The period during which a manufacturer must deliver security updates under the Cyber Resilience Act. Usually at least five years, unless the product is used for a shorter period.
The support period is the time during which the manufacturer of a product with digital elements must fix vulnerabilities and provide security updates. It is set out in Article 13(8) of the Cyber Resilience Act. The manufacturer determines it so that it reflects the length of time the product is expected to be in use, taking into account user expectations, the nature of the product and its intended purpose. It is at least five years. Only where the product is expected to be in use for less than five years does it have to match the expected use time.
The end date, at least month and year, must be stated clearly and understandably at the time of purchase (Article 13(19)). Security updates made available during the period must stay available after being issued for at least ten years or for the remainder of the support period, whichever is longer (Article 13(9)). Where technically feasible, the product should notify users when the period ends. The obligations apply to products placed on the market from December 11, 2027. For products placed on the market earlier, they apply only after a substantial modification (Article 69).
In operation, the support period works like a warranty limit. After it ends, the manufacturer no longer delivers security updates, yet the connected controller or gateway usually stays in the installation. That is a cost item, because replacement or protection becomes necessary, and a liability item: under the new Product Liability Directive, the lack of necessary security updates can point to a product defect. Anyone who keeps running unpatched components after the end of the period should do so deliberately and with a risk assessment. Put the end date in your calendar the way you would an inspection deadline.
What matters
- Record the end date of the support period for each connected component in the asset file.
- Ask for the date in writing before you buy.
- Plan replacement or protection, such as network separation and access restrictions, before the end date.
- Agree with the service company who installs and documents updates during the support period.
Suppose an operator is told that the support period of a new remote maintenance gateway ends in a certain month. He enters the date in his calendar and, a year ahead, uses the service meeting to clarify whether replacement, a move to a successor model or switching off the remote connection makes sense.
In the original wording
“[…] the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.”
“Manufacturers shall ensure that the end date of the support period referred to in paragraph 8, including at least the month and the year, is clearly and understandably specified at the time of purchase in an easily accessible manner and, where applicable, on the product with digital elements, its packaging or by digital means.”