Taking into account the iterative nature of software development, manufacturers that have placed subsequent versions of a software product on the market as a result of a subsequent substantial modification of that product should be able to provide security updates for the support period only for the version of the software product that they have last placed on the market. They should be able to do so only if the users of the relevant previous product versions have access to the product version last placed on the market free of charge and do not incur additional costs to adjust the hardware or software environment in which they operate the product. This could, for instance, be the case where a desktop operating system upgrade does not require new hardware, such as a faster central processing unit or more memory. Nonetheless, the manufacturer should continue to comply, for the support period, with other vulnerability-handling requirements, such as having a policy on coordinated vulnerability disclosure or measures in place to facilitate the sharing of information about potential vulnerabilities for all subsequent substantially modified versions of the software product placed on the market. Manufacturers should be able to provide minor security or functionality updates that do not constitute a substantial modification only for the latest version or sub-version of a software product that has not been substantially modified. At the same time, where a hardware product, such as a smartphone, is not compatible with the latest version of the operating system it was originally delivered with, the manufacturer should continue to provide security updates at least for the latest compatible version of the operating system for the support period.
Recital 40
Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026
European Commission Interpretation
Guidance of 27 July 2026The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.
Section 5 – 5.1Support period — determination, Art. 13(10) and substantial modifications
Five years is a floor, not a default: the support period reflects the expected use time, and products expected to be used longer need longer support. Article 13(10) allows manufacturers to address and remediate vulnerabilities only for the version last placed on the market, provided users can upgrade free of charge and without additional costs. A substantial modification does not automatically reset the support period.
Key takeaways
- 'Additional costs' under Art. 13(10) means mandatory hardware purchases or infrastructure replacement — not normal update effort such as personnel time, testing or configuration adjustments.
- Each substantially modified version needs its own declared support period under Art. 13(8) when placed on the market.
- Where unchanged factors (e.g. hardware durability) continue to determine the expected use time, the original support period stands — even where the remainder is less than five years (Examples 54/55: robot vacuum, industrial machinery with re-architected cloud back-end).
- Where the modification changes the use-time factors themselves (e.g. a new computing platform extends a PLC's life), the support period must be recalculated (Example 56).
- Indicate the support end date at the time of purchase (at least month/year) and display an end-of-support notification where technically feasible (Art. 13(19)).
- Manufacturers may voluntarily keep patching earlier versions — including on a paid basis; the CRA does not require free updates for them.
In practice
Derive the support period from the expected use time with documentation — a blanket '5 years' is attackable where your product is evidently used longer. State the end date in the purchase process (at least month/year). For software: check whether the Art. 13(10) rule lets you patch only the latest version — that requires free upgrades without forced hardware or infrastructure changes.
EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.
Related Articles
(1)This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex