Security and manufacturer obligations

graph TD
  M[Manufacturer of the starter] --> R[Release with changelog and documentation]
  M --> V[Handling of reported vulnerabilities]
  V --> C[Coordinating CSIRT and ENISA]
  V --> N[Security notice to users]
  R --> S[Starter on the user's PC]
  S --> K[Checks every delivery: size, SHA-256, signature, version]
  E[Customer subject to NIS 2] --> A[Assesses its suppliers]
  A --> M

The starter is a product with digital elements under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). This page explains which obligations its manufacturer has under that regulation and as a supplier to organizations covered by the NIS 2 Directive, how you report a vulnerability, and which of these obligations the starter supports today.

• Report vulnerabilities to Wolfgang.van.der.Stille@gmail.com and zp@datecpro.de; see Reporting a vulnerability.
• Reporting obligations already apply. Article 14 of the CRA has applied since 11 September 2026; the other obligations apply from 11 December 2027 (Art. 71(2)).
• Security fixes are separate releases. A security fix is released as its own patch release, free of charge, and the changelog marks it as security fix. Release 2.2.4 is such a release.
• Deliveries are checked. The starter places only copies that match size and SHA-256 of the delivery, installs only deliveries signed with the publisher's delivery key when the project names one, and from 2.2.4 refuses to go back to an older signed delivery.
• Conformity by 11 December 2027. By that date, the manufacturer issues the EU declaration of conformity with the CE marking for the starter; see Path to conformity.

The manufacturer is whoever develops a product with digital elements, or has it developed, and markets it under its own name or trademark (Art. 3(13)). The manufacturer of the starter is EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia, https://wvds.it, also when you obtain the starter through a sales partner. The White Knight Labs and WKL are trademarks of EMSR DATA, D.O.O. The application that the starter installs and starts has its own manufacturer: its publisher. The starter is a component of that delivery. A publisher who finds a vulnerability in the starter reports it to the manufacturer of the starter (Art. 13(6)) and remains responsible for the application.

Send the report by email to both addresses:

• Wolfgang.van.der.Stille@gmail.com
• zp@datecpro.de

Include the release of the starter (Wkl.Bootstrapper.exe /version or the properties of the file), the steps that reproduce the problem, what an attacker gains, and whether you know of any exploitation. Do not publish details before a fixed release is available; the manufacturer coordinates the time of publication with you.

The manufacturer records the report, assesses it, fixes the vulnerability in a patch release and then publishes a security notice with the affected and the fixed releases, the impact and the steps to take (Annex I Part II No 2 and 4). A security fix stays available for at least ten years or for the rest of the support period, whichever is longer (Art. 13(9)).

The manufacturer reports through ENISA's single reporting platform to the CSIRT designated as coordinator in the member state of its main establishment; ENISA receives the report at the same time (Art. 14(7), Art. 16). Affected users are informed of the incident or vulnerability and of the measures they can take (Art. 14(8)).

The Cyber Resilience Act is a regulation: it applies directly and uniformly in every member state, so the manufacturer has the same obligations wherever in the EU the starter is sold. The NIS 2 Directive, by contrast, takes effect only through national implementing laws. An entity generally falls under the law of the member state in which it is established (Directive (EU) 2022/2555, Art. 26(1)); special rules apply to, among others, providers of electronic communications, cloud computing services, data centers, and managed services. The directive does not bind a supplier as such; a supplier receives requirements from its customer under the law that applies to that customer.

• CSIRT of the manufacturer: the CSIRT that the member state of the manufacturer's main establishment has designated as coordinator. It receives the manufacturer's reports through the platform.
• Your national CSIRT: the coordinating CSIRT passes a report on to the CSIRTs of the member states in which the starter is made available (Art. 14(7), Art. 16), so your national CSIRT learns of it as well.
• NIS 2 in national law: each member state implements the NIS 2 Directive (EU) 2022/2555 in its own cybersecurity law, including the duty of essential and important entities to manage the security of their supply chain. Your national law decides whether your organization is such an entity; the manufacturer of the starter does not assess that for you.
• Outside the EU: the Cyber Resilience Act and the NIS 2 Directive do not apply; national rules on reporting cyberattacks may. The manufacturer accepts reports about a vulnerability in the starter from any country.

