Security and manufacturer obligations

graph TD
  M[Manufacturer of WKL Office SDK] --> R[Release with changelog, documentation, software bill of materials]
  M --> V[Handling of reported vulnerabilities]
  V --> C[Coordinating CSIRT and ENISA]
  V --> N[Security notice to users]
  R --> P[SDK on the developer's and the build computer]
  E[Customer subject to NIS 2] --> A[Assesses its suppliers]
  A --> M

WKL Office SDK is a product with digital elements under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). This page explains which obligations its manufacturer has under that regulation and as a supplier to organizations covered by the NIS 2 Directive, how you report a vulnerability, and what WKL Office SDK does for the computers that develop and build your applications.

• Report vulnerabilities to Wolfgang.van.der.Stille@gmail.com and zp@datecpro.de; see Reporting a vulnerability.
• Reporting obligations already apply. Article 14 of the CRA has applied since 11 September 2026; the other obligations apply from 11 December 2027 (Art. 71(2)).
• Security fixes are separate releases. A security fix is released as its own patch release, free of charge, and the changelog marks it as security fix.
• A build runs code of your sources. Whoever can change the sources can run code on the computer that builds them; build only sources you trust. Databases the SDK opens itself start no code of their own.
• Conformity by 11 December 2027. By that date, the manufacturer issues the EU declaration of conformity with the CE marking for WKL Office SDK; see Path to conformity.

The manufacturer is whoever develops a product with digital elements, or has it developed, and markets it under its own name or trademark (Art. 3(13)). The manufacturer of WKL Office SDK is EMSR DATA, D.O.O., Trg komandanta Staneta 8, 1000 Ljubljana, Slovenia, https://wvds.it, also when you obtain it through a sales partner. The White Knight Labs and WKL are trademarks of EMSR DATA, D.O.O. Applications built and delivered with the SDK have their own manufacturer: their publisher, whose obligations are described in Publisher obligations under the Cyber Resilience Act. A publisher who finds a vulnerability in the SDK reports it to its manufacturer (Art. 13(6)) and remains responsible for the application.

Send the report by email to both addresses:

• Wolfgang.van.der.Stille@gmail.com
• zp@datecpro.de

Include the release of WKL Office SDK (the name of the installation folder, or the version of bin\wkl-office.exe in its file properties), the steps that reproduce the problem, what an attacker gains, and whether you know of any exploitation. Do not publish details before a fixed release is available; the manufacturer coordinates the time of publication with you.

The manufacturer records the report, assesses it, fixes the vulnerability in a patch release and then publishes a security notice with the affected and the fixed releases, the impact and the steps to take (Annex I Part II No 2 and 4). A security fix stays available for at least ten years or for the rest of the support period, whichever is longer (Art. 13(9)).

The manufacturer reports through ENISA's single reporting platform to the CSIRT designated as coordinator in the member state of its main establishment; ENISA receives the report at the same time (Art. 14(7), Art. 16). Affected users are informed of the incident or vulnerability and of the measures they can take (Art. 14(8)).

The Cyber Resilience Act is a regulation: it applies directly and uniformly in every member state, so the manufacturer has the same obligations wherever in the EU WKL Office SDK is sold. The NIS 2 Directive, by contrast, takes effect only through national implementing laws. An entity generally falls under the law of the member state in which it is established (Directive (EU) 2022/2555, Art. 26(1)); special rules apply to, among others, providers of electronic communications, cloud computing services, data centers, and managed services. The directive does not bind a supplier as such; a supplier receives requirements from its customer under the law that applies to that customer.

