PEC is not a general confidentiality switch and does not apply broadly to every CRA report. ENISA's current SRP implementation limits it to the 72-hour AEV notification. The manufacturer can indicate that a PEC condition applies, but the coordinating CSIRT remains responsible for the dissemination decision.
PEC Is a Narrow Article 16 Mechanism
Particularly Exceptional Circumstances are addressed in the third subparagraph of Article 16(2). ENISA's current SRP guidance states that PEC applies only when a manufacturer submits the 72-hour notification for an actively exploited vulnerability. It is not a general option for every Article 14 reporting stage, and it is not currently presented as a PEC mechanism for severe-incident notifications. The purpose is to deal with exceptional situations where immediate dissemination of sensitive vulnerability information could itself create significant security risks.
- PEC is tied to Article 16(2).
- Current ENISA guidance limits PEC to the 72-hour AEV notification.
- PEC is not a general confidentiality preference.
- Assess PEC during the first 72-hour reporting window where relevant.
Condition One Concerns Exploitation in Only One Member State
The first Article 16(2) condition applies where the notified vulnerability has been actively exploited by a malicious actor and, according to the information available, it has been exploited in no other Member State than the Member State of the CSIRT designated as coordinator to which the manufacturer notified the vulnerability. The manufacturer should base this indication on the evidence available at the time rather than claiming certainty that cannot be supported.
- There must be an actively exploited vulnerability.
- The available information indicates exploitation in the coordinating CSIRT's Member State.
- The available information indicates no exploitation in another Member State.
- Document the evidence supporting the geographic assessment.
Condition Two Concerns Essential Interests of the Member State
The second statutory condition applies where any immediate further dissemination of the notified vulnerability would likely result in supplying information whose disclosure would be contrary to the essential interests of the relevant Member State. This is a high threshold and should not be reduced to ordinary commercial confidentiality or reputational concern. The manufacturer should provide specific facts supporting the indication so the coordinating CSIRT can assess whether the circumstances justify restricted or delayed dissemination.
- The concern must relate to immediate further dissemination.
- The expected disclosure must affect essential interests of the Member State.
- Ordinary commercial sensitivity is not the same test.
- Provide specific supporting facts where available.
Condition Three Concerns Imminent High Cybersecurity Risk
The third condition applies where the notified vulnerability poses an imminent high cybersecurity risk stemming from further dissemination. This focuses on situations where broader circulation of the vulnerability information could itself create an immediate and serious cybersecurity danger. The manufacturer should identify the mechanism by which dissemination creates that risk, such as revealing an unmitigated exploitation path before defensive measures can be deployed. A generic statement that security information is sensitive is not equivalent to the statutory test.
- The risk must be cybersecurity-related.
- The risk must be high.
- The risk must be imminent.
- The risk must stem from further dissemination.
- Explain the connection between disclosure and the anticipated risk.
The Manufacturer Indicates PEC in the 72-Hour Notification
ENISA's current platform guidance provides a Particularly Exceptional Circumstances indicator in the 72-hour AEV notification. When it is enabled, the reporter can select the applicable PEC reason and can provide a justification to help the CSIRT designated as coordinator assess the request. The manufacturer should not select PEC by default. The indicator should be used only where at least one Article 16(2) condition is actually supported by the available facts.
- Use the PEC indicator in the 72-hour AEV report where applicable.
- Select the applicable statutory condition.
- Provide a specific justification where useful.
- Do not treat PEC as a routine reporting setting.
The Coordinating CSIRT Makes the Dissemination Decision
The manufacturer's indication does not itself permanently block dissemination. ENISA states that the CSIRT Designated as Coordinator remains responsible for deciding whether dissemination is necessary and possible. Where PEC has been invoked, the coordinating CSIRT manages the manual sharing of the notification with concerned CSIRTs and the full notification with ENISA when appropriate. Manufacturers should therefore describe the security grounds accurately enough for that assessment to be made.
- The manufacturer raises the PEC condition.
- The coordinating CSIRT assesses dissemination.
- The manufacturer does not control the entire regulatory distribution process.
- Keep the supporting justification available for follow-up.
ENISA Initially Receives Only Limited Information
Where PEC applies, the full 72-hour AEV notification is not simultaneously made available to ENISA. Article 16 provides for a limited information set during that period. ENISA receives information that a notification has been made, general information about the product with digital elements, information on the general nature of the exploit and the fact that security-related grounds have been raised. The full notification can later be made available when the grounds for restricted dissemination cease to exist.
- PEC changes simultaneous access to the full 72-hour AEV notification.
- ENISA still receives a limited information set.
- The full information can be disseminated later.
- PEC does not erase the notification.
Do Not Confuse PEC With the Broader Delayed-Dissemination Rules
Article 16 also contains a broader exceptional-circumstances mechanism under which the coordinating CSIRT may delay dissemination on justified cybersecurity-related grounds for the period strictly necessary. Commission Delegated Regulation (EU) 2026/881 further specifies conditions for applying those grounds. PEC is narrower because it concerns the special Article 16(2) cases affecting simultaneous access to the full 72-hour AEV notification. Internal procedures should therefore distinguish ordinary Article 16 dissemination delay analysis from the narrower PEC workflow.
- Article 16 contains more than one dissemination concept.
- PEC is the narrower particularly exceptional route.
- Commission Delegated Regulation (EU) 2026/881 supplements the general delay framework.
- Use precise terminology in the regulatory case.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.