---
title: "Product and sector laws · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-sector-laws
updated: 2026-10-20
licence: "All rights reserved"
---

# Product and sector laws

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Decide whether NIS2, the Cyber Resilience Act and the European Accessibility Act apply to you. Turn the ones that do into dates, controls and checks.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws`.

## Required

- [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-scope): Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.
- [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures): If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.
- [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope): List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
- [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting): Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.
- [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period): State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.
- [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-technical-file): From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.
- [Meet the European Accessibility Act as a legal duty](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/accessibility-act-duty): Record whether the European Accessibility Act covers your products or services. If it does, meet EN 301 549, publish how you meet it, and test it in every build.
- [Let cloud customers leave under the Data Act](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-switching): If you sell a cloud or software service to EU customers, offer a tested full export and the switching terms of the Data Act. Charge nothing for switching from 12 January 2027.

- Previous: [AI Act](https://agentwranglers.se/playbook/compliance/ai-act)
- Next: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- [All chapters](https://agentwranglers.se/playbook/compliance)