• CSIRT of the manufacturer: the CSIRT that the member state of the manufacturer's main establishment has designated as coordinator. It receives the manufacturer's reports through the platform.
• Your national CSIRT: the coordinating CSIRT passes a report on to the CSIRTs of the member states in which WKL Office SDK is made available (Art. 14(7), Art. 16), so your national CSIRT learns of it as well.
• NIS 2 in national law: each member state implements the NIS 2 Directive (EU) 2022/2555 in its own cybersecurity law, including the duty of essential and important entities to manage the security of their supply chain. Your national law decides whether your organization is such an entity; the manufacturer of WKL Office SDK does not assess that for you.
• Outside the EU: the Cyber Resilience Act and the NIS 2 Directive do not apply; national rules on reporting cyberattacks may. The manufacturer accepts reports about a vulnerability in WKL Office SDK from any country.

Essential and important entities must manage the security of their supply chain, including the security aspects of the relationship with each direct supplier (Directive (EU) 2022/2555, Art. 21(2)(d)). They consider the vulnerabilities specific to each supplier and the overall quality of its products and cybersecurity practices, including the security of its development procedures (Art. 21(3)). If your organization is such an entity, the manufacturer of WKL Office SDK is one of your suppliers. For your assessment, these sources describe the product and its handling:

• this page, the changelog with every release and its security fixes, and the command-line reference with every exit code;
• the security policy SECURITY.md and the manufacturer information MANUFACTURER.md in the release package;
• questions for a supplier assessment go to the addresses under Reporting a vulnerability.

The remaining obligations of the regulation apply from 11 December 2027. The manufacturer already develops WKL Office SDK with the essential cybersecurity requirements of Annex I in mind and meets every obligation it has as manufacturer by that date (Art. 13). For WKL Office SDK, this means:

• Classification: In the manufacturer's assessment, WKL Office SDK belongs to no category of important or critical products (Annexes III and IV). Deliveries are signed by the starter of WKL Bootstrapper, not by the SDK; the SDK is no public key infrastructure and manages no identities and no networks.
• Conformity assessment: The manufacturer assesses conformity itself through the internal control procedure (module A, Annex VIII Part I); no notified body is required for it (Art. 32(1)).
• Technical documentation: It contains, among other things, the cybersecurity risk assessment, the test reports, and the reasons for the support period (Art. 31, Annex VII). It is not public: the manufacturer provides it to the market surveillance authority on request and keeps it for at least ten years (Art. 13(13)). The software bill of materials is also in the release package (sbom.cdx.json).
• EU declaration of conformity and CE marking: Every release comes with the declaration, or with a simplified declaration that gives the internet address of the full one (Art. 13(20), 28). For software, the CE marking appears on the declaration or on the website accompanying the product (Art. 30(1)).
• Support period: Each release is supported for five years from the month it is released; the end date, with month and year, is stated with each release (Art. 13(8) and (19)). Security fixes come for the latest release of the major version; a newer release of the same major version is free of charge and needs no changes on your side (Art. 13(10)).

Releases placed on the market before 11 December 2027 fall under these requirements only if they are substantially modified afterwards; the reporting obligations of Article 14 apply to all releases (Art. 69(2) and (3)).

This release does not yet carry an EU declaration of conformity or the CE marking. The end date of the support period is produced with the conformity assessment.

This page summarizes the manufacturer's obligations and what WKL Office SDK contributes, for example as input to your supplier assessment. The legal texts listed below are binding. Whether your organization is an essential or important entity, and which obligations it has itself, is for you or your legal counsel to determine. Sources: Regulation (EU) 2024/2847, OJ L of 20 November 2024, http://data.europa.eu/eli/reg/2024/2847/oj (Art. 3(13), 13, 14, 16, 28, 30 to 32, 69, 71(2), Annexes I to III, V, VII, and VIII); Directive (EU) 2022/2555, OJ L 333 of 27 December 2022, http://data.europa.eu/eli/dir/2022/2555/oj (Art. 21, 26).

• Publisher obligations under the Cyber Resilience Act
• How to: Install the WKL Office SDK
• Command-line reference: wkl-office
• A password is in the sources
• Security of the starter of delivered applications: “Security and manufacturer obligations” in the WKL Bootstrapper documentation