To plan for free security updates, treat update delivery as a fixed part of the product, not a paid add-on: build a working update channel into version one, reserve engineering time each quarter for fixes, decide a support period per product, and track how many devices are still on old firmware.
What the text says
Annex I, Part II of the Cyber Resilience Act sets out vulnerability handling. Point 2 says manufacturers must address and remediate vulnerabilities without delay, including by providing security updates. Point 8 says security updates must be disseminated without delay and, in general, free of charge, unless a manufacturer and a business user agree otherwise for a tailor-made product. Whether this applies to your product is for counsel.
For a startup, the message to the planning team is simple: shipping security fixes is part of the cost of the product.
What it means for planning
| Area | Planning question |
|---|---|
| Engineering | How many days a quarter go to maintenance, not features? |
| Update channel | Can every shipped unit receive a signed update? |
| Support period | How many years will each product line be supported? |
| Hosting | Who pays for update distribution traffic for a growing fleet? |
| Testing | Do you have hardware on a bench to test updates on every variant? |
| Communication | How do customers learn an update exists? |
A model that fits a small team
- Reserve capacity. Set aside a fixed share of firmware time for security work, the same way you reserve for bug fixes. Without a reserve, features always win.
- Keep fewer variants. Every hardware variant is a test matrix row. Fewer variants mean cheaper updates.
- Make updates boring. Automate build, signing, staged rollout and revert so a fix is a routine release.
- Measure the tail. Track the share of devices on the latest version. A long tail of old devices is a risk you can see in a chart.
- Set the end date early. Decide and publish how long you will provide updates, and give notice before it ends.
The update channel is a product feature
A device you cannot update is a device you cannot fix. The recitals describe products as having functions that let security updates be notified, distributed, downloaded and installed automatically, particularly for consumer products (Recital 56). If your device needs a cable and a laptop to update, plan how a customer will do it, or change the design.
Count the real cost drivers
Without quoting prices, the main drivers are people, test hardware, distribution and customer communication. Write each down for the next three years. If the total does not fit your business model, that is better learned at design time than at the first advisory.
Quick check
Can we sell a paid support tier for security fixes?
The regulation text says free of charge in general, with a stated exception for tailor-made products agreed with business users. Ask your counsel before designing a paid tier.
What is the smallest viable update plan?
A signed update path, a staged rollout, a revert on failure, a named owner and a published support end date.
Sources
Last reviewed: 19 October 2026.
