Support Period

What the support period means

‘support period’ means the period during which a manufacturer is required to ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I;

Regulation (EU) 2024/2847, Article 3(20)

The definition points to vulnerability handling. During the support period, the manufacturer must keep the process for receiving, assessing, fixing, disclosing, and communicating vulnerabilities working for the product and its components.

How long support lasts

Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.

Regulation (EU) 2024/2847, Article 13(8), third subparagraph

Five years is a minimum, not a maximum. Article 13(8) says the period must reflect how long the product is expected to be in use. A product that is normally used for longer than five years may need a longer support period.

The Regulation names the main factors. They are easier to read as a short set of decision points:

• the reasonable expectations of users for this kind of product;
• the nature and intended purpose of the product;
• Union law that sets or influences the product lifetime;
• the support period for similar products;
• the expected availability of the operating environment;
• the support periods of third-party components that provide core functions.

The manufacturer must include the information used to set the support period in the technical documentation.

When support can be shorter

A support period below five years is allowed only when the product is expected to be in use for less than five years. In that case, the support period must match the expected use time.

The Commission FAQ gives examples such as a time-limited emergency app or some subscription software that stops being available when the subscription ends. A short commercial support plan is not enough by itself.

Vulnerability handling during support

Annex I, Part II explains the work that continues during the support period. The list is process-based. It applies after the product is placed on the market and while the support period is still running.

• identify and document vulnerabilities and components, including at least top-level dependencies in the SBOM;
• address and remediate vulnerabilities in relation to the risks they create for the product;
• run effective and regular security tests and reviews;
• keep a coordinated vulnerability disclosure policy and a reporting contact address;
• securely distribute updates so vulnerabilities can be fixed or reduced in time;
• make available security updates without delay, normally free of charge, with advisory information for users.

Security updates stay available

Manufacturers shall ensure that each security update, as referred to in Part II, point (8), of Annex I, which has been made available to users during the support period, remains available after it has been issued for a minimum of 10 years or for the remainder of the support period, whichever is longer.

Regulation (EU) 2024/2847, Article 13(9)

This rule applies to security updates that were made available during the support period. It keeps issued fixes reachable. It does not turn every support period into a 10-year support period.