# Regulatory Scope Memo — CVD-2026-0012

**Incident:** CVD-2026-0012 — path-traversal in artifact-serving endpoint
**Organisation:** Meridian Systems
**Prepared by:** Rachel Stern, Legal Counsel & DPO
**Date:** 2026-04-08
**Classification:** Internal — incident-restricted. *All entities, companies, contacts, and obligations below are fictional.*

---

## T0 definition

T0 is **2026-04-08 10:23 UTC** — the moment Marc Dubois (Security Lead) independently reproduced the researcher's proof-of-concept and corroborated that the vulnerability was actively exploited. Every statutory clock in this memo runs from T0.

---

## Regulatory hat assessment

| Regulatory hat | Applies? | Why | Obligation / clock | Owner |
|---|---|---|---|---|
| EU CRA Art. 14 — manufacturer of a product with digital elements | **Yes** | Exploitation was corroborated at T0. Art. 14(2) requires manufacturers to notify ENISA without undue delay (and no later than 24 hours of becoming aware of active exploitation) of any actively exploited vulnerability in a product with digital elements. The affected endpoint is part of Meridian's generally available software product. | T0+24h: ENISA early warning. T0+72h: ENISA vulnerability report. | Lena Hartmann (IC) |
| NIS 2 Art. 23 — significant incident (Meridian as ICT managed-service provider) | **Yes** | Meridian provides managed software services to NIS 2 essential entities, including a healthcare operator. The incident affected Meridian's staging cloud subscription (which hosts its CI/CD pipeline runner) and the shared document store used by customers for compliance evidence. | T0+24h: early warning to competent authority. T0+72h: incident notification. | Lena Hartmann (IC) |
| GDPR Art. 33 — processor duty to notify controller | **Yes** | Sint-Aldegonde Hospital Group's compliance workflows processed on Meridian's platform include personal data (administrative data of clinical staff). Meridian acts as processor; Sint-Aldegonde is the controller. As processor, Meridian must notify Sint-Aldegonde "without undue delay" after becoming aware of a breach — and Sint-Aldegonde must then file with their supervisory authority within 72 hours of their own awareness. | Processor duty: no fixed statutory clock, but Sint-Aldegonde's 72-hour controller clock starts from our notification. | Rachel Stern |
| GDPR Art. 33 — controller duty (Meridian's own employee and recruitment data) | **Yes — provisional, pending Stage 3 scope confirmation** | Meridian's own HR and recruitment data is also stored in the compliance platform. Meridian acts as controller for that data. Confirmed in scope if Stage 3 audit log review shows it was accessible to the exposed token. | T0+72h to Meridian's lead supervisory authority (BE DPA). | Rachel Stern |
| Grant terms — NDIA programme (EC-funded) | **Yes** | NDIA's programme agreement clause 14.2 requires notification of security incidents affecting programme data within 48 hours of discovery. NDIA's programme deliverable evidence was accessible to the exposed token during the exposure window. | T0+48h: written notification to NDIA programme manager. | Carmen Vidal (Comms Lead) |

---

## Affected customer register

| Customer | Own regulatory status | Data confirmed at risk | Their own deadline | Our notification deadline | Customer liaison |
|---|---|---|---|---|---|
| Sint-Aldegonde Hospital Group | NIS 2 essential entity (healthcare sector, Belgium); GDPR controller for patient-adjacent administrative data | Administrative data of clinical staff in compliance evidence; no clinical patient records confirmed in scope at this stage (Stage 3 to confirm) | Sint-Aldegonde's own NIS 2 Art. 23 early warning is due **24 hours from receipt of our notification** — not from T0 | **T0+18h** (to give Sint-Aldegonde at least a 6-hour buffer for their own filing) | Dirk Vermeersch |
| National Digital Infrastructure Agency (NDIA) | EC-funded programme; grant terms clause 14.2 (non-statutory, contractual) | NDIA programme deliverable evidence in shared document store; no personal data confirmed in scope | 48 hours from NDIA's awareness (contractual, not statutory) | **T0+24h** (to meet the T0+48h grant obligation with margin) | Ana Ferreira |

**Note:** The customer liaison (Dirk Vermeersch for Sint-Aldegonde, Ana Ferreira for NDIA) manages the relationship. Rachel Stern holds the legal obligation and must approve notification content before it is sent. Both sign off.

---

## Decision

Rachel Stern recommends the IC declare this a multi-regulatory incident and activate Stage 4 (Notify) in parallel with Stage 3 (Contain). All five regulatory obligations above are treated as active until Stage 3 assessment narrows them. No obligation is deferred pending confirmation.

**Prepared by:** Rachel Stern, Legal Counsel & DPO, Meridian Systems
**Reviewed and approved by:** Lena Hartmann (IC), 2026-04-08 13:04 UTC
**Status:** Final — Stage 2 gate signed.