End-of-Life Policy

An end-of-life (EOL) policy is a public commitment by a manufacturer specifying when a product will cease to receive security updates, bug fixes, and technical support. It defines the 'end of support' or 'end of maintenance' date after which the manufacturer no longer has an active obligation to address newly discovered vulnerabilities. Well-defined EOL policies give users and organisations time to plan device replacement or compensating controls before support ceases. EOL should be distinguished from 'end of sale' (when a product stops being sold) — security support obligations continue long after sale ends.

The CRA establishes that manufacturers must provide security updates for the expected product lifetime or at least five years, whichever is shorter. Critically, Annex I Part II(2) requires manufacturers to clearly communicate to users the duration of the support period at the point of purchase — not after sale. This means the EOL date must be known and published before a product is placed on the market, not determined reactively. ENISA guidance reinforces that manufacturers should make EOL dates searchable and machine-readable. Failure to meet the minimum support period or to communicate it adequately is a breach of the CRA's essential requirements.

A compliant EOL policy should: (1) state the specific end-of-support date (or minimum years from date of market placement) for each product version; (2) be published on the manufacturer's website and referenced in product documentation and packaging; (3) be communicated to users 12 months before support ends, giving advance notice to plan migration; (4) cover what happens to the product after EOL — for example, whether the manufacturer will make a final firmware release, what users should do with internet-connected devices after support ends, and how to safely decommission the product; (5) define separate dates for security updates and feature updates if applicable.

Many manufacturers have historically left EOL dates undefined or communicated them only in obscure support documentation. Under the CRA, failing to communicate the support period at point of purchase is a compliance violation, not merely a customer service issue. A second error is conflating end of sale with end of support — regulatory obligations for security updates continue for the full support period regardless of whether the product is still commercially available. Manufacturers also sometimes announce EOL with insufficient notice, depriving users of time to plan replacements. For IoT products, abrupt EOL without a final hardening release can leave millions of devices permanently exposed.