The recitals of the EU Cyber Resilience Act say the support period for a product with digital elements should be no less than five years, unless the product's expected lifetime is shorter. Recitals explain intent rather than set binding rules, so treat five years as a planning signal and check the binding text and your own product category.
What the text says
According to the regulation's recitals:
- Recital 60: the support period should be no less than five years, unless the product's expected lifetime is shorter.
- Recital 54: manufacturers must comply with the vulnerability handling requirements throughout the support period.
- Recital 34: vulnerability handling obligations apply to products with digital elements in their entirety, including all integrated components.
- Recital 57: new security updates should, where technically feasible, be provided separately from functionality updates.
Article 71 sets the dates: the regulation applies from 11 December 2027, with Article 14 from 11 September 2026. I did not confirm the exact binding wording of the support period obligation, so verify it in the articles and annexes.
Why the length matters for robots, vehicles and chargers
A connected product can outlive its software team. A charger, a robot arm or a drone can stay in service for many years, while the libraries in its software go out of maintenance much sooner. A support period is a promise to keep fixing flaws in components you did not write.
If your supplier supports a library for three years and you promise five, you carry two years of risk yourself.
How to plan a support period
- Start from the expected lifetime. How long will customers actually use this product?
- List components and their support end dates. Operating system, libraries, models, firmware.
- Find the shortest link. The earliest end date caps your real support period.
- Decide the remedy. Upgrade, replace, fork and maintain, or accept and document the risk.
- Budget for it. Maintenance time is a cost of the product, not an extra.
- Publish the end date. Customers should know when updates stop.
Design choices that make long support affordable
- Separate security updates from feature updates. The recital encourages it, and it makes the fix smaller and easier to ship.
- Keep dependencies few and current. Each one is a promise you must keep.
- Automate inventory. If you cannot list your components, you cannot support them.
- Test the update path often. An update channel that has never been used in anger will fail when you need it.
Records to keep
Keep a table per product: version, ship date, support end date, component list and the date of the last field update. This is the record a customer, auditor or regulator is likely to ask for, and it makes a recall or advisory scope much faster.
Safeguard's SBOM and dependency scanning help track what each release contains, and its policies can flag components that you have decided are past their support date.
Click through it at your own pace, or open it full screen.
Quick check
Is five years a legal minimum for every product?
The recital says the period should be no less than five years unless the expected lifetime is shorter. Recitals are not the binding articles, so confirm what applies to your product.
Sources
Last reviewed: 19 October 2026.
