Support Period (CRA)

The support period is the timeframe during which a manufacturer is obligated to maintain the security of a product: developing patches for newly discovered vulnerabilities, making security updates available, and operating the CVD process. The EU Cyber Resilience Act sets the minimum support period at five years from the date the product is placed on the market — i.e., first made available to the EU market — or the expected product lifetime if shorter. For products with long expected operational lives (such as industrial control systems designed for 20-year deployment), the support period may need to extend beyond five years to reflect real-world usage.

The support period is the regulatory mechanism by which the CRA ensures that products do not become permanently vulnerable after manufacturers lose commercial interest in supporting them. Prior to the CRA, it was common for manufacturers to cease security updates for connected products within 1–2 years of sale, leaving millions of devices with no remediation path for subsequently discovered vulnerabilities. The CRA's five-year minimum support period directly addresses this market failure. Market surveillance authorities can enforce against manufacturers who cease providing security updates before the support period expires, and against those who fail to communicate the support period to buyers.

Manufacturers must determine and document the support period for each product before market placement. The period must be stated in: product packaging or printed materials; the manufacturer's website product page; and technical documentation. The communication must be clear and accessible to consumers — not buried in a legal agreement. The support period runs from the date of first market placement, not from the date of individual purchase. Manufacturers selling a product through a distribution chain must ensure their support commitment extends to cover the full five-year period even when the product has been in the distribution channel for some time before retail sale.

A frequent error is calculating the support period from the date of individual sale rather than from the date of first market placement. A product placed on the market in 2025 and sold at retail in 2026 must still be supported until at least 2030 — a full five years from 2025, not from 2026. Manufacturers also sometimes treat 'support period' as applying only to the latest hardware revision, leaving earlier revisions without adequate support. Another mistake is offering different support periods in different markets and providing the EU-mandated minimum only when specifically requested rather than as the default communicated position.