How Long Do Security Updates Last Under the CRA?

The Support Period Rule Under Article 13(8)

The CRA requires manufacturers to provide security updates for at least 5 years from placing the product on the market, or for the expected use time when that is shorter.

Understanding Support Period Factors

When determining support periods, manufacturers must consider: the expected use time, reasonable user expectations, product nature, intended purpose, relevant Union law, and ENISA guidance.

Examples by Product Category

• Consumer Electronics: Typically 3-5 years. If expected lifetime is 3 years, support period = 3 years. If lifetime is 6 years, support period = at least 5 years minimum.
• Hardware Components (motherboards, routers, switches): Often 10+ years expected use. Manufacturers should ensure longer support periods that match or exceed expected use time.
• Software (OS, tools, applications): Can have 5-10+ year lifetimes. Support period should reflect expected use time, typically 5-10 years.
• Industrial Equipment: Often 15-20+ years. Support periods should extend correspondingly.
• Subscription-Based SaaS: Support period corresponds to the lifetime of the subscription model.

It is legally required to explicitly state the End of Support date clearly and in an understandable manner at time of purchase, on product packaging, or through other appropriate means.