---
title: "Security, data and law · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/security-data-and-law
parts: 5
tokens_total: 4164
updated: 2026-10-27
build: a2a6bdfed830
tokens: 777
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Security, data and law

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Technical due diligence](https://agentwranglers.se/playbook/due-diligence.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Test the access rules on the running product, check personal data and sub-processors, and record AI provider, AI Act and Cyber Resilience Act duties.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/security-data-and-law">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- TDD-11 [Test the access rules on the running product](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/test-access-rules.md) · 761 tokens · updated 2026-10-27
  With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server.

## Recommended

- TDD-12 [Check how personal data is handled](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/personal-data-review.md) · 664 tokens · updated 2026-10-27
  Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.
- TDD-13 [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md) · 736 tokens · updated 2026-10-27
  State whether the Cyber Resilience Act covers the product. For a product it covers, name who reports exploited holes, the reporting route and the published support end date.
- TDD-18 [List every AI model the product depends on and its AI Act role](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review.md) · 1,091 tokens · updated 2026-10-27
  List every model provider and model version the product calls, with the contract terms on training and data retention, the monthly cost and the fallback. Record the company's AI Act role and risk class for each AI feature.
- TDD-19 [Time how long it takes to leave each sub-processor](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/sub-processor-exit.md) · 912 tokens · updated 2026-10-27
  List every sub-processor with the personal data it holds and the export path for that data. Record the measured or estimated time to move to another provider, and mark each one that has no export path.

- Previous: [Code and ownership](https://agentwranglers.se/playbook/due-diligence/code-and-ownership.md)
- Next: [Operations and growth](https://agentwranglers.se/playbook/due-diligence/operations-and-growth.md)
- [All chapters](https://agentwranglers.se/playbook/due-diligence.md)