Support period
The support period determines how long a manufacturer must fix security flaws in a product. Five years is the minimum, not the norm.
The support period is the period during which the manufacturer must ensure that vulnerabilities in a product are handled effectively. It is based on the expected use time and lasts at least five years; it may only be shorter if the product is expected to be in use for less time.
Definition in the Regulation
Article 3, point (20), of Regulation (EU) 2024/2847 defines the support period as "the period during which a manufacturer is required to ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I". Article 13(8) governs how it is determined: what counts is the length of time the product is expected to be in use, taking into account reasonable user expectations, the nature of the product and Union law on the lifetime of products. The support period is at least five years; only if the product is expected to be in use for less than five years may it be shorter, and it must then correspond to the expected use time. The criteria belong in the technical documentation. Article 13(19) requires the end date, including at least the month and year, to be specified in an easily accessible manner at the time of purchase. Article 13(9) adds that each security update, once made available, must remain available for at least ten years or for the remainder of the support period, whichever is longer.
What it means for manufacturers
For machine controllers that run for 15 to 20 years, five years would hardly be defensible; recital 60 explicitly names industrial control systems as a case for longer periods. Ten years or more is realistic, with a documented rationale that takes into account the support periods of integrated components such as the processor and operating system. The end date belongs on the data sheet, on the packaging or in the product information, not only in the contract. In the Commission's reading, the period runs from placing on the market, not from the customer's purchase; for units of the same model placed on the market later, the manufacturer sets a separate period (Commission services' FAQ, question 4.5.3). According to the Commission guidance, a substantial modification requires a reassessment but does not automatically restart the period (paragraph 133). The obligation applies from 11 December 2027 to products newly placed on the market.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Security update
- Substantial modification
- Information and instructions to the user (Annex II)
- Technical documentation