Docs

Appearance

Vulnerability handling and the support period ​

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, gives the vulnerability handling requirements for manufacturers of products with digital elements in Annex I, Part II. Article 13 adds the support period, the availability of security updates, and the information and instructions to the user.

The obligations apply to the manufacturer and persons considered to be a manufacturer in Articles 21 and 22, subject to Article 22(2)'s product scope where Article 22 applies.

Manufacturers' vulnerability handling obligations apply from 11 December 2027, subject to Article 69's transitional provisions (Article 71(2)).

The support period — Article 13(8) and (19) ​

In the CRA, the support period is "the period during which a manufacturer is required to ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I" (Article 3(20)). Article 13(8) tells the manufacturer to make sure "that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I". This obligation applies at the placing on the market and for the support period.

The manufacturer must set the support period "so that it reflects the length of time during which the product is expected to be in use". Article 13(8) tells the manufacturer to use these items "in particular":

  • "reasonable user expectations"
  • "the nature of the product, including its intended purpose"
  • "relevant Union law determining the lifetime of products with digital elements"

Article 13(8) also lets the manufacturer use these items:

  • the support periods of products with digital elements "offering a similar functionality placed on the market by other manufacturers"
  • "the availability of the operating environment"
  • "the support periods of integrated components that provide core functions and are sourced from third parties"
  • "relevant guidance provided by the dedicated administrative cooperation group (ADCO) established pursuant to Article 52(15) and the Commission"

Article 13(8) adds: "The matters to be taken into account in order to determine the support period shall be considered in a manner that ensures proportionality." Article 13(8) then sets the minimum:

Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.

The manufacturer must put "the information that was taken into account to determine the support period" in the technical documentation (Article 13(8) and Annex VII, point 4). Article 52(16) tells market surveillance authorities to "monitor how manufacturers have applied the criteria referred to in Article 13(8) when determining the support period of their products with digital elements".

Article 13(19) gives the manufacturer two obligations for the end of the support period:

  • The manufacturer must make sure that the end date, "including at least the month and the year, is clearly and understandably specified at the time of purchase in an easily accessible manner". Where applicable, the end date is also on the product, on its "packaging", or available "by digital means".
  • "Where technically feasible in light of the nature of the product with digital elements", the manufacturer must show a notification to users that tells them that the product is at the end of its support period.

Article 13(11) lets manufacturers "maintain public software archives enhancing user access to historical versions". A manufacturer that does this must clearly tell users "in an easily accessible manner about risks associated with using unsupported software".

The Commission services FAQ 4.5.3 gives this guidance, which is not binding (see Cyber Resilience Act (CRA)). Manufacturers "need to set the support period for all products with digital elements that have been placed on the market after 11 December 2027". These products "can continue to be made available on the market after their support period expires". The FAQ also tells manufacturers that "for units of that product that are newly placed on the market, manufacturers are required to set the support period".

Software bill of materials — Annex I, Part II, point (1) ​

CRA Annex I, Part II, point (1) tells the manufacturer to "identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products". The software bill of materials (SBOM) is part of the technical documentation. Annex VII, point 2(b), includes it in the information on the vulnerability handling processes.

Article 13(24) lets the Commission do this: "The Commission may, by means of implementing acts taking into account European or international standards and best practices, specify the format and elements of the software bill of materials referred to in Part II, point (1), of Annex I."

The CRA gives market surveillance authorities these procedures to get the SBOM, or the technical documentation that contains it:

  • Article 13(13) — The manufacturer keeps the technical documentation available to market surveillance authorities for the period in Article 13(13). See Technical documentation.
  • Annex VII, point 8 — The technical documentation contains, "where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I".
  • Article 13(22) — On a reasoned request from a market surveillance authority, the manufacturer must give that authority all “information and documentation” necessary to show conformity with Annex I.
  • Article 13(25) — ADCO "may decide to conduct a Union wide dependency assessment for specific categories of products with digital elements". Then "market surveillance authorities may request manufacturers of such categories of products with digital elements to provide the relevant software bills of materials".
  • Article 53 — Market surveillance authorities have access to the necessary data on a reasoned request where necessary to check conformity with Annex I.

If the manufacturer "decides to make available the software bill of materials to the user", the information and instructions to the user must give "information on where the software bill of materials can be accessed" (Annex II, point 9). When a manufacturer uses Article 32(5), the technical documentation "made available to the public" at the placing on the market contains the SBOM (Annex VII, point 2(b)).

Tests — Annex I, Part II, point (3) ​

CRA Annex I, Part II, point (3) tells the manufacturer to "apply effective and regular tests and reviews of the security of the product with digital elements". With Article 13(8), this obligation applies at the placing on the market and for the support period. Point (3) gives no test method and no interval.

