--- title: "Handle vulnerabilities for the whole ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period id: CMP-50 level: Recommended applies: digital-product region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 1068 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Handle vulnerabilities for the whole support period For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-50 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends. - Check: Every release of a covered product has a bill of materials. Its published support end date is at least five years after the market date. The release job fails when a scanner finds a known exploited vulnerability, such as one in the CISA KEV list. - Applies when: The project sells or hands out software or devices that others run, not only a hosted service. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The CRA applies in full from 11 December 2027. Annex I Part II asks for a bill of materials, as in the [provenance rule](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md). It also asks for a disclosure policy and contact, as in the [security.txt rule](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md). Ship security fixes apart from feature updates where you can. Release with no known exploitable vulnerability. Show the end date of support at the point of sale. ## Sources - [Cyber Resilience Act Article 13 and Annex I](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) ## Related rules - APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security - WEB-143 [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) in Website - CMP-55 [Keep the evidence to answer a product liability claim](https://agentwranglers.se/playbook/compliance/product-and-data-laws/product-liability.md) in Compliance and governance - DOC-39 [Ship the user information the Cyber Resilience Act lists](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/cra-user-information.md) in Documentation - IOT-35 [Publish the support end date for every model](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/support-end-date.md) in Connected devices - OSS-47 [Publish a security policy with the code](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy.md) in Open source maintenance - TDD-13 [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md) in Technical due diligence - DEV-12 [Publish a support matrix](https://agentwranglers.se/playbook/developer-tools/libraries-and-sdks/support-matrix.md) in Developer tools, SDKs and CLIs - APS-107 [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) - Next: [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)