Agent Wranglers

CMP-50Recommended EU law

Handle vulnerabilities for the whole support period

State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.

By Agent Wranglers. Updated .

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The CRA applies in full from 11 December 2027. Annex I Part II asks for a bill of materials, as in the provenance rule. It also asks for a disclosure policy and contact, as in the security.txt rule. Ship security fixes apart from feature updates where you can. Release with no known exploitable vulnerability. Show the end date of support at the point of sale.

How to check

Every release of a covered product has a bill of materials. Its published support end date is at least five years after the market date. The release job fails when a scanner finds a known exploited vulnerability, such as one in the CISA KEV list.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.