How long must a CRA support period be, and does a substantial modification extend it?

A manufacturer places a smartphone model on the EU market and declares a support period of X years from the date of placement on the market, during which it will provide security updates addressing vulnerabilities. During that period, the manufacturer releases regular software updates and substantially modified versions of the operating system, which users can install free of charge without requiring new hardware.

The manufacturer may, in accordance with Article 13(10), address and remediate vulnerabilities for the latest version of the operating system made available for that smartphone model, provided that earlier versions can be upgraded free of charge and without additional costs. For the duration of the support period, the manufacturer remains subject to the other vulnerability handling requirements, such as coordinated vulnerability disclosure and information-sharing measures.

A manufacturer places an enterprise software product with digital elements on the market and releases substantially modified versions every few months, reflecting security improvements, new features and compatibility with updated operating systems and platforms. Each version is placed on the market with a declared support period in accordance with Article 13(8). The manufacturer expects users to upgrade regularly as part of normal operation and provides access to the latest version free of charge. Applying upgrades may require reasonable operational effort, such as testing or configuration adjustments, but does not require additional costs, such as the purchase of new hardware or fundamental infrastructure changes. In this context, the manufacturer may rely on Article 13(10) to discontinue addressing and remediating vulnerabilities for earlier versions once users can upgrade to the latest version, while continuing to comply with the other vulnerability-handling requirements for all subsequent substantially modified versions.

A manufacturer places on the market a robot vacuum cleaner with an expected use time of X years, determined on the basis of the nature of the product with digital elements, including the physical durability and wear characteristics of the hardware components, and taking into account reasonable user expectations as to that product's lifetime. The manufacturer sets a support period of X years. After Y years, the manufacturer releases a software update that qualifies as a substantial modification, adding new cleaning modes and navigation features. The software update does not affect the physical durability of the hardware and does not alter reasonable user expectations as to that product's lifetime. The Article 13(8) criteria therefore continue to indicate the same expected use time. The support period of the modified product with digital elements aligns with the remaining expected use time as originally determined.

A manufacturer places on the market a complex industrial machinery product with digital elements, with a cloud back-end that constitutes a remote data processing solution. The expected use time is X years, determined in light of reasonable user expectations and the nature of the product with digital elements, such as the physical durability of the machinery hardware and expected wear and tear. The support period is set to align with that expected use time at X years. After Y years, the manufacturer rearchitects the cloud back-end (the remote data processing solution), introducing new APIs and data flows, in a manner that qualifies as a substantial modification of the product with digital elements but does not alter the nature of that product or affect user expectations. The Article 13(8) criteria therefore continue to indicate the same expected use time. The support period of the modified product with digital elements aligns with the remaining expected use time as originally determined.

A manufacturer places on the market a programmable logic controller (PLC) with an expected use time of X years, determined primarily on the basis of the nature of the product with digital elements and the durability of the underlying hardware. The support period is set accordingly. Several years after the initial placing on the market, the manufacturer carries out a substantial modification consisting of the replacement of the PLC's embedded computing platform, including the processor, memory and runtime environment, with a new generation of components designed for a significantly longer operational lifetime. As a result of the modification, reasonable user expectations and the nature of the product with digital elements change: the PLC's user may now reasonably expect the PLC to remain in productive use beyond its originally declared expected use time, supported by the new computing platform. The Article 13(8) criteria therefore indicate a longer expected use time, and the manufacturer recalculates the support period for that specific PLC accordingly.