CRA Support Period: Why Five Years Is Not the Default
Updated 20 September 20263 min read
Under the Cyber Resilience Act, every manufacturer must determine a support period for each product: the time during which it handles vulnerabilities and provides security updates. Many manufacturers are planning to declare exactly five years. That is the position most likely to be questioned.
What Article 13(8) says
The support period must reflect the time the product is expected to be in use. Without prejudice to that, it shall be at least five years — and where the product is expected to be in use for less than five years, the support period corresponds to that expected use time.
The manufacturer takes into account, in particular, reasonable user expectations, the nature of the product including its intended purpose, and relevant Union law determining product lifetime. It may also take into account:
- the support periods of similar products placed on the market by other manufacturers;
- the availability of the operating environment;
- the support periods of integrated third-party components that provide core functions;
- relevant guidance from the administrative cooperation group and the Commission.
These matters are to be considered in a manner that ensures proportionality.
Five years is a floor
The Commission's guidance on the application of the CRA (C(2026) 5252, paragraph 126) is unambiguous: a support period of five years is not to be considered as the default for all products. The minimum operates only as a safeguard. Products reasonably expected to be in use for longer should have correspondingly longer support periods.
For network devices, industrial equipment or anything installed and left in place for a decade, declaring five years because it is the legal minimum is hard to defend.
The constraint that gets underestimated
The support period is a binding commitment. During it, security updates must be provided free of charge (Annex I, Part II, point 8). If your product runs on a kernel, a cryptographic library or a base distribution whose upstream support ends before yours does, you carry the remaining maintenance yourself.
Check component end-of-life dates against the period you intend to declare — before you declare it.
Telling users
Article 13(19) (guidance paragraph 127):
- the end date of the support period — at least month and year — must be indicated at the time of purchase, clearly and understandably;
- where technically feasible, a notification must be displayed to users once the support period expires.
The end date is also item 7 of the Annex II user information, and the reasoning behind it goes into the technical documentation under Annex VII, item 4.
Iterative software
Guidance paragraph 128: where software is released iteratively, each substantially modified version placed on the market must have its own declared support period complying with Article 13(8).
Sources
- Regulation (EU) 2024/2847, Article 13(8) and 13(19); Annex I, Part II; Annexes II and VII — Official Journal of the European Union
- European Commission, Guidance on the application of the CRA, C(2026) 5252, paragraphs 125–128
Position as at 20 September 2026. General information, not legal advice.