Annex I, a rulebook in two parts
Annex I Part I sets the product security properties for the design. A product ships with no known exploitable vulnerabilities, a secure-by-default configuration, protection of data at rest and in transit, a minimised attack surface, and a secure update mechanism that can verify what it installs. Part II sets vulnerability handling for the post-market phase, which means a public coordinated disclosure policy, remediation without undue delay, disclosure of fixed vulnerabilities with their CVE identifiers, and security updates provided free of charge. Both parts are mandatory.
The clocks Article 13 adds
Article 13 adds statutory timelines on top of the ISO disclosure and handling standards. A manufacturer acknowledges a received vulnerability report within 48 hours. Security updates stay available for at least 10 years after the product is placed on the market, or for the rest of the support period when that runs longer. The support period must reflect how long the product is expected to be in use, and it works from a five-year reference point for most products, stated as a month and year that users can find easily.
Three numbers to remember. Acknowledge a report within 48 hours, keep updates available for at least 10 years, and treat five years as the support-period reference point.
The evidence a manufacturer produces
A software bill of materials lists the product's components and versions and sits inside the technical documentation, so it supports due diligence without having to be public. Fixed vulnerabilities are published as machine-readable CSAF 2.0 advisories, and the disclosure contact is commonly advertised through a security.txt file at the well-known path defined by RFC 9116. Together these give market surveillance authorities and researchers a clear, consistent way to see how a product is maintained.