CRA Vulnerability & Reporting Obligations

# CRA Vulnerability & Reporting Obligations

Given a product and, optionally, a concrete vulnerability, this skill produces a cited obligations assessment under the EU Cyber Resilience Act (Regulation (EU) 2024/2847): whether the product is in scope, its classification, the standing vulnerability-handling duties for the user's role, which reporting duties fire and on what timeline, and which neighbouring regimes (NIS2, GDPR, DORA) may also apply.

## Overview

Every legal claim is fetched at answer time from official sources (EUR-Lex, ENISA) with citations, and live vulnerability intelligence — CVE records, the CISA KEV catalog, EPSS scores, and exploit metadata — comes via the Ansvar Gateway MCP connector. The "actively exploited vulnerability" legal test is applied to fetched data, never assumed.

## Requirements

- The Ansvar Gateway MCP connector: `https://gateway.ansvar.eu/mcp` (OAuth 2.1 with Dynamic Client Registration; free signup at ansvar.eu).
- Works in MCP-capable agents: Claude, ChatGPT, Microsoft Copilot, Gemini, and others.

## Key Features

- **Scope determination** — applies the CRA's product and connectivity tests from Articles 2–3.
- **Product classification** — maps to important (Class I/II) and critical categories using the annexes and Commission Implementing Regulation (EU) 2025/2392.
- **Role-specific duties** — separate branches for manufacturers, importers, distributors, and open-source stewards, with Annex I vulnerability-handling requirements.
- **Article 14 reporting** — early warning, notification, final report, and the severe-incident path.
- **Live CVE intelligence** — CVE records, CISA KEV status, and EPSS scores applied to the CRA's own legal tests.
- **Entity-level screening** — NIS2, GDPR Articles 33/34, and DORA overlays where relevant.
- **Timeline analysis** — application dates and transitional rules from Articles 69–71, checked against served text rather than assumed.

## Example Usage

"Does the CRA apply to our IoT device, and what do we have to report for this CVE?" — the skill determines scope and role, classifies the product, screens the named CVE against KEV and EPSS, applies the CRA's reporting tests, and returns a cited duty-by-duty assessment with the relevant application dates.

## Repository

[github.com/Ansvar-Systems/cra-vulnerability-obligations-skill](https://github.com/Ansvar-Systems/cra-vulnerability-obligations-skill)