Agent WranglersTDD-13Recommended
Record the product's Cyber Resilience Act duties
State whether the Cyber Resilience Act covers the product. For a product it covers, name who reports exploited holes, the reporting route and the published support end date.
How to do it
The Act's reporting duties under Article 14 have applied since 11 September 2026, and the whole Act applies from 11 December 2027. After a purchase, these duties come with the product. Decide the scope with Decide whether the Cyber Resilience Act covers your product. Check the reporting setup against Report exploited vulnerabilities in your products. Check the support period against Handle vulnerabilities for the whole support period.
How to check
The report says in scope or out of scope, with the reason. For a product in scope, it names the person who reports, the route and the support end date. Each missing one is listed as a finding.
Sources
Related rules
- CMP-48 Decide whether the Cyber Resilience Act covers your product in Compliance and governance
- CMP-49 Report exploited vulnerabilities in your products in Compliance and governance
- CMP-50 Handle vulnerabilities for the whole support period in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check">Agent Wranglers technical due diligence playbook</a>. In code you write, add a comment next to it with the same link.