The CRA support period

The rule

The support period should reflect the time the product is expected to be in use and is generally at least five years, unless the expected use is shorter. During this time the manufacturer must handle vulnerabilities and provide security updates.

For machinery

For long-lived machinery, five years rarely match an honest estimate of expected use. The decision and its justification belong in the technical documentation.

Updates stay available

Each security update provided must remain available for at least ten years, or until the end of the support period if that is later.

Where the end date goes

The buyer must be able to see the end of the support period at the time of purchase. In practice: on the target page behind the QR code, in the instructions and in the product information.