How Long Do Security Updates Last Under the CRA?

The Support Period Rule Under Article 13(8)

The CRA requires manufacturers to provide security updates for at least 5 years from placing the product on the market, or for the expected use time when that is shorter.

Understanding Support Period Factors

When determining support periods, manufacturers must consider: the expected use time, reasonable user expectations, the nature and intended purpose of the product, relevant Union law determining product lifetime, the support periods of similar products, the availability of the operating environment, the support periods of integrated third-party components, and guidance from ADCO and the Commission.

Illustrative Examples by Product Category

The figures below are illustrative, not set by the CRA: you must determine the support period for your own product.

• Consumer Electronics: Typically 3-5 years. If the expected use time is 3 years, the support period = 3 years. If it is 6 years, the support period should reflect that expected use time and in any case be at least 5 years.
• Hardware Components (motherboards, routers, switches): Often 10+ years expected use. Manufacturers should ensure longer support periods that match or exceed expected use time.
• Software (OS, tools, applications): Can have 5-10+ year lifetimes. Support period should reflect expected use time, typically 5-10 years.
• Industrial Equipment: Often 15-20+ years. Support periods should extend correspondingly.
• Subscription-based products with remote data processing: The support period should reflect how long the product is expected to remain in use, for example the duration of the subscription.

It is legally required to explicitly state the End of Support date clearly and in an understandable manner at time of purchase, on product packaging, or through other appropriate means (the end date must include at least the month and year, Article 13(19)).

Security updates made available during the support period must remain available for a minimum of 10 years after they are issued, or for the remainder of the support period, whichever is longer (Article 13(9)).