Tools · Support-period planner

Plan your support period

The CRA requires manufacturers to set a support period that reflects how long the product is expected to be in use, counted from when it is placed on the market. Five years is the default; it may be shorter where the expected use is shorter, and should be longer where it is longer. Enter your dates to see your support and retention deadlines, and to flag any component that goes End-of-Life too soon.

Placed on the EU market

The support period is counted from this date.

Expected in-use lifetime (years)

How long the product is reasonably expected to be in use.

Key dependencies & their End-of-Life

Support period ends

–

Enter a market-placement date

Legal minimum

5 yrs

Five years by default; longer where expected use is longer

Keep docs & DoC until

–

10 years from placement, or the support end if later (Art. 13(13))

Updates stay available until

–

Each security update must remain available for 10 years after it is issued, or to the end of support if later (Art. 13(9)); this is the date for an update issued on the last day of support

These come from your SBOM

Your key dependencies and their End-of-Life dates live in your software bill of materials. Rather than entering them by hand, the Vulnerability Analyzer reads your SBOM and identifies component End-of-Life automatically; feed those dates back in here to check them against your support period.

Dependency End-of-Life check

Add a dependency on the left to check it against your support period.

A component whose End-of-Life falls before your support period ends will leave you maintaining unsupported software; plan a replacement or an extended-support arrangement before then. Indicative only; not legal advice. Verify against Article 13(8), (9) and (13) and Article 31(3) of Regulation (EU) 2024/2847.

After a substantial modification

A substantial modification (a change that alters the product's cybersecurity risk beyond what your risk assessment covered) means reassessing the support period against the same criteria; it does not automatically reset or extend it. The Commission guidance explains how the support period and substantial modifications interact.