FlagThis

Abstract

The EU Cyber Resilience Act assumes that vulnerability discovery is slow and human‑scarce, that a product’s exploitable flaw set is knowable at shipment, that exploitation is a rare detectable event, and that remediation keeps pace with discovery. Cybersecurity AI (CAI) agents that autonomously find and exploit flaws falsify all four premises, causing the Act’s process‑based compliance to bend under volume or break when the underlying landscape collapses. The paper maps each regulatory mechanism to the AI‑agent dynamic that stresses it, shows that point‑in‑time certification becomes invalid, and proposes a continuous, agent‑operated conformity model validated on a humanoid robot and a lawn‑mower.