Sometimes the vendor will provide an optional fix in a safety information bulletin, sometimes they will be mandatory (Sometimes the optional ones become mandatory [1]).
They are coordinated with applicable certification bodies (civil aviation authorities) and distributed as airworthiness directives that can, in fact, force a specific action to be taken.
[1] (writing from memory unfortunately) an airflow modification for 737 NG (iirc, could be older 737, pre-MAX definitely) avionics bay was "optional", as in mandatory only for aircraft flying in hot enough regions. After a near miss in Poland when steadily overheating avionics essentially slowly lobotomized a plane after takeoff. Turned out europe got hot enough for it.
After that incident, Boeing issued a change in safety information bulletin that the modification was now mandatory.
