Support period and life cycle
This is the most underestimated financial impact of the Regulation. The CRA does not only ask that a secure product be placed on the market: it asks that it be kept secure for years, including after it stops being sold.
The rule
The manufacturer determines the support period so as to reflect the length of time the product is expected to be in use. That period is at least five years.
One exception only: if the expected product lifetime is shorter than five years, the support period corresponds to that lifetime. It is a narrow exception and must be reasoned; it applies because the product itself is not built to last, not because you would prefer a shorter commitment.
The criteria to document
The duration chosen must be justified in the technical documentation, against:
- reasonable user expectations;
- the nature of the product and its use;
- the support periods of comparable products on the market;
- the legislation applicable to the product;
- the availability of the operating environment — a product depending on an operating system whose support ends;
- the support periods of integrated components, including free ones.
That last criterion is the classic trap: you cannot guarantee five years on a product built on an upstream component maintained for two. Either you take over maintenance of that component, or you replace it, or you shorten — and justify — your support period. There is no fourth option.
The ten-year rule on fixes
Distinct from the support period, and often confused with it: after they are issued, security updates remain available for at least ten years from the placing of the product on the market, or for the remainder of the support period, whichever is longer.
| Support period | Availability of fixes | |
|---|---|---|
| What is owed | Producing fixes | Making available fixes already produced |
| Duration | ≥ 5 years, or the expected lifetime | ≥ 10 years after placing on the market, or the support period if longer |
| Consequence | Maintenance team, live build chain | Hosting, archiving, availability of the distribution channel |
The duty to inform
The end date of the support period must be communicated to the user in a clear and understandable manner at the time of purchase, expressed at least as a month and year (Annex II). It therefore appears in the product documentation, and should appear on the commercial datasheet.
End of support and cessation of operations
Approaching end of support: inform users, state the residual risk, offer a migration path, state the date after which no further fixes will be produced.
On cessation of operations: the manufacturer informs the competent market surveillance authorities and, by any means available, the users of the products concerned. The Regulation also encourages, in that situation, transferring the source code or releasing it as free software so the community can maintain it.
The financial translation — to carry to the committee
This is the message for leadership:
- keeping reproducible build chains and build environments alive for five to ten years, with the tools and dependencies of the time;
- backporting fixes onto old branches, which requires available skills and a suitable versioning strategy;
- retaining artefacts, SBOMs and technical documentation, with their storage and indexing cost;
- giving up the option of ending support for a product still in use without regulatory consequence — commercial end of life no longer ends the obligations.
The register to keep
| Column | Content |
|---|---|
| Product and version | Traceable identification |
| Date placed on the market | Start of the ten years |
| Declared support period | Duration and end date, to the month |
| Justification | Pointer to the section of the technical documentation |
| Fixes available until | Calculated date |
| Limiting components | Components whose upstream support ends earlier |
| Estimated annual cost | Maintenance, hosting, archiving |
| Owner | By name |
The register is kept by Legal and fed by engineering. It is reviewed at every committee, because it is what reveals commitments that have become untenable.