The technical documentation contains "reports of the tests carried out to verify the conformity of the product with digital elements and of the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of Annex I" (Annex VII, point 6).

The Commission guidance on the CRA gives this guidance on point (3), which is not binding (see Cyber Resilience Act (CRA)):

  • Paragraph 238: "Applying regular tests does not require the mechanical repetition, at fixed intervals, of an unchanged test campaign. It means regularly reviewing whether new input, such as newly identified threats or newly discovered vulnerabilities, requires the existing tests to be updated, and executing tests accordingly."
  • Paragraph 239: "The frequency, depth and content of the review should be proportionate to the cybersecurity risk profile of the product with digital elements, its evolution over time, and the state of the threat landscape."
  • Paragraph 240: "Where the review identifies no such input, additional tests need not be devised." The other vulnerability handling obligations continue to apply.

Vulnerabilities and security updates — Annex I, Part II, points (2), (7), and (8) ​

CRA Annex I, Part II gives the manufacturer these obligations on vulnerabilities and security updates:

  • Point (2) — "in relation to the risks posed to products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates"
  • Point (7) — "provide for mechanisms to securely distribute updates for products with digital elements to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner"
  • Point (8) — "ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken"

The Commission services FAQ 4.3.1 gives this guidance on point (2), which is not binding. The CRA "does not require manufacturers to provide a patch for all vulnerabilities that are discovered during a product's support period". The FAQ continues: "On the basis of the risk that the vulnerability poses, manufacturers need to ensure that remedies are put in place without delay." The FAQ gives these examples: "immediate patches, advisories on workarounds to be later complemented by a software updates, updates to user manuals, configuration guidance to disable the affected features".

Article 13(9) tells the manufacturer to keep security updates available. Each security update of point (8) "which has been made available to users during the support period, remains available after it has been issued for a minimum of 10 years or for the remainder of the support period, whichever is longer".

Article 13(10) gives a rule for software products: "Where a manufacturer has placed subsequent substantially modified versions of a software product on the market, that manufacturer may ensure compliance with the essential cybersecurity requirement set out in Part II, point (2), of Annex I only for the version that it has last placed on the market". This rule applies only on the two conditions that follow:

  • The users of the previous versions "have access to the version last placed on the market free of charge".
  • These users "do not incur additional costs to adjust the hardware and software environment in which they use the original version of that product".

The Commission guidance, paragraph 131, gives this guidance on Article 13(10), which is not binding. In this guidance, "the declared support period for each substantially modified version must comply with Article 13(8) at the time it is placed on the market". The manufacturer can use Article 13(10) "to discontinue addressing and remediating vulnerabilities for earlier versions once users are able to upgrade to a later version free of charge and without incurring additional costs as referred to above, even if this results in a shorter effective support period for those earlier versions". The manufacturer stays subject to the other requirements of Annex I, Part II, and to Article 14.

"On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable", products must "ensure that vulnerabilities can be addressed through security updates" (Annex I, Part I, point (2)(c)).

Fixed vulnerabilities — Annex I, Part II, point (4) ​

CRA Annex I, Part II, point (4) tells the manufacturer to "share and publicly disclose information about fixed vulnerabilities" "once a security update has been made available". The information includes:

  • "a description of the vulnerabilities"
  • "information allowing users to identify the product with digital elements affected"
  • "the impacts of the vulnerabilities, their severity"
  • "clear and accessible information helping users to remediate the vulnerabilities"

Point (4) then gives this rule: "in duly justified cases, where manufacturers consider the security risks of publication to outweigh the security benefits, they may delay making public information regarding a fixed vulnerability until after users have been given the possibility to apply the relevant patch". This rule is only for "making public" the information.

The manufacturer's obligation in Annex I, Part II, point (4) applies from 11 December 2027. It is different from the obligations in Articles 14(8) and 17(2).

Coordinated vulnerability disclosure — Annex I, Part II, points (5) and (6) ​

CRA Annex I, Part II gives the manufacturer these obligations:

  • Point (5) — "put in place and enforce a policy on coordinated vulnerability disclosure"
  • Point (6) — "take measures to facilitate the sharing of information about potential vulnerabilities in their product with digital elements as well as in third-party components contained in that product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements"

Article 13(8) also tells the manufacturer to have "appropriate policies and procedures, including coordinated vulnerability disclosure policies". With these policies and procedures, the manufacturer must "process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources". The technical documentation contains "the coordinated vulnerability disclosure policy" and "evidence of the provision of a contact address for the reporting of the vulnerabilities" (Annex VII, point 2(b)).

