Guide Last updated 8 October 2026 13 min read

Support period: how long security updates are required

The support period is the time during which a manufacturer must fix vulnerabilities in its product. Five years is the floor, not the norm. This page explains how the period is determined, what to watch out for and what applies to machinery.

The Cyber Resilience Act requires manufacturers to handle vulnerabilities in their products throughout a support period that reflects the expected use time of the product and lasts at least five years (Article 13(8)). The end date must be visible at the time of purchase, stating at least the month and year (Article 13(19)). Security updates must be provided without delay and free of charge, and where possible separately from new features (Annex I, Part II, points (2) and (8)). Each update remains available for at least ten years after it has been issued (Article 13(9)). For machinery and control systems that run for 15 or 20 years, five years is hard to justify.

Key points

The yardstick is the expected use time. Five years is the minimum; a shorter period is only possible where the product is demonstrably used for less time (Article 13(8)).
The end date is shown at the time of purchase on the product, the packaging or by digital means, stating at least the month and year (Article 13(19)).
Security updates: without delay, free of charge and, where possible, separate from functionality updates (Annex I, Part II, points (2) and (8)).
Every security update remains available for at least ten years (Article 13(9)).
Maintaining only the latest version is permitted if users can switch to it free of charge and without new hardware (Article 13(10)).

What is the support period?

Article 3, point (20), defines it as the period during which the manufacturer is required to ensure that vulnerabilities are handled effectively in accordance with Annex I, Part II. It does not mean warranty or the supply of spare parts. It means the obligation to fix vulnerabilities once they become known: identify them, remediate them, distribute security updates and inform users.

How long must the period be?

The Regulation does not set a fixed figure for each type of product. It sets a yardstick and a floor. The second subparagraph of Article 13(8) requires the period to reflect the length of time the product is expected to be in use. The relevant factors are reasonable user expectations, the nature and intended purpose of the product, and relevant Union law determining the lifetime of products. Manufacturers may also take into account comparable products, the availability of the operating environment and the support periods of integrated components that provide core functions. The third subparagraph sets the floor: at least five years. Only where the product is expected to be in use for less time does the period correspond to that shorter use time.

Recital 60 makes the direction clear. The period should be longer than five years for hardware components such as motherboards and microprocessors, for routers, modems and switches, and for operating systems. Products intended for industrial settings, such as industrial control systems, "are often in use for significantly longer periods of time", according to the recital. A shorter period is only acceptable where shorter use can be demonstrated; the recital gives the examples of a contact tracing application intended for use during a pandemic and subscription software that can no longer be used once the subscription expires.

The reasoning belongs in the technical documentation (fifth subparagraph of Article 13(8), Annex VII, point (4)), and authorities can ask to see it (recital 59). A manufacturer that simply sets five years across the board leaves a gap here.

Which periods are plausible?

The table is a starting point for your own reasoning, not a legal statement. The Commission may set binding minimum periods for specific product categories by delegated act (fourth subparagraph of Article 13(8)); it has not done so yet.

Type of product	Expected use time	Reasonable period (for orientation)
Control system of a packaging machine	15 to 20 years	Well over five years, realistically 10 years or more; take the support periods of the processor and operating system into account
Router or switch for corporate networks	More than five years	Longer than five years (recital 60 names this type of product explicitly)
Smart plug for consumers	Five to seven years	Five to seven years, counted from when the devices are placed on the market, not from the end customer's purchase (example in the Commission services' FAQ, question 4.5.3)
Desktop software with annual major releases	Several years, with version changes	At least five years; maintaining only the latest version is possible if the upgrade is free of charge (Article 13(10))
Subscription software that cannot be used after the subscription ends	Term of the subscription	Shorter than five years is possible if the shorter use can be demonstrated (recital 60)

What must be visible at the time of purchase?

