Search every question across sub-FAQs

The Commission FAQ describes a narrow scenario: free and open-source software placed on the market may be monetised only through paid support services, and the software may remain in use after the user stops paying for support. In that circumstance, the FAQ says the manufacturer is required to ensure a Support Period equal to the duration of the active subscription.

The scenario does not create a general short-period rule for all open-source or subscription software. The evidence file should show the commercial model, what remains usable after support ends, what security support the user receives during the active subscription, and why the chosen Support Period follows the CRA expected-use rule.

For physical products, use the Blue Guide concept of placing on the market: each individual product can be placed on the Union market only once. The Commission FAQ applies this logic to CRA support periods for hardware units.

If a manufacturer places more units of the same hardware model on the market later, the later units need their own Support Period determination. Units already placed on the market can continue to be made available after their Support Period expires, but newly placed units still need a Support Period.

The reliable CRA answer is to anchor the analysis in placing on the market, not manufacturing alone, later distributor resale, activation, or first use.

The Blue Guide says a product is placed on the market when it is made available for the first time on the Union market. Manufacturing must be complete, and the transfer can occur without physical handover. Later transactions down the distribution chain are making available, not a second placing-on-the-market event for the same unit.

At the time of purchase, the manufacturer must clearly and understandably specify the end date of the Support Period, including at least the month and year, in an easily accessible manner. Where applicable, this may be on the product, packaging, or by digital means.

The user information must also state the type of technical security support offered and the end date of the period during which users can expect vulnerabilities to be handled and to receive security updates. Where technically feasible, the manufacturer must notify users when the product reaches the end of its Support Period.

During the Support Period, manufacturers must address and remediate vulnerabilities without delay in relation to the risks posed, including by providing security updates. Where technically feasible, new security updates must be provided separately from functionality updates.

Where security updates are available to address identified security issues, they must be disseminated without delay and, unless a tailor-made product arrangement with a business user says otherwise, free of charge and with advisory messages telling users relevant information and potential action to take.

Yes. Article 13(9) is separate from the length of the Support Period itself.

Each security update made available to users during the Support Period must remain available after issuance for at least 10 years or for the remainder of the Support Period, whichever is longer. This can make update availability last longer than a five-year Support Period.

The technical documentation must include the information used to determine the Support Period, not merely the final number.

Useful evidence includes the expected-use analysis, user-expectation rationale, intended-purpose and operating-environment assumptions, relevant Union-law lifetime constraints, comparable-product support references, third-party core-component support periods, component vulnerability-handling assumptions, the disclosed end date, and the security-update availability plan.

Keep the evidence connected to the cybersecurity risk assessment. Article 31 requires technical documentation to be drawn up before placement on the market and continuously updated where appropriate, at least during the Support Period.

No. Third-party core-component support periods are a factor the manufacturer may consider, but they do not automatically cap the finished product's Support Period.

The Commission FAQ says the finished-product manufacturer must comply with CRA vulnerability-handling obligations for the product in its entirety. If an integrated component is no longer supported and a vulnerability cannot be adequately handled by mitigations, the finished-product manufacturer may need to switch the component, develop a patch, disable compromised functions, or remediate by other means.

This retention rule is separate from the Support Period decision.

The manufacturer must keep technical documentation and the EU declaration of conformity available to market surveillance authorities for at least 10 years after placement on the market or for the Support Period, whichever is longer. User information and instructions must also remain available to users and market surveillance authorities on the same 10-years-or-support-period basis, including online where provided online.

Do not read those retention periods as saying the Support Period itself is always 10 years.

Yes. Market surveillance authorities must monitor how manufacturers applied the Article 13(8) criteria when determining support periods.

The CRA also requires ADCO to publish relevant statistics, including average support periods, and guidance with indicative support periods for product categories. Those statistics and indicative periods are not the same as binding legal minimums, but the Commission may later adopt delegated acts specifying minimum support periods for product categories where market-surveillance data suggests inadequate support periods.

For each product or relevant unit batch, record the placing-on-the-market basis, expected-use analysis, Article 13(8) criteria, component support dependencies, disclosed support end date, security-update distribution method, update availability plan, user notification method, and technical-documentation evidence.

Keep separate fields for the Support Period end date, update-retention end dates under Article 13(9), and documentation/user-instruction retention under Article 13(13) and Article 13(18). These clocks are related, but they are not the same obligation.

A product placed on the market before 11 December 2027 is not brought under the full CRA merely because the general application date arrives. Under Article 69(2), the full requirements apply to that product only if it is substantially modified from 11 December 2027.

Article 14 is different. Its reporting obligations apply from 11 September 2026 to all in-scope products, including products placed on the market before 11 December 2027. If a legacy product is later substantially modified and placed on the market as a new CRA product event, the manufacturer must determine and disclose a support period for that modified product under the applicable CRA rules.

A CRA tailor-made product is a product with digital elements fitted to a particular purpose for a particular business user, with explicit different contractual terms agreed between that user and the manufacturer.

The point is not simply that the customer is an enterprise or that the product has been configured for that customer. The product has to be genuinely fitted to that customer's particular purpose, and the contractual deviation has to be explicit.

No. Tailor-made status does not by itself put the product outside the CRA.

The CRA applies to products with digital elements made available on the market. If a bespoke product is supplied for distribution or use on the EU market in the course of a commercial activity, the CRA scope analysis still has to be done. The tailor-made wording only affects the two identified essential requirements, not the existence of market-placement obligations.

It can. A one-customer build can still be supplied for use on the EU market in the course of a commercial activity.

The CRA materials distinguish that from products manufactured only for the manufacturer's own use. The Commission FAQ, citing the Blue Guide, says placing on the market is not considered to take place where a product is manufactured for one's own use. That own-use concept should not be stretched into a customer-specific development exemption.