---
title: "Record the product's Cyber Resilience Act · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check
id: TDD-13
level: Recommended
applies: eu-users
updated: 2026-10-27
build: a2a6bdfed830
tokens: 788
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Record the product's Cyber Resilience Act duties

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TDD-13
- Level: Recommended
- Chapter: [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)
- Rule: State whether the Cyber Resilience Act covers the product. For a product it covers, name who reports exploited holes, the reporting route and the published support end date.
- Check: The report says in scope or out of scope, with the reason. For a product in scope, it names the person who reports, the route and the support end date. Each missing one is listed as a finding.
- Applies when: The project has users in the EU.
- How: The Act's reporting duties under Article 14 have applied since 11 September 2026, and the whole Act applies from 11 December 2027. After a purchase, these duties come with the product. Decide the scope with [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md). Check the reporting setup against [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md). Check the support period against [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md).

## Sources

- [European Commission: Cyber Resilience Act summary](https://digital-strategy.ec.europa.eu/en/policies/cra-summary)

## Related rules

- CMP-48 [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md) in Compliance and governance
- CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) in Compliance and governance
- CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check how personal data is handled](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/personal-data-review.md)
- Next: [List every AI model the product depends on and its AI Act role](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review.md)
- [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)