Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.
Yes.
The CRA requires the technical documentation to be drawn up before placement on the market and to be continuously updated where appropriate, at least during the support period.
Article 13(12), Article 31(1)-(2)
They must be kept, but this is a separate retention rule.
The CRA says technical documentation and the EU declaration of conformity must be kept for at least 10 years after placement on the market or for the support period, whichever is longer. It applies the same 10-years-or-support-period rule to user instructions and their online availability.
This does not mean the support period is always 10 years.
Article 13(13), Article 13(18)
Yes.
This is a separate rule from the length of the support period itself. Each security update made available during the support period must remain available for at least 10 years after issuance or for the remainder of the support period, whichever is longer.
Article 13(9)
Yes.
Article 13(9) is separate from Article 13(8). A product might have a five-year support period, but updates issued during that period may still need to remain available for longer.
Article 13(8)-13(9)
As a rule, they are subject to the CRA only if they undergo a substantial modification on or after 11 December 2027.
Article 14 reporting obligations are the main express exception and apply more broadly.
Article 69(2)-(3)
section 1.4
points 111-113
No.
The Commission FAQ says the CRA applies to individual units placed on the market after the application date. Old product types or models are not grandfathered for newly placed units.
section 7.2
section 2.3
Generally no.
If those units were already placed on the market before 11 December 2027, they are not subject to the CRA cybersecurity requirements merely because they remain in distribution afterward, unless they are substantially modified. Reporting obligations are the main exception.
Article 69(2)-(3)
sections 1.4 and 7.2
Yes.
Article 69(3) makes Article 14 apply to in-scope products placed on the market before that date as well. The Commission FAQ says manufacturers must notify actively exploited vulnerabilities and severe incidents for those legacy products even though other CRA obligations may not apply to them.
Article 69(3)
section 5.3
Yes.
The CRA and the Commission FAQ allow support periods below five years where the product is genuinely expected to be in use for less than five years. Recital 60 gives software that becomes unavailable and no longer in use once the subscription expires as an example of that kind of case.
Article 13(8), Article 13(19), recital 60
section 4.5.2
point 115
Use this rule set:
- For physical products, including hardware plus software that is part of that product, determine the support period at the level of each individual unit when that unit is first placed on the EU market.
- Do not use manufacturing date as the support-period start date.
- Do not use later distributor sale, activation, installation, or first use as the support-period start date.
- Treat stock already in the distribution chain as already placed if the first EU supply event has already occurred.
- For direct online sales, determine the placement date from the actual distribution model, not from marketing language alone.
- For standalone software delivered digitally, the current Commission draft guidance points to the first EU offering of the unchanged version as the placement date.
- If a software or product change is a substantial modification, treat the modified product as a new product with a new placement event and a new support-period determination.
- Track component support periods, but do not treat them as automatic caps on the finished product's support period.
- Track Article 13(9) separately: each security update issued during the support period must remain available for at least 10 years after issuance or for the remainder of the support period, whichever is longer.
- Record in the technical documentation exactly what factors were used to justify the support period.
Article 13(8)-13(10), Article 13(19)
sections 4.2.3, 4.5.1, 4.5.3, 7.2
points 13-19 and 114-120
sections 2.3-2.4
Yes.
The Blue Guide says the transfer can be for payment or free of charge and gives sale, loan, hire, leasing, and gift as examples. What matters is the first making available on the Union market after manufacture is complete.
sections 2.2-2.3
No.
The Blue Guide says repeated renting of the same product does not create a new placing-on-the-market event. The relevant compliance moment remains the first placing-on-the-market event for that unit.
section 2.3
No.
The Blue Guide expressly says placing on the market does not take place where a product is transferred from the manufacturer in a third country to an authorised representative in the Union engaged to help ensure compliance.
section 2.3
No, not if they have not yet been supplied for distribution, consumption, or use.
The Blue Guide says products in those stocks are not yet placed on the market where they are not yet made available.
section 2.3
No.
The Blue Guide says products displayed or operated under controlled conditions at trade fairs, exhibitions, or demonstrations are not placed on the market. The same is true for transfers for testing or validating pre-production units that are still in the stage of manufacture.
section 2.3
No.
Under the CRA, the support period is a cybersecurity support obligation: it is the period during which vulnerabilities must be handled effectively. It is not simply another label for abstract product lifetime, physical durability, or a general commercial warranty period.
But the manufacturer must set the support period so that it reflects how long the product is expected to be in use. Expected use and product lifetime therefore matter because they are inputs into the support-period decision.
Article 13(8), Article 3(20)
sections 4.1.6 and 4.5.1
It affects both.
Article 13(3) requires the cybersecurity risk assessment to take into account the length of time the product is expected to be in use. The Commission FAQ then links that same expected-use analysis to the support period under Article 13(8).
Article 13(3), Article 13(8)
section 4.1.6
Yes.
The Commission FAQ says the manufacturer should consider the product's lifetime during design and development and prepare the product so that vulnerabilities, including component vulnerabilities, can be handled effectively throughout the support period.
section 4.1.6
Article 13(8), Annex I Part II
Yes, where appropriate.
The CRA requires the risk assessment to be documented and updated where appropriate during the support period. The Commission FAQ adds that where the risk assessment relies on information and instructions to users to address certain risks, those materials should be updated accordingly.
Article 13(7), Article 31(2)
section 4.1.6
Yes.
Article 13(8) expressly requires the manufacturer to take into account relevant Union law determining the lifetime of products with digital elements. So the support-period analysis is not based only on internal policy or market preference.
Article 13(8)
section 4.5.1