Agent WranglersProduct and sector laws Required
Handle vulnerabilities for the whole support period
State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.
How to do it
The CRA applies in full from 11 December 2027. Annex I Part II asks for a bill of materials, as in the provenance rule. It also asks for a disclosure policy and contact, as in the security.txt rule. Ship security fixes apart from feature updates where you can. Release with no known exploitable vulnerability. Show the end date of support at the point of sale.
How to check
Every release of a covered product has a bill of materials. Its published support end date is at least five years after the market date. The release job fails when a scanner finds a known exploited vulnerability, such as one in the CISA KEV list.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period.