Nine more of 342 measured EU manufacturers publish a valid RFC 9116 security contact in September 2026 than in July 2026. The share rose from 7.0% to 9.6%. Most manufacturers still publish nothing.
Key takeaways
- Wave 2 re-scanned the same 342-manufacturer frame on 16 September 2026, five days after Article 14 started to apply.
- Valid security.txt files rose from 24 to 33. Discoverable disclosure policies rose from 20 to 23.
- The share of the frame publishing neither artifact fell from 75.1% to 73.1%.
- Scan observability was stable between waves, so the movement reflects changed publishing behaviour rather than changed visibility.
What changed between the two waves
| Measure | July 2026 | September 2026 | Change |
|---|---|---|---|
| Valid RFC 9116 security.txt | 24 (7.0%) | 33 (9.6%) | +9 (+2.6pp) |
| Any security.txt | 34 (9.9%) | 41 (12.0%) | +7 (+2.1pp) |
| Discoverable CVD policy | 20 (5.8%) | 23 (6.7%) | +3 (+0.9pp) |
| Both artifacts | 14 (4.1%) | 18 (5.3%) | +4 (+1.2pp) |
Why a small move still answers the question
Article 14 assumes a manufacturer can be reached about a vulnerability. The first wave showed most of the measured base could not be reached through any published channel. The second wave shows the obligation moved a small number of manufacturers rather than the base. That is itself the finding. A deadline that moved everyone would need no further argument. A deadline that moved nine manufacturers in two months defines the work ahead.
The comparison is clean. The frame is the same set of manufacturers in both runs. Determinability held steady at 296 of 342 observable, so no part of the change comes from the scan seeing more or less. The full wave-to-wave delta, including per-sector movement, ships inside the Wave 2 dataset.
Sources
- CRA Exposure Study 2026, Wave 2 (CC BY 4.0). Same frame, same tooling, scanned 16 September 2026.
- Wave 2 dataset as JSON (CC BY 4.0). Carries the delta block and the full methodology.
- Regulation (EU) 2024/2847, Article 14. CELEX 32024R2847.
How CVD Portal Can Help
CVD Portal publishes both artifacts for any manufacturer in minutes.
- Branded security contact at yourcompany.cvdportal.com
- Machine-readable security.txt generator with RFC 9116 validation
- Discoverable coordinated disclosure policy
- Automated 48-hour acknowledgment tracking
Last updated: 16 September 2026.
Read the full study with methodology and dataset.
Read the study