appropriate in a structured, machine-readable format that is easily automatically processable. Where the manufacturer fails to inform the users of the product with digital elements in a timely manner, the notified CSIRTs designated as coordinators may provide such information to the users when considered to be proportionate and necessary for preventing or mitigating the impact of that vulnerability or incident.

製造業者だけでなく、その他の自然人または法人も、デジタル要素を含む製品に含まれる脆弱性、およびデジタル要素を含む製品のリスクプロファイルに影響を与える可能性のあるサイバー脅威を、コーディネーターとして指定されたCSIRTまたはENISAに任意で通知することができる。

製造者だけでなく、その他の自然人または法人も、デジタル要素を含む製品のセキュリティに影響を及ぼすインシデントや、そのようなインシデントにつながる可能性があったニアミスを、コーディネーターとして指定されたCSIRTまたはENISAに任意で通知することができる。