CRA Vulnerability & Reporting Obligations

Given a product and, optionally, a concrete vulnerability, produce a cited obligations assessment under the EU Cyber Resilience Act (Regulation (EU) 2024/2847): whether the product is in scope, its classification, the standing vulnerability-handling duties for the user's role, which reporting duties fire and on what timeline, and which neighbouring regimes (NIS2, GDPR, DORA) may be engaged at the entity level. Vulnerability facts (known exploitation, exploit-prediction score, public exploits) come from live CVE intelligence. Legal conclusions come only from fetched official text.

Requirements