Article 13(19) requires the end date to be clearly specified at the time of purchase in an easily accessible manner, stating at least the month and year, on the product, its packaging or by digital means. Where technically feasible, users should be notified when the end of the period is reached. Annex II, point (7), also requires the date in the information and instructions to the user. An end date that appears only in the contract is not enough.

The Regulation does not say explicitly when the period starts. "At the time of purchase" in Article 13(19) governs when the end date must be visible, not when the period begins. The Commission counts from placing on the market. In its FAQ (question 4.5.3), a manufacturer places 10,000 identical devices on the market in January 2028 with five years of support, so until January 2033; a distributor may still sell remaining devices after that date. On this example, a device sold late therefore does not receive the full span from its purchase. If the manufacturer places a further 5,000 devices of the same model on the market in 2030, it must set a separate period for them under Article 13(8). The smartphone example in the Commission guidance also counts from the day of placing on the market (example 52). For software, the guidance treats all copies of a version as placed on the market at the same time (paragraph 14); the end date then attaches to the version, not to the individual download. Neither the guidance nor the FAQ is legally binding.

What applies to security updates?

Four rules from Article 13 and Annex I, Part II:

Without delay and free of charge. Annex I, Part II, point (8), requires security updates to be disseminated without delay and free of charge, accompanied by advisory messages for users. The only exception is for tailor-made products for business users where this has been agreed (recital 64). Making security updates conditional on a maintenance contract is therefore not compatible with the Regulation.
Separate from functionality updates. Annex I, Part II, point (2), requires security updates to be provided separately from functionality updates where technically feasible.
Available for ten years. Under Article 13(9), each security update remains available for at least ten years after it has been issued or for the remainder of the support period, whichever is longer.
Distributed securely. Annex I, Part II, point (7), requires mechanisms for secure distribution, and Annex I, Part I, point (2)(c), requires updates to be easy to install, automatically where applicable with an option to opt out. Recital 56 exempts components intended for integration and professional networks from this, in particular critical and industrial environments.

Do I have to keep maintaining old versions?

Not in every case. Article 13(10) allows vulnerability handling to be limited to the latest substantially modified version, provided users can access that version free of charge and without additional costs for adjusting their hardware or software environment. Recital 40 adds that where the latest version no longer runs on the existing hardware, the last compatible version must continue to be supported. According to the Commission guidance (paragraph 130), additional costs means new hardware, replacing infrastructure or a fundamental change to the operating environment; the customer's normal testing and configuration effort does not count.

Historical versions may remain in public archives if the manufacturer clearly informs users of the risks (Article 13(11)). What a new version means for the period is covered under Substantial modification. In short, according to the guidance a substantial modification does not automatically restart the period. The manufacturer reassesses it and only recalculates it if the factors determining the expected use time change (paragraphs 133 to 135). For software, the guidance requires a separately declared period for each substantially modified version (paragraph 131); if the factors stay the same, the original period continues, even if fewer than five years remain (paragraph 128).

What this means in practice: machinery and consumer products

A manufacturer of packaging machines supplies a control system that runs at the customer's site for 15 to 20 years. Recital 60 explicitly names industrial control systems as a case for longer periods. Five years would be open to challenge; ten years or more is realistic, with documented reasoning and an eye on the support periods of the processor and operating system. Automatic updates cannot be expected in this environment (recital 56), so secure manual distribution and security advisories are needed, for example in CSAF (a machine-readable format for security advisories). The end date belongs in the data sheet and the documentation. More on this under The CRA in machinery and plant engineering.

A manufacturer of smart plugs expects five to seven years of use: at least five years from when the devices are placed on the market, a separate end date for production batches shipped later, automatic updates by default with an opt-out, and the end date on the packaging or in the app store listing.

