Skip to content
Declara
⌘K
compliance-owner

Record a product's support period

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 13(8) and 13(19), Annex VII as of . It is not legal advice. Review process.

The support period is at least five years, unless the product is expected to be in use for less. Setting it is your determination, taking into account the factors Article 13(8) lists. Declara keeps the end date, the factors you answered, your reasoning and who recorded it, so the reasoning can be produced later. It does not decide the period for you.

Before you start

  • A product, with the date it was placed on the market if you know it. The five-year comparison runs from that date.
  • The owner or an admin role to record a determination.

Steps

  1. Open the product, then Support period.
  2. Under Record the determination, set Supported until.
  3. Answer the factors you took into account. Answer at least one if the period is shorter than five years.
  4. If the period is shorter than five years, give your Reasoning. The form refuses a short period without it.
  5. Press Record the determination.

A version can end earlier or later than the product. In Versions, set Override end date for that version. Its own date wins; with none set it follows the product. A date later than the product's is flagged. The daily sweep retires a version once it is past its own end date.

When a support end is near, draft the End-of-support notice on the same page, edit it, and press Mark as sent once you have told your users, noting how you did it. The draft includes the address of your published disclosure page.

What you should see

History lists every determination, newest first, with a badge on those under five years. A new determination replaces the current end date; earlier ones stay as they were. The technical file section 4 shows the newest determination and its factors.

Primary source

Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10:

  • Article 13(8): the support period is at least five years, or the expected use time where that is shorter, determined from the factors the paragraph lists.
  • Article 13(19): the end date, at least month and year, is stated at the time of purchase, and users are notified at the end of the support period where that is technically feasible.
  • Annex VII, point 4: the information taken into account to determine the support period goes in the technical documentation.

The Commission's guidance C(2026) 5252 discusses reassessing the support period after a substantial modification. Its paragraph numbers on this page's subject come from a secondary reading and have not yet been checked against the Commission's text; see the regulatory changelog.

Related