How long must I support my product?
Under the CRA’s product-support rules, the period must reflect how long the product is expected to be used. Five years is generally the minimum, not an automatic answer for every product. If its expected use is shorter than five years, the period corresponds to that shorter use time.
Start with expected use, then apply the minimum
Article 13(8) requires the manufacturer to consider reasonable user expectations, the product’s nature and intended purpose, and relevant EU rules on product lifetime. A product reasonably expected to be used for longer than five years calls for a correspondingly longer support period.
You may also consider comparable products, availability of the operating environment, support for third-party components that provide core functions, and relevant official guidance. Record the reasons and evidence in the technical documentation. A commercial wish to stop supporting the product is not, on its own, evidence that users will stop using it.
Be clear about what security support covers
The support period concerns effective handling of vulnerabilities in the product, including its components. It is different from a promise of new features, a helpdesk contract or a hardware warranty.
Plan how reports are received, how risks are assessed, how relevant vulnerabilities are addressed and how security updates reach users. An upstream component reaching its own end of support does not automatically end your product’s support period; decide how the dependency will be maintained, replaced or otherwise addressed.
Show the end date when the customer buys
Article 13(19) requires the end date to be specified clearly and accessibly at purchase, including at least the month and year. Where technically feasible, users should also be notified when the product reaches the end of support.
Keep the declared end date, the product or version it covers and the underlying justification together. A generic statement such as “five years of support” can leave buyers unsure which date applies to the unit or version they are buying.
Separate new fixes from keeping existing updates available
A security update issued during the support period must remain available for at least ten years after its issue, or for the remainder of the support period, whichever is longer. That availability requirement is separate from the period for developing new fixes.
Software version changes need their own analysis. Article 13(10) allows remediation to focus on the latest substantially modified version only under specified conditions, including free access to that version and no extra cost to adapt the user’s hardware or software environment. Do not assume that announcing a new version automatically ends support for every older version.
Check which product and date the rules apply to
The CRA’s main product requirements generally apply from 11 December 2027. Products placed on the market before that date have transitional rules, including treatment of later substantial modifications. Article 14 reporting obligations started on 11 September 2026 and have their own application to earlier products.
For a practical support record, capture the product and version, placement date, expected use, declared end date, reasoning, key dependency support dates and the plan for security updates. Review the record when the product or its dependencies change; do not silently overwrite an earlier commitment.
A fictional example: a controller expected to last eight years
A manufacturer plans a connected industrial controller for an expected eight-year working life.
Choosing five years only because it is the usual minimum would not reflect that expected use. The manufacturer needs a support period and a documented rationale that address the product’s actual expected life.
If a core software dependency is supported for only three more years, record the gap and plan how to address it. An eight-year date written into a spreadsheet does not itself create the capacity to maintain the product.
What this overview does not decide
- It does not calculate a support deadline for a particular product, establish transitional relief or determine whether a change is substantial.
- Special software, subscription and open-source distribution arrangements need assessment against the applicable provisions and current guidance.
- Recording dates in Scopeward does not provide security maintenance or change the commitments you have made to users.
Sources and further reading
Related reading
Record your product’s starting point
Use the free assessment to record the product you supply and the facts behind its indicative result.
Start the assessment