EU CRA Vulnerability Handling and Support Period

Once a product has shipped, or has even been discontinued, is the manufacturer still responsible for security updates?

The EU Cyber Resilience Act (CRA) will apply in full from 11 December 2027. The CRA explicitly requires manufacturers to keep managing vulnerabilities and providing the necessary security updates during a product’s support period. Placing a product on the market does not mean its cybersecurity responsibilities end there.

For products placed on the market from 11 December 2027, the manufacturer must still handle vulnerabilities and provide security updates during the support period, even if the model has been discontinued. The reporting obligations for actively exploited vulnerabilities (Article 14) are not limited by the support period and, since 11 September 2026, also apply to products placed on the market before 11 December 2027.

📌 CRA vulnerability handling and support period: key points (summary)

🔹 Vulnerability handling and disclosure: Establish a coordinated vulnerability disclosure (CVD) policy and an external reporting channel, so that vulnerability reports can be risk-assessed, remediated and tracked once received.
🔹 Security updates: As a general rule, security updates should be provided free of charge (exception: a separate agreement between the manufacturer and a business user for a tailor-made product) and, where technically feasible, released separately from functionality updates, so that users can fix vulnerabilities in time.
🔹 Product support period: The support period shall reflect the time the product is expected to be in use, taking into account factors such as reasonable user expectations and the nature and intended purpose of the product. It is at least 5 years as a general rule; a shorter period may be set only where the product is expected to be in use for less than 5 years. The basis for this determination must be recorded in the technical documentation. At the time of purchase, the manufacturer should indicate the end date of the support period (at least the month and year) in a clear, understandable and easily accessible way.
🔹 Availability of security updates: Each security update issued during the support period must remain available for at least 10 years after it is issued, or until the end of the support period if that is longer, whichever is longer.
🔹 Vulnerabilities in third-party components: When a vulnerability is found in a third-party or open-source component integrated in the product, the manufacturer must report it to the person or entity manufacturing or maintaining the component, and handle and remediate it in its own product in line with the CRA vulnerability handling requirements. If the manufacturer has developed a fix, it should share the relevant code or documentation with the component's maintainer.

🔍 Is your company also facing these issues? (Illustrative common industry scenarios, not legal requirements)

🖥️ Industrial PCs (IPC): Products may stay in use for 5 years or more, and customers may still be running them in the field after they have been discontinued. When a firmware vulnerability is found, which models and versions still need support?
🌐 Networking equipment: Firmware needs long-term maintenance, but different customers may be running different versions. How do you confirm the patch and update status of each version?
🔋 Energy storage systems (ESS): Systems such as the EMS and BMS need long-term operation and maintenance. When a security vulnerability occurs, how do you track the patching, verification and deployment records?

💡 How should companies prepare?

We recommend setting up management mechanisms in three areas:
✅ Set up a PSIRT contact point: Receive vulnerability reports through a single channel and define the assessment, remediation, verification and release process.
✅ Clearly define support periods: Manage support end dates by product model and expected period of use.
✅ Build version and vulnerability traceability: Link vulnerabilities, affected components, firmware versions, security updates and test records.
⚠️ The CRA is not only about releasing patches. It is about knowing, on an ongoing basis, the vulnerability handling and security update status of every product version.

👉 Want to learn how to set up a vulnerability management process, product support periods and security update traceability?

Get in touch with Anselm (安盛資訊).

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: EU CRA Vulnerability Reporting: 24-Hour Early Warning and 72-Hour Notification | Next article: EU CRA System Integration: Connecting PLM, SBOM Tools and Polarion

This article is for general information only and does not constitute legal advice. Official sources: Regulation (EU) 2024/2847 (Articles 13, 14 and 69 and Annex I Part II); European Commission guidance on CRA implementation.