The CRA support period: how long you must keep fixing

Under the Cyber Resilience Act (CRA), the support period is the time during which you must handle your product's vulnerabilities and ship security updates. It must be at least five years, unless the product is expected to be in use for less than that, in which case it matches the expected use time (Article 13(8)). You show the end date, at least month and year, when the customer buys (Article 13(19)).

What "support" means here

The law defines the support period as the time during which you must make sure your product's vulnerabilities are handled in line with Part II of Annex I (Article 3(20)). In practice that's the whole vulnerability handling list: keep the SBOM current, fix flaws without delay, test, publish advisories and ship security updates free of charge.

It isn't a warranty for features. You can stop adding features whenever you like. You can't stop fixing security problems before the end date.

Setting the length

Five years is the floor, and the law asks you to think about more. You set the period to reflect how long the product is expected to be in use, taking into account in particular (Article 13(8)):

• reasonable user expectations;
• the nature of the product, including its intended purpose;
• relevant EU law that sets product lifetimes.

You may also consider what other makers offer for similar products, how long the operating environment stays available, how long your key third-party parts are supported, and guidance from ADCO (the group of national market surveillance authorities) and the Commission.

Here is a quick way to sanity-check your number. A smart thermostat stays on a wall for a long time; a five-year period that ends while most units are still installed may not match reasonable expectations. A trade-show badge reader used for one season is different.

The Commission can set minimum periods for specific product categories by delegated act, if market data shows periods are too short (Article 13(8)).

Write down why

The information you used to set the support period goes into your technical documentation (Article 13(8) and Annex VII, point 4). So keep a short note: the expected use time, what you compared against, and the support dates of the chip vendor's SDK and the Linux kernel branch you depend on. If your SoC vendor stops kernel updates after three years, you need a plan for years four and five.

Telling buyers

What	Where	Source
End date of support, at least month and year	Clearly shown at the time of purchase; on the product, packaging or by digital means where applicable	Article 13(19)
Type of security support and end date	In the user information and instructions	Annex II, point 7
A notice that support has ended	Shown to users when it's technically feasible	Article 13(19)

"At the time of purchase" means the shop page, the quote or the order form. A date buried in a manual nobody opens until after delivery won't meet it.

What keeps running after the end date

Some duties outlast the support period:

• Each security update you released during support stays available for at least 10 years after it was issued, or for the rest of the support period, whichever is longer (Article 13(9)).
• You keep the technical documentation and the declaration of conformity for at least 10 years after placing the product on the market, or for the support period, whichever is longer (Article 13(13)).

Software with several versions

For software where you release new, substantially modified versions, you may meet the duty to fix vulnerabilities only for the latest version, provided users of older versions can get the latest one free of charge, without extra costs to adjust their hardware or software (Article 13(10)). For firmware this usually means everyone on the same hardware gets the newest release.

What it costs in practice

A five-year period means five years of watching every part in every firmware you still support. For a small team with three products and two active firmware lines each, that's six parts lists to re-check whenever a new CVE appears. The work is mostly the watching, plus the time to rebuild and ship when something matters.

What Proofsheet does here

The Paperwork pack (€249) includes a support-period record: a filled-in page with the dates and the reasons you give, ready for your technical file. You choose the period, not the app, and Proofsheet doesn't promise updates for you.

Watchdog (€79 a month, opening soon) is a software subscription built for the years that follow. It re-scans every release you upload, keeps the parts list for each, and sends you an email when a part you use is exploited. Everything the app generates is technical evidence, not a legal certificate.

See prices, or read the guides on manufacturer obligations and the SBOM.