Support periods and security updates

The support period is the time during which the manufacturer effectively handles vulnerabilities in the product and its components. It should reflect real use, not only a sales cycle or warranty.

Law

When determining support, consider in particular:

reasonable user expectations;
the product’s nature and intended purpose;
expected use time and relevant EU product-lifetime law;
proportionately, support for similar products, operating-environment availability, support for integrated components providing core functions and relevant Commission or ADCO guidance.

Support lasts at least five years. It may be shorter where expected use is less than five years, but must then match that expected use. Where expected use is longer, support should be correspondingly longer.

Record the factors in the technical documentation. At purchase, state the support end date clearly, understandably and accessibly, at least as month and year and, where appropriate, on the product, packaging or digitally. Where technically feasible in light of the product’s nature, display an end-of-support notification to users.

During support, handle vulnerabilities effectively and distribute security updates securely, without delay and free of charge with user advice. A different agreement is possible between a manufacturer and a business user for a tailor-made product.

Each security update issued during support must remain available for at least ten years after issue or for the remainder of the support period, whichever is longer.

For successive substantially modified software versions, the manufacturer may under specified conditions patch only the latest placed version if users of earlier versions have free access to it and incur no additional cost to adapt their hardware or software environment. Other vulnerability-handling obligations remain.

Guidance — making the support decision

Create a short approved record for each model:

Question	Evidence
How long will the product actually be used?	user research, service data, replacement cycles, contracts
What does its core functionality depend on?	SBOM, firmware, OS, cloud, cryptography, certificates
Until when are key components supported?	supplier commitments and EOL dates
How long is the operating environment available?	platforms, hardware, protocols and backend
What do comparable products provide?	documented market comparison
Does other law require longer life or support?	product legal analysis

Align the date across packaging, product page, application, contract, instructions and version register. Do not use vague phrases such as “at least five years” without a specific purchase-time end date.

Update-process check

Updates are authentic, verified, tamper-resistant and securely delivered.
Automatic installation is the default where applicable, with a clear user opt-out.
The advisory explains the issue, affected versions, severity, impact and action.
The update is free unless the narrow tailor-made B2B agreement exception applies.
Fixes remain available for the legal period and their archive is maintained.
The process covers failed updates, rollback, offline products and end of support.

Page sources: CRA Article 13(8)–(11), 13(19); Annex I Part I point 2(c), Part II points 2 and 7–8; Annex II points 7–8; Recitals 57–62; Commission final guidance on support periods.