TI provides SBOMs in SPDX and CycloneDX formats for all products for which public source code is available as part of SDK on ti.com. SBOMs for secure software components are available through TI's MySecure access program.

TI processor SDKs are scanned for known vulnerabilities before each release. TI manages the full vulnerability handling lifecycle through PSIRT: notification intake, triage, technical analysis, remediation, and coordinated public disclosure with CVSS v3.1 severity scoring and CVE assignment. The process aligns to ISO/IEC 30111 and ISO/IEC 29147. TI provides security patches free of charge with advisory messages.

TI delivers patches and advisories through the product security advisory portal (PSAP) at ti.com/psap. PSAP gives customers a structured channel to report vulnerabilities through myTI accounts, subscribe to advisory feeds scoped to the TI products in their designs, and access disclosures in CSAF v2.0 machine-readable format. CSAF v2.0 advisories reference the specific software components affected, enabling customers to automate correlation against their SBOMs and assess exposure within their CRA reporting timelines.

TI publishes a security.txt file at ti.com/.well-known/security.txt per BSI TR-03183-3 and RFC 9116. The text file contains the PSIRT contact address, CVD policy URI, and CSAF provider metadata. TI operates under German jurisdiction, and TI's designated national CSIRT for Article 14 reporting is CERT-Bund, operated by the German Federal Office for Information Security (BSI). TI submits incident notifications through the CRA Single Reporting Platform within the required timelines.

Article 14 requires manufacturers to notify the appropriate national CSIRT within 24 hours of "becoming aware" of an actively exploited vulnerability. The regulation does not define the moment awareness is established in a multi-person organization. Manufacturers define in advance what constitutes awareness in their organization, whether at intake acknowledgment or when the responsible technical team member first reviews the report, however, an undefined clock creates compliance risk. The 24-hour window starts at that defined moment, not when an individual engineer reviews the report. The automated deadline tracking from PSAP enforces this by escalating reports before the window closes. Any actively exploited vulnerability known to TI triggers this 24-hour deadline, whether the information arrives from a security researcher, a customer, or internal discovery. The 72-hour notification follows with a fuller assessment, submitted simultaneously to the national CSIRT and ENISA through the CRA Single Reporting Platform.