Partnerblog
Under the Cyber Resilience Act (CRA), manufacturers of products with digital elements (PDEs) must keep handling vulnerabilities and providing security updates for years after the product has left the factory. This applies to standalone software, software embedded in hardware and standalone hardware alike. The duration of that obligation is set by the support period. For most product manufacturers, this is an unfamiliar idea. EU product legislation has traditionally stopped at the moment a product is placed on the market or has limited mandatory support to consumers. The CRA does not. This blog post explains what the support period is, how manufacturers must determine and communicate it, and why it breaks with the logic of the New Legislative Framework (NLF), the common model on which EU product legislation is built.
What is the support period?
Article 3 (20) CRA defines the support period as “the period during which a manufacturer must ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Annex I, Part II CRA”. That Part II of Annex I of the CRA contains the vulnerability handling requirements, including the obligation to identify and document vulnerabilities, to remediate them without delay and to distribute security updates free of charge.
The manufacturer must set the support period to reflect the time the product is expected to be in use, so that vulnerabilities in the product are handled for its entire expected lifetime. Article 13(8) CRA sets the baseline at five years. Where the product is expected to be in use for a shorter time, the support period may be shorter. Conversely, where the product is expected to be in use for a longer time, the support period must be longer. In practice, manufacturers must always assess the support period case by case and cannot simply fall back on the default five years. This support period runs from the moment each individual unit is placed on the market, not the model. A model sold over three years with a five-year support period therefore ties the manufacturer in for eight years counted from the first unit.
Article 13 (8) CRA lists the criteria for assessing how long a support period should be. The primary criteria are reasonable user expectations, the nature and intended purpose of the product, and any requirements under Union law that determine the product’s lifetime. These are supplemented by the support periods of comparable products, the availability of the operating environment and the support period of integrated third-party components. For example, a smart thermostat hardwired into a heating installation could be expected to follow the boiler’s replacement cycle of twelve to fifteen years, whereas an app published for a single edition of a trade fair does not outlive the event. The analysis must be documented in the technical documentation. In our view, that applies equally where the manufacturer sets a shorter period than five years, even though FAQ 4.5.2 of the Commission’s FAQs on the CRA states that in that case the other Article 13 (8) CRA criteria need not be considered. We see no legal basis for that exemption, and the FAQ is not binding in any event.
Once set, the support period must be communicated. Article 13 (19) CRA requires the manufacturer to indicate its end date, at least the month and year, at the time of purchase. The CRA does not say who that purchaser is, so anyone buying the product must be told, whether that is an importer, a distributor or an end user. Manufacturers must ensure the information travels down the distribution chain. Where technically feasible, the product itself must also display an end-of-support notification once the period expires.
The concept has two limits:
- First, the support period is about cybersecurity only. It does not oblige the manufacturer to fix functional bugs, release new features, maintain compatibility with new operating environments or run a helpdesk. Whether and for how long a manufacturer offers that kind of commercial support remains a contractual matter.
- Second, the support period limits the vulnerability handling obligations, not the reporting obligations. Even after the support period has ended, the manufacturer must still notify actively exploited vulnerabilities and severe incidents of which it becomes aware. Those reporting obligations have applied since 11 September 2026, well before the rest of the CRA.
Why is this new?
EU harmonisation legislation follows a settled pattern. The manufacturer designs the product to meet the essential requirements, verifies compliance through a conformity assessment, draws up an EU declaration of conformity and affixes the CE marking. The point of reference for all of this is the placing on the market. Once a product has lawfully been placed on the market, the manufacturer’s obligations largely consist of monitoring, cooperating with market surveillance authorities and taking corrective action where non-compliance emerges. The essential requirements themselves are assessed against the product as it was when it entered the market.
The CRA departs from this pattern. It keeps the pre-market conformity assessment, but it adds a set of essential requirements that can only be met after the product has been placed on the market. Vulnerability handling is by definition a continuous activity. A product that is compliant on launch becomes non-compliant if the manufacturer stops patching it during the support period. This is the point where traditional product legislation meets cybersecurity legislation. It allows the EU legislator to hold manufacturers responsible not only for how their products are built but also for how they are maintained.
The legislator did not, however, want to impose open-ended maintenance obligations. The support period is the instrument that keeps them finite. During the support period, the manufacturer remediates vulnerabilities and reports. After the support period, it only reports. That dichotomy is the balance the CRA strikes between product security and the commercial reality of product lifecycles. The support period also affects record-keeping. The technical documentation and the EU declaration of conformity must stay available to the market surveillance authorities for ten years after the product is placed on the market, or for the support period if that runs longer. Security updates must likewise remain downloadable for ten years after their release, or until the end of the support period, whichever comes later.
The vulnerability handling requirements apply to products placed on the market after 11 December 2027. For these products, the support period must be determined before they are placed on the market, and the reasoning must sit in the technical documentation. Manufacturers should map their product portfolio against the Article 13 (8) CRA criteria now and align the support period with their commercial communications and their component suppliers’ commitments.
Auteurs
