Safe Harbour Clause

A safe harbour clause (also called a legal safe harbour or good-faith protection clause) is a provision in a manufacturer's vulnerability disclosure policy that explicitly states the manufacturer will not take legal action against security researchers who discover and report vulnerabilities, provided they act within the stated scope and follow responsible disclosure principles. Without such a clause, researchers risk legal exposure under laws such as the Computer Misuse Act (UK), the CFAA (US), or equivalent national computer crime laws in EU member states — even for entirely benign, authorised-seeming security research. The safe harbour removes this deterrent, encouraging researchers to report vulnerabilities to the manufacturer rather than publishing them publicly or selling them on vulnerability markets.

The CRA requires manufacturers to establish a coordinated vulnerability disclosure policy that actively enables security researchers and users to report vulnerabilities. A CVD policy that lacks a meaningful safe harbour clause is effectively hollow — researchers who cannot trust they will not be prosecuted will not report, and the manufacturer's policy becomes a compliance formality rather than a functional security mechanism. ENISA's CVD Good Practice Guide, which regulators treat as a reference for CRA compliance, specifically recommends including a safe harbour statement in all CVD policies. Market surveillance authorities assessing CVD policy quality are likely to consider the absence of a safe harbour as a significant deficiency indicating the policy is not genuinely intended to receive researcher reports.

An effective safe harbour clause should clearly address:

• Scope of protection: Which products and services are covered by the policy and therefore eligible for safe harbour protection.
• Authorised conduct: What actions are considered good-faith research — typically access limited to what is necessary to confirm and document the vulnerability, with no exploitation beyond demonstration, no data exfiltration, no denial-of-service.
• Non-retaliation commitment: An explicit statement that the manufacturer will not initiate civil or criminal legal proceedings against researchers who comply with the policy terms.
• Coordination expectations: The researcher's obligations — private disclosure to the manufacturer, a defined coordination period before public disclosure.
• Scope exclusions: Clear statement of what is out of scope (e.g., social engineering, physical attacks, third-party systems).

Manufacturers should understand the boundaries of what a safe harbour clause can provide. A manufacturer's safe harbour applies to the manufacturer's own legal claims — it does not prevent third parties (such as customers whose data a researcher accessed) from bringing claims, nor does it preclude prosecution by law enforcement if the researcher's conduct violates criminal law. Safe harbour clauses are therefore strongest when research is strictly non-destructive, minimally invasive, and limited to the manufacturer's own systems and products. Manufacturers should ensure their legal team reviews the safe harbour language to ensure it is enforceable under applicable national law, as enforceability varies across EU member states. The security.txt standard includes a specific field for linking to the safe harbour policy, making it discoverable by researchers.