What is PEC, when can I use it, and who decides?

What PEC is

It isn’t a way to avoid reporting, only a way to keep the details from spreading further than necessary while things are still sensitive. ENISA’s CRA SRP Glossary defines PEC verbatim, in the “Particular Exceptional Circumstances (PEC)” row of its field table: “Selection indicating that one or more legally specified circumstances in the third subparagraph of Article 16(2) of CRA justify withholding the full 72-hour AEV notification from simultaneous access by ENISA and/or delaying wider dissemination.”

The three conditions, verbatim

The operative text is Article 16(2), third subparagraph, of Regulation (EU) 2024/2847 (the Cyber Resilience Act). It reads: “In particularly exceptional circumstances, where the manufacturer indicates in the notification referred to in Article 14(2), point (b): (a) that the notified vulnerability has been actively exploited by a malicious actor and, according to the information available, it has been exploited in no other Member State than the one of the CSIRT designated as coordinator to which the manufacturer has notified the vulnerability; (b) that any immediate further dissemination of the notified vulnerability would likely result in the supply of information the disclosure of which would be contrary to the essential interests of that Member State; or (c) that the notified vulnerability poses an imminent high cybersecurity risk stemming from the further dissemination; only the information that a notification was made by the manufacturer, the general information about the product, the information on the general nature of the exploit and the information that security related grounds were raised are to be made available simultaneously to ENISA until the full notification is disseminated to the CSIRTs concerned and ENISA.”

ENISA’s SRP Glossary carries the same three conditions in its “PEC Delay Reason” field, which the reporter selects from when toggling PEC in the 72-hour report template.

When you can use it

ENISA’s dedicated PEC guidance page states that PEC “are applicable only when a manufacturer or open-source software steward (hereinafter the ‘Reporter’) submits a 72-hour Notification of an Actively Exploited Vulnerability (AEV),” and that “PEC can be invoked only where at least one of the conditions under the third subparagraph of Article 16(2) of the CRA applies.” This means PEC has no role at the Early Warning stage or the Final Report stage, and it does not apply to a Severe Incident (SI) notification. It exists as a toggle on the 72-hour AEV notification template: switching it on displays the PEC Delay Reason selection described above, plus a separate free-text field in the glossary’s field table, described as a “Description of anything that should be helpful for CSIRT Designated as Coordinator (CDaC) taking their decision,” with the instruction “You may provide additional information (max. 800 characters).”

When PEC is invoked, the ENISA SRP FAQ and the PEC guidance page describe the effect: the dissemination status becomes “72h Submitted under PEC,” and “only limited information in accordance with Article 16(2) is made available to ENISA” until the receiving CSIRT disseminates the full notification.

Who decides

ENISA’s PEC guidance page ties the justification field directly to a CDaC decision: “An optional field is also available to provide a justification that can help the CSIRT Designated as Coordinator (CDaC) decide whether to accept the submission under PEC.” The same page states: “The CDaC remains responsible for deciding whether dissemination is necessary and possible, and for manually sharing the notification with other concerned CSIRTs and the full notification with ENISA.”

Recital 70 of Regulation (EU) 2024/2847 describes the ongoing side of that judgment the same way: the full notification “should then be made available to ENISA and other relevant CSIRTs designated as coordinators when the CSIRT designated as coordinator initially receiving the notification finds that those security grounds, reflecting particularly exceptional circumstances as established in this Regulation, cease to exist.” Every primary-source description of this decision, both ENISA’s operational guidance and the Regulation’s recital, names the CDaC as the party deciding acceptance and continued withholding. The reporter’s role, in these same sources, is limited to marking the indicator and optionally supplying a justification for the CDaC to weigh.

Unsettled: no source uses the words “not the manufacturer’s call” outright. This is inferred, consistently, from two independent sources describing the CDaC as the one who decides and the reporter as the one who only requests.

craclock treats PEC as a flagged request pending your CDaC’s judgment, not a status you set and forget.