CRAKit

Guides · Updated 27 July 2026

How long is the CRA support period, exactly?

Five years is a floor, not a default. And the ten-year number people quote is a different obligation entirely.

The short answer

Under Article 13(8) the support period must be at least five years. Where the product is expected to be in use for less than five years, the support period corresponds to the expected use time. Separately, Article 13(9) requires that every security update made available during the support period remains available for at least 10 years after it was issued, or for the remainder of the support period, whichever is longer. These are two different obligations and they are commonly confused.

The five-year floor

Article 13(8) states that the support period shall be at least five years, and that where the product is expected to be in use for less than five years, the support period shall correspond to the expected use time. So five years is a floor for ordinary products and a ceiling only for genuinely short-lived ones.

If your industrial sensor has a fifteen-year service life, five years is not your answer. The support period has to reflect how long the product is actually in use, and a market surveillance authority reading your technical file will compare the two numbers.

The ten-year obligation is about update availability

Article 13(9) is separate: each security update made available to users during the support period must remain available for a minimum of 10 years after it was issued, or for the rest of the support period, whichever is longer. This is about not taking the download offline. It does not extend the period during which you must produce new updates.

You have to justify the number in writing

Annex VII point 4 requires the technical documentation to contain the relevant information taken into account to determine the support period. A number with no reasoning behind it is an incomplete technical file. Expected product lifetime, comparable products, component availability and customer contract terms are all valid inputs. Writing down which ones you used takes ten minutes today and is very hard to reconstruct in 2031.

It goes on the box, effectively

Annex II point 7 requires the information accompanying the product to state the type of technical security support offered and the end date of the support period. This is not an internal planning number. It is a published commitment that users read.

Questions people actually ask

What is the minimum CRA support period?

Five years, under Article 13(8). If the product is expected to be in use for less than five years, the support period matches that shorter expected use time.

Is the CRA support period ten years?

No. Ten years is the separate Article 13(9) obligation to keep each issued security update available for at least 10 years after issue, or for the remainder of the support period if that is longer.

Do I have to publish the support period end date?

Yes. Annex II point 7 requires the information accompanying the product to state the type of security support offered and the end date of the support period.

Find out where your product stands

A dozen or so questions, no signup, no email address. You get a dated PDF determination with your classification, your conformity route and what it costs.

Run the free wizard

More guides

What actually happens on 11 September 2026

The Article 14 reporting obligation starts. Here is precisely what it requires, what it does not, and why most manufacturers over-estimate it.

How to produce an SBOM when you have no source code

Your ODM will not give you source. Annex I Part II still requires an SBOM. Here is how binary analysis actually works and what it can and cannot tell you.

Default, Important Class I, Class II or Critical: which are you?

The classification decides whether you can sign your own conformity paperwork or must pay a notified body. Here is the actual test, from Annex III, Annex IV, Article 32 and the implementing regulation that says core functionality decides it.