L’Institut des juristes d’entreprise (IJE) est l’ordre professionnel des 2647 juristes d’entreprise en Belgique

On 17 September 2026, the European Commission published its proposal for the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act (EU KIDS Act). The proposal has attracted significant attention because it would introduce a minimum age of 15 for the autonomous use of certain social networking and video-sharing platform services.

Under the Cyber Resilience Act (CRA), manufacturers of products with digital elements (PDEs) must keep handling vulnerabilities and providing security updates for years after the product has left the factory. This applies to standalone software, software embedded in hardware and standalone hardware alike. The duration of that obligation is set by the support period. For most product manufacturers, this is an unfamiliar idea. EU product legislation has traditionally stopped at the moment a product is placed on the market or has limited mandatory support to consumers. The CRA does not. This blog post explains what the support period is, how manufacturers must determine and communicate it, and why it breaks with the logic of the New Legislative Framework (NLF), the common model on which EU product legislation is built.