Support period

The CRA requires manufacturers to determine a support period reflecting how long the product is expected to remain in use, taking into account factors such as expected lifetime and comparable products, with a general minimum of five years unless the product's expected lifetime is genuinely shorter. The support period, and the date it ends, must be communicated to users, typically at the point of sale.

The commitment behind the period

• Security updates for vulnerabilities discovered during the support period must be provided free of charge, separable from functional updates where feasible.
• The manufacturer must maintain the capability to build, sign and distribute updates for the whole declared period.
• For products with long field lifetimes, the support period may need to extend well beyond typical software product cycles.

Setting the support period is a commercial and engineering decision, not just a compliance statement. Committing to a period the organisation cannot realistically sustain — because the update pipeline, signing infrastructure, or component supply will not last that long — creates an obligation that will be visible as a failure later rather than avoided now.

For long-lived embedded products, the support period decision needs to account for component end-of-life, dependency on third-party update infrastructure, and the practical mechanism by which updates reach deployed units.