For both, the period has consequences beyond development. Contracts: supply and maintenance contracts must reflect the period and the fact that security updates are free of charge; supplier contracts must ensure that components are supported for at least as long as the product. Spare parts and discontinuation: each new quantity of a model placed on the market needs its own period (Commission services' FAQ, question 4.5.3), so a discontinuation must allow for the period of the last devices shipped. Devices already held by a distributor may be sold by it even after the end date. Reporting obligation: Article 14 applies throughout the entire period, even in the twelfth year of a control system. CRA Response Center monitors the reporting address for this and alerts the people responsible, however old the product is.

Common mistakes

Declaring five years across the board. Without reasoning based on the use time, and implausible for industrial products.
End date only in the contract. Article 13(19) requires it to be easily accessible at the time of purchase.
Security fix only in the next feature release. Annex I, Part II, point (2), requires separation where technically feasible.
Maintenance contract as a condition. Security updates are free of charge (Annex I, Part II, point (8)).
Deleting old updates. Ten years of availability under Article 13(9).
Buying components without a matching support commitment. If support for the operating system ends earlier, the manufacturer carries the risk for the remaining years.

What remains open?

The delegated acts on minimum periods for specific product categories (fourth subparagraph of Article 13(8)) have not been adopted. The Regulation itself does not say explicitly when the period starts; the Commission guidance (example 52) and the Commission services' FAQ (question 4.5.3) count from placing on the market, and neither is binding. The guidance does not explain how paragraph 128 (the original period continues if the factors are unchanged) and paragraph 131 (a separately declared period for each substantially modified software version) relate to each other. The relationship with the right to repair (Directive (EU) 2024/1799) and with ecodesign requirements has not been settled.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

How long do I have to provide security updates?

At least five years, and longer if the expected use time is longer (Article 13(8)). For machinery and control systems, five years can rarely be justified.

May I state less than five years?

Only if the product is demonstrably used for less time (third subparagraph of Article 13(8)), for example subscription software that stops working when the subscription ends (recital 60).

Where must the end date appear?

Easily accessible at the time of purchase, stating at least the month and year, on the product, its packaging or by digital means (Article 13(19)), and also in the information and instructions to the user (Annex II, point (7)).

Do security updates have to be free of charge?

Yes (Annex I, Part II, point (8)). The only exception is for tailor-made products for business users where this has been agreed.

What does "available for ten years" mean?

Each security update provided must remain available for ten years after it has been issued or for the remainder of the support period, whichever is longer (Article 13(9)).

Do I have to maintain old versions?

Not if users can switch to the latest version free of charge and without new hardware (Article 13(10)). If the latest version does not run on the existing hardware, the last compatible version must continue to be supported (recital 40).

Does the period run from the customer's purchase?

Not on the Commission's reading. Its FAQ (question 4.5.3) counts from when the devices are placed on the market, and a distributor may sell remaining stock even after the end date. Article 13(19) only requires the end date to be visible at the time of purchase.

Does the period restart with a new version?

Not automatically. According to the Commission guidance, a substantial modification requires a reassessment; the period is recalculated if the factors determining the expected use time change (paragraphs 133 to 135). For software, each substantially modified version needs its own declared period (paragraph 131).

Sources

Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 3, point (20), Article 13(8) to (11) and (19), Annex I, Part I, point (2)(c), Part II, points (2), (7) and (8), Annex II, point (7), Annex VII, point (4), recitals 40, 56, 59, 60, 61 and 64, Publications Office of the EU, 20 November 2024, Article 13(8) as corrected on 2 July 2025.
Commission guidance on the application of the Cyber Resilience Act, Annex to Communication C(2026) 5252, paragraphs 14 and 125 to 135, example 52, European Commission, 27 July 2026.
FAQs on the Cyber Resilience Act, Version 1.4, question 4.5.3, Commission services, 4 September 2026.
The new CRA guidance in practice, Schutzwerk, 2026.
Cyber Resilience Act guidance: products, obligations, Gamingtechlaw, 5 August 2026.
EU Cyber Resilience Act: New Guidance Clarifies Scope, Orrick, September 2026.
CRA Commission guidance, Noze, 28 July 2026.