Security update
A security update closes a security flaw without changing the product. The Regulation requires it to be free of charge, to arrive promptly and to be installable without functional changes.
A security update is an update that fixes or mitigates a vulnerability in a product. It is the most important tool of vulnerability handling during the support period.
Definition in the Regulation
The requirements are set out in Annex I, Part II, of Regulation (EU) 2024/2847. Point (2) requires vulnerabilities to be addressed and remediated without delay, including by providing security updates, and, where technically feasible, to provide them separately from functionality updates. Point (7) requires mechanisms for secure distribution, where applicable automatically. Point (8) requires security updates to be disseminated without delay and free of charge, accompanied by advisory messages for users; the only exception is tailor-made products where this has been agreed with the business user. Annex I, Part I, point (2)(c), requires that vulnerabilities can be addressed through updates, where applicable through automatic updates with an opt-out. Article 13(9) requires each security update, once made available, to remain available for at least ten years or for the remainder of the support period.
What it means for manufacturers
There are three practical consequences: security fixes must not wait for the next feature release, maintenance contracts must not be a condition for security updates, and old updates must not disappear from the server once a product is discontinued. According to recital 39, a security update that decreases the risk and does not change the intended purpose is not a substantial modification, so it does not trigger a new conformity assessment. According to recital 56, the Regulation does not expect automatic updates in industrial and critical environments; there, secure manual distribution with a security advisory remains the usual approach. Once an update is available, information about the fixed vulnerability must be published (Annex I, Part II, point (4)), and this can be delayed until users have had the chance to patch.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit