Security and manufacturer obligations

graph TD
  M[Manufacturer of WKL Office JSON] --> R[Release with changelog, documentation, software bill of materials]
  M --> V[Handling of reported vulnerabilities]
  V --> C[Coordinating CSIRT and ENISA]
  V --> N[Security notice to users]
  R --> P[Library in the publisher's Office application]
  E[Customer subject to NIS 2] --> A[Assesses its suppliers]
  A --> M

WKL Office JSON is a product with digital elements under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). This page explains which obligations its manufacturer has under that regulation and as a supplier to organizations covered by the NIS 2 Directive, how you report a vulnerability, and what WKL Office JSON does for the safe handling of JSON from untrusted sources.

• Report vulnerabilities to Wolfgang.van.der.Stille@gmail.com and zp@datecpro.de; see Reporting a vulnerability.
• Reporting obligations already apply. Article 14 of the CRA has applied since 11 September 2026; the other obligations apply from 11 December 2027 (Art. 71(2)).
• Security fixes are separate releases. A security fix is released as its own patch release, free of charge, and the changelog marks it as security fix.
• JSON from outside is untrusted input. The parser stops at 512 levels of nesting with an error instead of crashing Office, refuses invalid JSON with the position of the error, and keeps numbers exact.
• Conformity by 11 December 2027. By that date, the manufacturer issues the EU declaration of conformity with the CE marking for WKL Office JSON; see Path to conformity.

The manufacturer is whoever develops a product with digital elements, or has it developed, and markets it under its own name or trademark (Art. 3(13)). The manufacturer of WKL Office JSON is EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia, https://wvds.it, also when you obtain it through a sales partner. The White Knight Labs and WKL are trademarks of EMSR DATA, D.O.O. Applications that use the library have their own manufacturer: their publisher. WKL Office JSON is a component of such an application. A publisher who finds a vulnerability in the library reports it to its manufacturer (Art. 13(6)) and remains responsible for the application.

Send the report by email to both addresses:

• Wolfgang.van.der.Stille@gmail.com
• zp@datecpro.de

Include the release of WKL Office JSON (the version of Wkl.Office.JSON.dll in its file properties), the steps that reproduce the problem, what an attacker gains, and whether you know of any exploitation. Do not publish details before a fixed release is available; the manufacturer coordinates the time of publication with you.

The manufacturer records the report, assesses it, fixes the vulnerability in a patch release and then publishes a security notice with the affected and the fixed releases, the impact and the steps to take (Annex I Part II No 2 and 4). A security fix stays available for at least ten years or for the rest of the support period, whichever is longer (Art. 13(9)).

The manufacturer reports through ENISA's single reporting platform to the CSIRT designated as coordinator in the member state of its main establishment; ENISA receives the report at the same time (Art. 14(7), Art. 16). Affected users are informed of the incident or vulnerability and of the measures they can take (Art. 14(8)).

The Cyber Resilience Act is a regulation: it applies directly and uniformly in every member state, so the manufacturer has the same obligations wherever in the EU WKL Office JSON is sold. The NIS 2 Directive, by contrast, takes effect only through national implementing laws. An entity generally falls under the law of the member state in which it is established (Directive (EU) 2022/2555, Art. 26(1)); special rules apply to, among others, providers of electronic communications, cloud computing services, data centers, and managed services. The directive does not bind a supplier as such; a supplier receives requirements from its customer under the law that applies to that customer.

• CSIRT of the manufacturer: the CSIRT that the member state of the manufacturer's main establishment has designated as coordinator. It receives the manufacturer's reports through the platform.
• Your national CSIRT: the coordinating CSIRT passes a report on to the CSIRTs of the member states in which WKL Office JSON is made available (Art. 14(7), Art. 16), so your national CSIRT learns of it as well.
• NIS 2 in national law: each member state implements the NIS 2 Directive (EU) 2022/2555 in its own cybersecurity law, including the duty of essential and important entities to manage the security of their supply chain. Your national law decides whether your organization is such an entity; the manufacturer of WKL Office JSON does not assess that for you.
• Outside the EU: the Cyber Resilience Act and the NIS 2 Directive do not apply; national rules on reporting cyberattacks may. The manufacturer accepts reports about a vulnerability in WKL Office JSON from any country.

Essential and important entities must manage the security of their supply chain, including the security aspects of the relationship with each direct supplier (Directive (EU) 2022/2555, Art. 21(2)(d)). They consider the vulnerabilities specific to each supplier and the overall quality of its products and cybersecurity practices, including the security of its development procedures (Art. 21(3)). If your organization is such an entity, the manufacturer of WKL Office JSON is one of your suppliers. For your assessment, these sources describe the product and its handling:

• this page, the changelog with every release and its security fixes, and the page Values and limits with every limit and every refused conversion;
• the page How to: Install and deploy WKL Office JSON on what the registration writes and how it is removed;
• questions for a supplier assessment go to the addresses under Reporting a vulnerability.

The remaining obligations of the regulation apply from 11 December 2027. The manufacturer already develops WKL Office JSON with the essential cybersecurity requirements of Annex I in mind and meets every obligation it has as manufacturer by that date (Art. 13). For WKL Office JSON, this means:

• Classification: In the manufacturer's assessment, WKL Office JSON belongs to no category of important or critical products (Annexes III and IV): it has no security function and no network access, and it manages no identities and no keys.
• Conformity assessment: The manufacturer assesses conformity itself through the internal control procedure (module A, Annex VIII Part I); no notified body is required for it (Art. 32(1)).
• Technical documentation: It contains, among other things, the cybersecurity risk assessment, the test reports, and the reasons for the support period (Art. 31, Annex VII). It is not public: the manufacturer provides it to the market surveillance authority on request and keeps it for at least ten years (Art. 13(13)). The software bill of materials is also in the release package (sbom.cdx.json).
• EU declaration of conformity and CE marking: Every release comes with the declaration, or with a simplified declaration that gives the internet address of the full one (Art. 13(20), 28). For software, the CE marking appears on the declaration or on the website accompanying the product (Art. 30(1)).
• Support period: Each release is supported for five years from the month it is released; the end date, with month and year, is stated with each release (Art. 13(8) and (19)). Security fixes come for the latest release of the major version; a newer release of the same major version is free of charge and needs no changes on your side (Art. 13(10)).

Releases placed on the market before 11 December 2027 fall under these requirements only if they are substantially modified afterwards; the reporting obligations of Article 14 apply to all releases (Art. 69(2) and (3)).

This release does not yet carry an EU declaration of conformity or the CE marking. The end date of the support period is produced with the conformity assessment.

This page summarizes the manufacturer's obligations and what WKL Office JSON contributes, for example as input to your supplier assessment. The legal texts listed below are binding. Whether your organization is an essential or important entity, and which obligations it has itself, is for you or your legal counsel to determine. Sources: Regulation (EU) 2024/2847, OJ L of 20 November 2024, http://data.europa.eu/eli/reg/2024/2847/oj (Art. 3(13), 13, 14, 16, 28, 30 to 32, 69, 71(2), Annexes I to III, V, VII, and VIII); Directive (EU) 2022/2555, OJ L 333 of 27 December 2022, http://data.europa.eu/eli/dir/2022/2555/oj (Art. 21, 26).

• How to: Install and deploy WKL Office JSON
• Values and limits
• Obligations of publishers who deliver applications with the SDK: “Publisher obligations under the Cyber Resilience Act” in the WKL Office SDK documentation
• Security of the starter of delivered applications: “Security and manufacturer obligations” in the WKL Bootstrapper documentation