Article 13(17) tells the manufacturer to "designate a single point of contact to enable users to communicate directly and rapidly with them, including in order to facilitate reporting on vulnerabilities of the product with digital elements". The manufacturer must make sure that users can easily identify the single point of contact. The manufacturer must also put the single point of contact in the information and instructions to the user. The single point of contact "shall allow users to choose their preferred means of communication and shall not limit such means to automated tools".

Product identification and information to users — Article 13(15) to (18) and Annex II ​

CRA Article 13 gives the manufacturer these obligations on identification and information:

  • Identification, Article 13(15) — The product must "bear a type, batch or serial number or other element allowing their identification". If this is not possible, that information must be "on their packaging or in a document accompanying the product with digital elements".
  • Manufacturer information, Article 13(16) — The manufacturer must give "the name, registered trade name or registered trademark of the manufacturer, and the postal address, email address or other digital contact details, as well as, where applicable, the website where the manufacturer can be contacted". This information is on the product, on its "packaging", or "in a document accompanying the product with digital elements". It is also in the information and instructions to the user. The "contact details" "shall be in a language which can be easily understood by users and market surveillance authorities".
  • Information and instructions, Article 13(18) — The information and instructions to the user of Annex II go with the product "in paper or electronic form". They must be "in a language which can be easily understood by users and market surveillance authorities". They "shall be clear, understandable, intelligible and legible", and they "shall allow for the secure installation, operation and use of products with digital elements".
  • Availability, Article 13(18) — The manufacturer must keep the information and instructions to the user "at the disposal of users and market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer". Article 13(18) also tells manufacturers: "Where such information and instructions are provided online, manufacturers shall ensure that they are accessible, user-friendly and available online for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer".

Annex II gives the minimum information and instructions to the user:

  1. "the name, registered trade name or registered trademark of the manufacturer, and the postal address, the email address or other digital contact as well as, where available, the website at which the manufacturer can be contacted"
  2. "the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received, and where the manufacturer's policy on coordinated vulnerability disclosure can be found"
  3. "name and type and any additional information enabling the unique identification of the product with digital elements"
  4. "the intended purpose of the product with digital elements, including the security environment provided by the manufacturer, as well as the product's essential functionalities and information about the security properties"
  5. "any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks"
  6. "where applicable, the internet address at which the EU declaration of conformity can be accessed"
  7. "the type of technical security support offered by the manufacturer and the end-date of the support period during which users can expect vulnerabilities to be handled and to receive security updates"
  8. "detailed instructions or an internet address referring to such detailed instructions and information", for the six items of points 8(a) to 8(f):
    • "the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use"
    • "how changes to the product with digital elements can affect the security of data"
    • "how security-relevant updates can be installed"
    • "the secure decommissioning of the product with digital elements, including information on how user data can be securely removed"
    • "how the default setting enabling the automatic installation of security updates, as required by Part I, point (2)(c), of Annex I, can be turned off"
    • "where the product with digital elements is intended for integration into other products with digital elements, the information necessary for the integrator to comply with the essential cybersecurity requirements set out in Annex I and the documentation requirements set out in Annex VII"
  9. "If the manufacturer decides to make available the software bill of materials to the user, information on where the software bill of materials can be accessed."

The manufacturer also gives a copy of the EU declaration of conformity, or a simplified EU declaration of conformity, with the product (Article 13(20)). See EU declaration of conformity and CE marking. An importer must also give its name and "contact details" on the product, on its "packaging", or "in a document accompanying the product with digital elements" (Article 19(4)). See Importers.

Vulnerability handling in Modulos ​

For manufacturers' CRA vulnerability handling, see AI System Requirements MRF-467 to MRF-472 and Organization Requirements ORF-470 to ORF-475.

Where to go next ​

Sources ​

  • Cyber Resilience Act — Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 (OJ L, 2024/2847, 20.11.2024). Articles 3(20), 13(8) to (11), 13(13), 13(15) to (20), 13(22), 13(24), and 13(25). Articles 17(2), 19(4), 21, 22, 32(5), 52(16), 53, 69(2), 69(3), and 71(2). Annex I, Part I, point (2)(c), and Part II. Annex II. Annex VII, points 2(b), 4, 6, and 8. EUR-Lex.
  • Commission guidance — "Commission guidance on the application of Regulation (EU) 2024/2847 (Cyber Resilience Act)", Annex to Communication "C(2026) 5252 final" of 27 July 2026. Paragraphs 131 and 238 to 240. European Commission.
  • Commission services FAQ — Cyber Resilience Act FAQ, version 1.4 of 4 September 2026. FAQ 4.3.1 and FAQ 4.5.3. European Commission.

Disclaimer

This page gives general information. It is not legal advice.