Essential and important entities must manage the security of their supply chain, including the security aspects of the relationship with each direct supplier (Directive (EU) 2022/2555, Art. 21(2)(d)). They consider the vulnerabilities specific to each supplier and the overall quality of its products and cybersecurity practices, including the security of its development procedures (Art. 21(3)). If your organization is such an entity, the starter's manufacturer is one of your suppliers. For your assessment, these sources describe the product and its handling:

• this page, the changelog with every release and its security fixes, and the reference pages on what the starter writes and checks;
• the error codes, each with its cause and resolution;
• questions for a supplier assessment go to the addresses under Reporting a vulnerability.

The remaining obligations of the regulation apply from 11 December 2027. The manufacturer already develops the starter with the essential cybersecurity requirements of Annex I in mind and meets every obligation it has as manufacturer by that date (Art. 13). For the starter, this means:

• Classification: In the manufacturer's assessment, the starter belongs to no category of important or critical products (Annexes III and IV). Boot managers in the sense of these categories manage system startup up to the operating system (Implementing Regulation (EU) 2025/2392, Annex I, point 8); the starter runs only afterwards and starts applications.
• Conformity assessment: The manufacturer assesses conformity itself through the internal control procedure (module A, Annex VIII Part I); no notified body is required for it (Art. 32(1)).
• Technical documentation: It contains, among other things, the cybersecurity risk assessment, the software bill of materials (SBOM), a machine-readable list of the components contained in the starter, the test reports, and the reasons for the support period (Art. 31, Annex VII). It is not public: the manufacturer provides it to the market surveillance authority on request and keeps it for at least ten years (Art. 13(13)).
• EU declaration of conformity and CE marking: Every release comes with the declaration, or with a simplified declaration that gives the internet address of the full one (Art. 13(20), 28). For software, the CE marking appears on the declaration or on the website accompanying the product (Art. 30(1)).
• Support period: Each release is supported for five years from the month it is released; the end date, with month and year, is stated with each release (Art. 13(8) and (19)). Security fixes come for the latest release of the major version; a newer release of the same major version is free of charge and needs no changes on your side (Art. 13(10)).

Releases placed on the market before 11 December 2027 fall under these requirements only if they are substantially modified afterwards; the reporting obligations of Article 14 apply to all releases (Art. 69(2) and (3)).

Release 3.2.0 does not yet carry an EU declaration of conformity or the CE marking. The software bill of materials and the end date of the support period are produced with the conformity assessment.

This page summarizes the manufacturer's obligations and what the starter contributes, for example as input to your supplier assessment. The legal texts listed below are binding. Whether your organization is an essential or important entity, and which obligations it has itself, is for you or your legal counsel to determine. Sources: Regulation (EU) 2024/2847, OJ L of 20 November 2024, http://data.europa.eu/eli/reg/2024/2847/oj (Art. 3(13), 13, 14, 16, 28, 30 to 32, 69, 71(2), Annexes I to III, V, VII, and VIII); Implementing Regulation (EU) 2025/2392, OJ L of 1 December 2025, http://data.europa.eu/eli/reg_impl/2025/2392/oj (Annex I, point 8); Directive (EU) 2022/2555, OJ L 333 of 27 December 2022, http://data.europa.eu/eli/dir/2022/2555/oj (Art. 21, 26).

• How to: Publish a signed delivery
• The project file: signed deliveries
• The application's folder offers an older version than the one installed before (code 52)
• The installer
• Obligations of publishers who deliver applications with the SDK: “Obligations as a publisher under the Cyber Resilience Act” in the WKL Office SDK documentation