Under the Cyber Resilience Act (CRA), manufacturers of products with digital elements (PDEs) must keep handling vulnerabilities and providing security updates for years after the product has left the factory. This applies to standalone software, software embedded in hardware and standalone hardware alike. The duration of that obligation is set by the support period. For most product manufacturers, this is an unfamiliar idea. EU product legislation has traditionally stopped at the moment a product is placed on the market or has limited mandatory support to consumers. The CRA does not. This blog post explains what the support period is, how manufacturers must determine and communicate it, and why it breaks with the logic of the New Legislative Framework (NLF), the common model on which EU product legislation is built.