---
title: "Security laws · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/security-laws
parts: 10
tokens_total: 9159
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1261
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Security laws

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Compliance and governance](https://agentwranglers.se/playbook/compliance.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Decide whether NIS2, DORA and the Cyber Resilience Act reach you. Register where the law asks, map the measures to controls, and report on time.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/security-laws">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- CMP-47 [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures.md) · 855 tokens · updated 2026-10-27
  If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.
- CMP-84 [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) · 840 tokens · updated 2026-10-27
  If the cybersäkerhetslag (2025:1506) covers you, register with the Swedish Civil Defence Agency, MCF, as soon as you can. Report any change to the registered facts within 14 days.
- CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) · 969 tokens · updated 2026-10-27
  Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.

## Recommended

- CMP-46 [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope.md) · 733 tokens · updated 2026-10-27
  Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.
- CMP-75 [Decide whether DORA reaches you through financial customers](https://agentwranglers.se/playbook/compliance/security-laws/dora-ict-provider.md) · 896 tokens · updated 2026-10-27
  When you sell software or IT services to EU banks, insurers, payment firms or investment firms, record whether DORA applies to them. Keep a contract annex that covers each item in its Article 30.
- CMP-85 [Give financial customers the facts for their DORA register](https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts.md) · 905 tokens · updated 2026-10-27
  Keep the facts a financial customer needs for its DORA register of information as one data file. Include your legal identifier, each service, where its data is processed and stored, and every subcontractor.
- CMP-48 [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md) · 859 tokens · updated 2026-10-27
  List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
- CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) · 997 tokens · updated 2026-10-27
  State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.
- CMP-73 [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) · 1,401 tokens · updated 2026-10-27
  For each covered product, publish a machine-readable advisory on the day a security fix ships. Name the affected versions, the severity, the impact and how to fix it.
- CMP-51 [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/security-laws/cra-technical-file.md) · 704 tokens · updated 2026-10-27
  From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.

## Read this with

- [Connected devices playbook](https://agentwranglers.se/playbook/connected-devices.md). The Cyber Resilience Act and the Data Act set legal duties for devices sold in the EU. That chapter holds the scope, reporting and support rules.
- [Open source maintenance playbook](https://agentwranglers.se/playbook/open-source.md). Companies that ship your code face the Cyber Resilience Act. Know what they must report, and when advisories are due.

- Previous: [AI Act](https://agentwranglers.se/playbook/compliance/ai-act.md)
- Next: [Product and data laws](https://agentwranglers.se/playbook/compliance/product-and-data-laws.md)
- [All chapters](https://agentwranglers.se/playbook/compliance.md)