How long is the CRA support period?

At least five years (Art 13(8)), shorter only where the product's expected use time is under five years — and each security update issued must remain available for at least ten years (Art 13(9)).

Must the support period be disclosed to buyers?

Yes — the end date of the support period is to be specified at the time of purchase (Art 13(19)).

Kilde › Guides › CRA › The CRA support period: the five-year …

The CRA support period: the five-year floor and the ten-year tail

Current to 26 August 2026 · updates land in the changelog.

From full application, every in-scope product carries a defined support period — and its length is not a marketing choice. The duties sit in Article 13.

The rules

At least five years of vulnerability handling (Article 13(8)) — shorter only where the product's expected use time is under five years.
Each security update stays available for at least ten years after issuance, or the remainder of the support period if longer (Article 13(9)) — the long tail that outlives the support window itself.
The end date is stated at purchase (Article 13(19)) — support duration becomes visible commercial information, not an internal roadmap detail.
A single point of contact for users (Article 13(17)).

What this changes commercially

The support period converts patching from goodwill into a dated commitment printed at the point of sale. For hardware businesses used to end-of-life by press release, the operational lift is real: version-support matrices, update distribution that still works in year nine, and a stated end date sales teams cannot quietly extend. Determining the period has methodology guidance in the Commission's draft CRA guidance — draft being the operative word at our verification date.

How it meets the reporting duty

The support period is a 2027 obligation for products placed on the market; the reporting duty arrives first (September 2026) and reaches the installed base regardless of any support-period analysis. A product outside any support window can still trigger a 24-hour report if an actively exploited vulnerability surfaces in it.

Related guides

Quick answers

How long is the CRA support period?: At least five years (Art 13(8)), shorter only where the product's expected use time is under five years — and each security update issued must remain available for at least ten years (Art 13(9)).
Must the support period be disclosed to buyers?: Yes — the end date of the support period is to be specified at the time of purchase (Art 13(19)).

Be reporting-ready before 11 September 2026.

The CRA Reporting-Ready Pack: the staged 24h / 72h / final-report runbook and templates, vulnerability-vs-incident triage worksheet, CSIRT-routing and main-establishment worksheet, platform registration runbook, CVD policy and evidence log — built from the regulation and the ENISA platform guides, with pinpoint citations.

Get the pack — US$390 Free 4-page sample (PDF)

Instant download · 14-day unconditional refund · single-organisation licence · full product page

General information only — not legal advice, and never a conformity assessment. Whether a specific product falls in a listed category is decided against the binding technical descriptions in Implementing Regulation (EU) 2025/2392, and reporting-platform mechanics are ENISA-published material marked subject to change. Sources are Regulation (EU) 2024/2847 (CELEX 32024R2847; Annex III/IV item texts read verbatim from EUR-Lex) and our audited kit research. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com