Article 13.8 of Regulation (EU) 2024/2847 requires you to determine a support period during which you provide security updates for your product. The support period must reflect the expected time of use, considering user expectations and the nature of the product. Recital 59 references 5 years as a default where no shorter period is justified. You cannot sell a connected device to the EU market and stop patching it after 12 months. CRACheck documents your support period commitment as part of the 8-document Annex VII dossier.

The support period obligation transforms the economics of connected products. A Chinese manufacturer that ships a WiFi smart plug and never releases a firmware update is non-compliant from day one of enforcement. Article 13.8 requires a support period that reflects the expected time of use. Annex I Part II requires security updates to be provided without delay during that period. Annex II requires the support period to be communicated to users. The support period is documented in the Technical Documentation (Annex VII point 4) and the User Information (Annex II). CRACheck structures both. 15-25 minutes. €149 per product. Browser-side.

Generate CRA dossier — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side

Key numbers

Art. 13.8

Manufacturer must determine and declare a support period reflecting expected time of use.

5 years

Recital 59 default. Where expected use is longer (industrial, infrastructure), longer support required.

Annex VII.4

Support period determination must be documented in the technical documentation.

How to define and document your CRA support period

The support period is not a warranty. It is a firmware update commitment backed by regulation.

Assess expected product lifetime

How long do users actually use your product? Smart plug: 3-5 years. Router: 5-7 years. Industrial gateway: 10-15 years. EV charger: 10-15 years.

Plan your firmware update infrastructure

OTA delivery, update testing pipeline, vulnerability monitoring, SBOM tracking. This must be operational for the entire support period.

Declare the support period

Choose a period consistent with expected use. Declaring 2 years for a product used 7 years is a compliance risk under Art. 13.8.

Document in CRACheck

The support period is captured in Doc 2 (Technical Documentation, Annex VII point 4), Doc 4 (User Information, Annex II) and Doc 8 (Obligations Calendar).

Communicate to users

Annex II requires informing users about the support period, including the end date. This must appear on packaging, in documentation or at the point of sale.

Plan for end-of-support

What happens when the support period ends? Inform users. Consider offering extended support as a commercial service.

The support period is not a warranty. It is a firmware update commitment backed by regulation.

Support period mistakes

❌

ART. 13.8

We declare a 1-year support period to minimise our obligation

Article 13.8 of Regulation (EU) 2024/2847 requires the support period to reflect "the time during which the product is expected to be in use, considering in particular reasonable user expectations, the nature of the product including its expected lifetime and other relevant factors." A 1-year support period for a product used 5 years is not consistent with user expectations. Market surveillance authorities may consider it non-compliant.

❌

ANNEX I, PART II

We provide firmware updates when we have time — there is no timeline

Annex I Part II point 8 of Regulation (EU) 2024/2847 requires security updates to be provided "without delay" and, where applicable, through automatic updates with opt-out. "Without delay" means as soon as a security patch is available and tested. Months-long delays between vulnerability discovery and patch release are non-compliant.

❌

ANNEX II

Users do not need to know the support period — we just provide updates

Annex II of Regulation (EU) 2024/2847 requires the manufacturer to inform users about the expected product lifetime during which security updates will be provided. This includes the end date of the support period. The information must be provided at the time the product is made available. Users have the right to know when security updates will stop.

What each CRACheck dossier contains: 8 documents

The support period obligation touches multiple CRA documents. CRACheck generates 8 PDFs that consistently document your support period across Technical Documentation, User Information and Obligations Calendar.

Product Classifier

Determines product category per Annex III. Defines conformity assessment route under Art. 32.

Technical Documentation

Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.

Risk Assessment

Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.

User Information

Information and instructions per Annex II. Security properties, support period, vulnerability reporting.

Declaration of Conformity

EU declaration of conformity per Art. 28 and Annex V.

CVD Policy

Coordinated Vulnerability Disclosure policy per Annex I Part II.

ENISA Notification Template

Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.

Obligations Calendar

Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated in your browser. No product data is transmitted to any server.

What you pay for support period documentation

🧾 PRODUCT LIFECYCLE CONSULTANCY (SUPPORT PERIOD STRATEGY)

€10,000–€25,000

Per product family. Strategy + documentation. 2-4 months.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history