---
title: "Handle vulnerabilities for the whole · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period
updated: 2026-10-20
licence: "All rights reserved"
---

# Handle vulnerabilities for the whole support period

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)
- Rule: State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.
- How: The CRA applies in full from 11 December 2027. Annex I Part II asks for a bill of materials, as in the [provenance rule](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance). It also asks for a disclosure policy and contact, as in the [security.txt rule](https://agentwranglers.se/playbook/website/security/security-txt). Ship security fixes apart from feature updates where you can. Release with no known exploitable vulnerability. Show the end date of support at the point of sale.
- Check: Every release of a covered product has a bill of materials. Its published support end date is at least five years after the market date. The release job fails when a scanner finds a known exploited vulnerability, such as one in the CISA KEV list.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period`.

- Previous: [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting)
- Next: [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-technical-file)
- [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)