CRA support period: how long you must provide security updates
Under the Cyber Resilience Act, you have to decide, write down and announce how long each product gets security updates. Here are the rules on the support period, the five-year default, and what to record so the decision holds up.
At least five years
Article 13 sets a support period of at least five years. It can only be shorter if the product is expected to be in use for less than five years, and then it matches that expected use time.
To set it, you take into account what users can reasonably expect, the nature and purpose of the product, and EU law on product lifetimes. You may also look at comparable products, how long the operating environment stays available, and how long the third-party components that provide core functions are supported.
What you owe during that time
- Handle vulnerabilities as Annex I Part II describes: fix them without delay, test, publish what was fixed.
- Keep each security update available for at least ten years after it is issued, or for the rest of the support period if that is longer.
- Show the end date, with at least the month and the year, clearly at the time of purchase, and where applicable on the product, its packaging or by digital means.
- Tell users when support ends, where that is technically feasible.
What to record
For each product and version, write down the end date and why you chose it, especially if it is shorter than five years. Keep that reasoning with the technical documentation, which is kept for at least ten years or for the support period if that is longer. Check every few months which versions are approaching their end date, so the announcement is never a surprise.
Where Clearlane CRA helps
Clearlane CRA keeps your products and versions in Jira, each with its own support period. The default is five years, and a shorter period needs a recorded reason. The register lists the supports that end within six months.
These rules apply to products placed on the market from 11 December 2027. See the CRA timeline for the full sequence.
Source: Regulation (EU) 2024/2847, Article 13 and Annex I Part II. Checked on 16 October 2026.