Tell customers early, through every channel they use, with the exact date of the last security fix and a clear upgrade path. The recitals of the EU Cyber Resilience Act say manufacturers should inform users when a product has reached the end of its support period. Do not wait until the day.
What the recitals say
In the text of Regulation (EU) 2024/2847, Recital 56 says manufacturers should inform users when a product has reached the end of the support period. Recital 60 says the support period should be no less than five years unless the expected product lifetime is shorter. Recital 67 says manufacturers should inform users about incidents of severe impact on product security and about corrective measures users can take. Recitals explain intent. The binding duties are in the articles, which I did not read in this fetch, so confirm the operative wording with counsel.
What a good notice contains
| Element | Example wording |
|---|---|
| Product and versions | Server 4.x, all patch levels |
| Last fix date | Last security fix released on a stated date |
| What changes after | No further security fixes, no support cases for security issues |
| Upgrade path | Version to move to, and a link to the upgrade guide |
| Where to ask | Support contact and an escalation route for customers who cannot move |
| Date of notice | The true date the notice was sent |
Timeline
- Publish the support dates at release time. Customers should never be surprised.
- Send a first reminder well before the date, long enough for a customer's change process.
- Send a second reminder closer to the date, listing customers still on the version if you can identify them.
- On the day, update the download page and the advisory feed to show the version as unsupported.
- After the date, stop shipping fixes, keep the old artifacts available, and make clear they are unsupported.
Channels
Use email to the security contact on the account, the advisory feed, the release notes, the download page and the in-product banner if you have one. Do not rely on a single channel.
What happens after end of support
A new vulnerability in an unsupported version will not be fixed by you. Say whether you will still publish an advisory that lists it as affected and unfixed. That is useful to customers who are scanning. See CVE for an end of life product and support periods and end of life dates.
If you want a second look at what you ship, Safeguard can generate and scan an SBOM and run dependency scanning with reachability analysis, and you can try the free scan.
Quick check
Do the recitals set the notice period?
No. They say users should be informed but give no notice period. Set your own and publish it.
Should I still publish advisories for unsupported versions?
Decide and state it. Listing them as affected and unfixed helps customers who scan their estate.
Sources
Last reviewed: 19 October 2026.
