Security and manufacturer obligations

graph TD
  M[Manufacturer of WKL Forms Object Library] --> R[Release with changelog, documentation, software bill of materials]
  M --> V[Handling of reported vulnerabilities]
  V --> C[Coordinating CSIRT and ENISA]
  V --> N[Security notice to users]
  R --> P[Controls in the publisher's Access application]
  E[Customer subject to NIS 2] --> A[Assesses its suppliers]
  A --> M

WKL Forms Object Library is a product with digital elements under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). This page explains which obligations its manufacturer has under that regulation and as a supplier to organizations covered by the NIS 2 Directive, how you report a vulnerability, and what WKL Forms Object Library does for the data and the credentials of your application.

• Report vulnerabilities to Wolfgang.van.der.Stille@gmail.com and zp@datecpro.de; see Reporting a vulnerability.
• Reporting obligations already apply. Article 14 of the CRA has applied since 11 September 2026; the other obligations apply from 11 December 2027 (Art. 71(2)).
• Security fixes are separate releases. A security fix is released as its own patch release, free of charge, and the changelog marks it as security fix.
• Nothing leaves the PC on its own. The controls open a network connection only when your application sends a web request, send the Windows account only with UseWindowsLogin, and keep API keys and tokens in memory only.
• Conformity by 11 December 2027. By that date, the manufacturer issues the EU declaration of conformity with the CE marking for WKL Forms Object Library; see Path to conformity.

The manufacturer is whoever develops a product with digital elements, or has it developed, and markets it under its own name or trademark (Art. 3(13)). The manufacturer of WKL Forms Object Library is EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia, https://wvds.it, also when you obtain it through a sales partner. The White Knight Labs and WKL are trademarks of EMSR DATA, D.O.O. Applications that use the controls have their own manufacturer: their publisher. WKL Forms Object Library is a component of such an application. A publisher who finds a vulnerability in the library reports it to its manufacturer (Art. 13(6)) and remains responsible for the application.

Send the report by email to both addresses:

• Wolfgang.van.der.Stille@gmail.com
• zp@datecpro.de

Include the release of WKL Forms Object Library (the version of Wkl.Forms.ObjectLibrary.dll in its file properties), the steps that reproduce the problem, what an attacker gains, and whether you know of any exploitation. Do not publish details before a fixed release is available; the manufacturer coordinates the time of publication with you.

The manufacturer records the report, assesses it, fixes the vulnerability in a patch release and then publishes a security notice with the affected and the fixed releases, the impact and the steps to take (Annex I Part II No 2 and 4). A security fix stays available for at least ten years or for the rest of the support period, whichever is longer (Art. 13(9)).

The manufacturer reports through ENISA's single reporting platform to the CSIRT designated as coordinator in the member state of its main establishment; ENISA receives the report at the same time (Art. 14(7), Art. 16). Affected users are informed of the incident or vulnerability and of the measures they can take (Art. 14(8)).

The Cyber Resilience Act is a regulation: it applies directly and uniformly in every member state, so the manufacturer has the same obligations wherever in the EU WKL Forms Object Library is sold. The NIS 2 Directive, by contrast, takes effect only through national implementing laws. An entity generally falls under the law of the member state in which it is established (Directive (EU) 2022/2555, Art. 26(1)); special rules apply to, among others, providers of electronic communications, cloud computing services, data centers, and managed services. The directive does not bind a supplier as such; a supplier receives requirements from its customer under the law that applies to that customer.

• CSIRT of the manufacturer: the CSIRT that the member state of the manufacturer's main establishment has designated as coordinator. It receives the manufacturer's reports through the platform.
• Your national CSIRT: the coordinating CSIRT passes a report on to the CSIRTs of the member states in which WKL Forms Object Library is made available (Art. 14(7), Art. 16), so your national CSIRT learns of it as well.
• NIS 2 in national law: each member state implements the NIS 2 Directive (EU) 2022/2555 in its own cybersecurity law, including the duty of essential and important entities to manage the security of their supply chain. Your national law decides whether your organization is such an entity; the manufacturer of WKL Forms Object Library does not assess that for you.
• Outside the EU: the Cyber Resilience Act and the NIS 2 Directive do not apply; national rules on reporting cyberattacks may. The manufacturer accepts reports about a vulnerability in WKL Forms Object Library from any country.

