Recital 60 of the EU Cyber Resilience Act says the support period should be no less than five years, unless the lifetime of the product is less than five years. It also says a shorter period is acceptable only where expected use justifies it. Confirm how this applies to your product with counsel.
What a support period is
A support period is the time during which you handle vulnerabilities and provide security updates for a product. The CRA requires manufacturers to handle vulnerabilities during the lifecycle of their products, according to the European Commission's overview. The recital sets the benchmark for how long that lifecycle should be treated as running.
Recitals explain the intent of the law. The binding rules sit in the articles, so read those and the Commission's guidance before committing to a number in a contract. The Commission page says it published practical implementation guidance on 27 July 2026 and that main obligations apply from 11 December 2027.
What it means for the roadmap
Support periods multiply your maintenance surface. If each major release must be patched for years, then:
- you hold older dependency versions longer
- you need a way to ship fixes to old branches
- you need to tell customers the end date up front
| Decision | Product manager question |
|---|---|
| Release lines | How many versions do we keep patched at once? |
| End date | Is it published on the product page and in contracts? |
| Upgrade path | Can customers move forward easily to stay supported? |
| Components | Do our dependencies have support windows as long as ours? |
The last row is the one that bites. If you promise five years on top of a library whose upstream support ends in two, you inherit the gap.
Steps
- List each product line and its expected lifetime.
- For each, list the key components and their upstream support dates, from the projects' own documentation.
- Mark where your promise outlasts upstream support.
- For each gap, choose: upgrade the component, carry patches yourself, or shorten the product's stated lifetime with a justification.
- Publish end of support dates clearly.
Keep dates findable
Customers and answer engines look for a plain statement of how long a version is supported. Put the date in a table on one stable page and update it when plans change.
Quick check
Is five years a legal minimum for every product?
The recital says no less than five years unless the product's lifetime is shorter. The details depend on the articles and the product, so ask counsel.
Does support mean new features?
No. It refers to vulnerability handling and security updates.
Safeguard's asset discovery and dependency scanning help track which versions and components are live across your products, and the free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
