CRA 5-Year Support Period — Security Update Obligation

Key numbers

5 years

minimum support period — longer if product is expected to be in use beyond five years (Art. 13(8))

10 years

minimum retention period for technical documentation after market placement (Art. 13(13))

Free

security updates must be provided free of charge during the support period — Part II, point (8) of Annex I

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Determine expected use time

Article 13(8) lists factors: reasonable user expectations, nature of the product, intended purpose, relevant Union law. If your industrial gateway has a 10-year lifecycle, the support period is 10 years.

Document the rationale

Annex VII, point (4) requires the technical documentation to include the information taken into account to determine the support period.

Establish vulnerability handling processes

Part II of Annex I mandates: SBOM, remediating vulnerabilities without delay, regular testing, public disclosure, CVD policy, contact address, secure update distribution, free security updates.

Plan update infrastructure

Part I, point (2)(c) of Annex I requires automatic security updates enabled by default, with a clear opt-out mechanism.

Retain security updates

Article 13(9) requires each security update to remain available after issuance for a minimum of 10 years or the remainder of the support period.

Generate documentation

CRACheck structures the support period rationale into the Annex VII documentation alongside all other required elements.

Common mistakes

❌

SUPPORT PERIOD

"Setting the support period at exactly five years for a product expected to last ten"

Article 13(8), second subparagraph, is clear: if your product is expected to be in use for longer than five years, the support period must match that expected use time. Setting it at five for a product with a ten-year lifecycle is a documentation gap that market surveillance authorities can challenge.

❌

UPDATE COST

"Charging users for security updates"

Part II, point (8) of Annex I requires security updates to be disseminated free of charge during the support period, "unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product." For standard products, security updates must be free.

❌

RATIONALE GAP

"Not documenting why you chose a specific support period"

Annex VII, point (4) specifically requires the technical documentation to include the relevant information taken into account to determine the support period. A support period stated without rationale does not meet this requirement.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Sets the product category, which may inform support period expectations. Industrial IoT may face longer expected use times than consumer electronics.

Technical Documentation

Annex VII, point (4) section specifically structured to capture the support period rationale: expected product lifecycle, user expectations, component support periods, and the resulting determination.

Risk Assessment

Part I of Annex I requirements include ongoing availability and update mechanisms. The risk assessment must consider threats over the full support period.

User Information

Annex II, point 7 requires the product to be accompanied by information about the support period end-date and the type of technical security support offered.

Declaration of Conformity

Per Article 28 and Annex V. The support period commitment is part of the overall conformity context.

CVD Policy

Must be operational for the entire support period. Part II, point (5) of Annex I requires a policy, not a temporary arrangement.

Notification Template

Article 14 reporting obligations apply throughout the support period, not just at launch. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Maps your support period start and end dates, security update retention milestones (10 years per Article 13(9)), and ENISA reporting activation.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 SUPPORT PERIOD PLANNING BY A COMPLIANCE CONSULTANT

€5,000–€10,000

Separate engagement for lifecycle analysis, vulnerability management planning, and legal review for support period contractual terms. No tooling to map rationale to Annex VII, point (4). Recurring fees for updates.

✓ CRACHECK

€149

€149 one-time. Annex VII, point (4) rationale section included. Integrated with the full 8-document package. Regenerate if product lifecycle assumptions change. Support period milestones in Obligations Calendar.

Two layers

● LAYER 1

The Annex VII, point (4) rationale and the lifecycle context

CRACheck captures the factors behind your support period determination and embeds them in the technical documentation per Annex VII. It also structures the CVD policy, ENISA template, and user information (Annex II, point 7) around the support period timeline.

∅ LAYER 2

Five years of engineering, not five years of paperwork

CRACheck does not build your OTA update infrastructure. It does not staff your vulnerability response team. It does not run security tests per Part II, point (3) of Annex I. The support period is an operational commitment that the documentation records but does not fulfill.

The documentation says "we commit to five years of support." Your engineering team delivers on that commitment. Both layers must exist.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Vulnerability handling failures during support period (Art. 64(2))

€15,000,000 / 2.5%

Failure to handle vulnerabilities per Part II of Annex I during the support period.

🟠

Documentation failures (Art. 64(3))

€10,000,000 / 2%

Failure to document the support period rationale per Annex VII, point (4) and Article 31.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Providing misleading information about the support period.

Alternatives

Criterion	No support period defined	1-year warranty only	Consultant lifecycle plan	CRACheck
Art. 13(8) compliance	Non-compliant	Non-compliant (below 5-year min)	Compliant, but €5K–€10K	Compliant, €149
Annex VII, point (4) rationale	Missing	Missing	Custom report	Structured, integrated
Time to document	N/A	N/A	4–8 weeks	15–25 minutes
Regulation update handling	Not tracked	Not tracked	New engagement	Free regeneration

Multiple products with different support period requirements?

Each product may have a different expected lifecycle. CRACheck generates independent documentation with product-specific support period rationale. Pack of 10: €99/product.

Request Volume Pricing

The Obligations Calendar adapts to each product's individual support period.

What CRACheck guarantees and what it does not

CRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the data you input, including the support period rationale per Annex VII, point (4). You are responsible for the accuracy and reasonableness of the factors you declare.

We guarantee that the document structure follows Article 31 and Annex VII and that all cited legal references are correct. We do not guarantee that a market surveillance authority will accept your support period determination in a specific case.

CRACheck is not legal advice. For product lifecycle and contractual support period questions, consult a specialised advisor.

Frequently asked questions

Can the support period be shorter than five years?

Only if the product is expected to be in use for less than five years. Article 13(8), third subparagraph, states that where a product is expected to be in use for less than five years, the support period shall correspond to the expected use time. For all other products, five years is the floor.

What counts as a security update under the CRA?

Part II, point (8) of Annex I refers to updates that address identified security issues. Article 13(10) distinguishes between security updates and functionality updates, requiring that where technically feasible, new security updates be provided separately from functionality updates.

Must security updates be automatic?

Part I, point (2)(c) of Annex I requires that security updates be installable enabled as a default setting, with a clear and easy-to-use opt-out mechanism. The default must be automatic installation, but users must have the option to opt out.

How long must each security update remain available?

Article 13(9) requires that each security update remain available after issuance for a minimum of 10 years or for the remainder of the support period, whichever is longer.

Can the support period be changed after the product is on the market?

The support period must be determined before market placement and documented per Annex VII, point (4). Article 13(18) requires the end-date to be communicated to users via Annex II. Shortening it after market placement would conflict with the information already provided to users.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Article 13(8) — Support period
Regulation (EU) 2024/2847 — Annex I Part II — Vulnerability handling requirements

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.