CRA Support Period and Security Update Obligations
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, requires manufacturers to provide security updates for their products with digital elements. They must do so for as long as the product is expected to be in use, and for at least five years from placing on the market. This obligation ties up development capacity for years, changes the cost calculation of entire product lines, and reaches into your supplier contracts.
Contents
What the CRA requires
It comes down to four points:
- fix vulnerabilities in your products without delay,
- offer a reporting channel through which third parties can report vulnerabilities to you,
- deliver updates through a secure mechanism, and
- provide security updates free of charge.
The update obligation is therefore only one part of the CRA obligations of manufacturers.
You may charge for new features, but not for security patches. Where technically feasible, you must also deliver the two separately. Your customer should be able to close a vulnerability without having to buy a new generation of features. Many release processes today cannot keep the two apart.
How long must you provide updates?
You determine the support period yourself, but not arbitrarily. It must reflect the length of time during which the product is expected to be in use (Article 13 of the CRA). What counts is the product's intended purpose and what users can reasonably expect. You may also take into account comparable products on the market and the support commitments for core components sourced from suppliers. The minimum is five years, unless the product is expected to be in use for a shorter time.
For a single product, this can be planned. Across a portfolio, it becomes a permanent task. Take a manufacturer with 15 product lines in several variants and firmware versions. For each of them, the manufacturer must assess vulnerabilities, build updates, test them, and deliver them for years. That requires development capacity, working build and test environments for old software versions, and a way to reach existing customers at all.
Manufacturers who have worked on the principle “product sold, support on request” must rebuild their support from the ground up.
Ten years of availability: the second deadline
Article 13 sets a second deadline. Every security update you have issued must remain available for at least 10 years after it was issued, or for the remainder of the support period if that is longer.
The two deadlines work differently. The support period determines how long you must develop new updates. The 10-year rule determines how long an update already released must remain accessible. An update issued early in a long support period stays available at least until the support period ends. An update issued near the end stays available for 10 years after its release, well beyond the end of the support period.
You therefore need an update infrastructure that outlasts active support. Archive download portals, update servers, signing keys, and the related documentation so that a patch is still available years after the last hour of development work.
The update obligation extends into the supply chain
Your update obligation is only as reliable as the commitments of your suppliers. In industrial practice, two to three years pass between the first evaluation of a component and its use in a series product. Only then does your support period of at least five years begin. Your supplier must therefore still patch the component seven to eight years after its release.
This belongs in supplier selection and in the contract. Does your supplier commit to this period? Does it actively track vulnerabilities in its component? The expensive case is the end of support for a part that is still in your products in the field. Toward the market, the obligation still remains with you.
The cost question: security updates without revenue
Free security updates change the cost calculation of product support. Until now, support could be designed as a separate source of revenue or ended once the warranty expired. For security updates, the CRA rules out both.
The CRA allows one narrow exception. For a tailor-made product for a specific business user, you and that customer may agree otherwise by contract. For off-the-shelf products, there is no such room.
The cost of security maintenance over at least five years must therefore be built into the product price. This gets tight for low-cost products with many variants. If a single update has to be qualified and rolled out across several lines and variants, it can quickly cost more than the original development of the product.
The expected use time determines the support period
Industrial control systems often run in the field for ten to fifteen years, and routers and operating systems well beyond five years. Your support period then runs that long, too. You can go below five years only for products that are actually in use for a shorter time.
Decide deliberately how long your products are expected to be in use, and record what you base this estimate on. This justification belongs in the technical documentation. If you set a short use time while comparable products on the market are in use for ten years, you must be able to explain this to market surveillance.
The decision does not rest with you alone in any case. If market surveillance shows that manufacturers set their support periods too short, the European Commission can set minimum support periods for specific product categories.
What you need to build now
The CRA obligations apply in full from December 2027. By then, manufacturers need build environments for legacy products, reliable supplier contracts, and capacity planning that anchors security support firmly in the development process. The task is largest for companies with a broad portfolio, a high share of supplied components, and support that has so far worked on request.
Place the update obligation in the overall picture of the Cyber Resilience Act before you set your priorities.
Which CRA obligations are still open for you?
The update obligation is only one of many CRA requirements that manufacturers must implement by December 2027. With the CRA readiness check, you can see in a few minutes where your company stands and where action is needed.