Essential and important entities must manage the security of their supply chain, including the security aspects of the relationship with each direct supplier (Directive (EU) 2022/2555, Art. 21(2)(d)). They consider the vulnerabilities specific to each supplier and the overall quality of its products and cybersecurity practices, including the security of its development procedures (Art. 21(3)). If your organization is such an entity, the manufacturer of WKL Forms Object Library is one of your suppliers. For your assessment, these sources describe the product and its handling:

• this page, the changelog with every release and its security fixes, and the reference of the per-user registration;
• the fixed error numbers of the controls, each with its meaning (How to: Handle errors of WKL controls in VBA);
• questions for a supplier assessment go to the addresses under Reporting a vulnerability.

The remaining obligations of the regulation apply from 11 December 2027. The manufacturer already develops WKL Forms Object Library with the essential cybersecurity requirements of Annex I in mind and meets every obligation it has as manufacturer by that date (Art. 13). For WKL Forms Object Library, this means:

• Classification: In the manufacturer's assessment, WKL Forms Object Library belongs to no category of important or critical products (Annexes III and IV): it manages no identities and no access (its web requests can pass on the Windows account but manage none), shows no web content, and is neither security software nor network management.
• Conformity assessment: The manufacturer assesses conformity itself through the internal control procedure (module A, Annex VIII Part I); no notified body is required for it (Art. 32(1)).
• Technical documentation: It contains, among other things, the cybersecurity risk assessment, the test reports, and the reasons for the support period (Art. 31, Annex VII). It is not public: the manufacturer provides it to the market surveillance authority on request and keeps it for at least ten years (Art. 13(13)). The software bill of materials is also in the release package (sbom.cdx.json).
• EU declaration of conformity and CE marking: Every release comes with the declaration, or with a simplified declaration that gives the internet address of the full one (Art. 13(20), 28). For software, the CE marking appears on the declaration or on the website accompanying the product (Art. 30(1)).
• Support period: Each release is supported for five years from the month it is released; the end date, with month and year, is stated with each release (Art. 13(8) and (19)). Security fixes come for the latest release of the major version; a newer release of the same major version is free of charge and needs no changes on your side (Art. 13(10)).

Releases placed on the market before 11 December 2027 fall under these requirements only if they are substantially modified afterwards; the reporting obligations of Article 14 apply to all releases (Art. 69(2) and (3)).

This release does not yet carry an EU declaration of conformity or the CE marking. The end date of the support period is produced with the conformity assessment.

This page summarizes the manufacturer's obligations and what WKL Forms Object Library contributes, for example as input to your supplier assessment. The legal texts listed below are binding. Whether your organization is an essential or important entity, and which obligations it has itself, is for you or your legal counsel to determine. Sources: Regulation (EU) 2024/2847, OJ L of 20 November 2024, http://data.europa.eu/eli/reg/2024/2847/oj (Art. 3(13), 13, 14, 16, 28, 30 to 32, 69, 71(2), Annexes I to III, V, VII, and VIII); Directive (EU) 2022/2555, OJ L 333 of 27 December 2022, http://data.europa.eu/eli/dir/2022/2555/oj (Art. 21, 26).

• How to: Install the released package
• What the per-user registration writes
• How to: Handle errors of WKL controls in VBA
• Obligations of publishers who deliver applications with the SDK: “Publisher obligations under the Cyber Resilience Act” in the WKL Office SDK documentation
• Security of the starter of delivered applications: “Security and manufacturer obligations” in the WKL Bootstrapper documentation