Cyber Resilience Act: support periods in IT procurement

IT Strategy · 4 min

The Cyber Resilience Act introduces rules for the security support of digital products. Learn how to assess timelines, updates and end-of-support risks before you buy.

Cyber Resilience Act: support periods in IT procurement

TL;DR

The Cyber Resilience Act requires manufacturers to define and communicate a security support period for the products in scope.
The general rule sets a minimum of five years, unless the product's expected use time is shorter; products with a longer lifespan may require longer support.
The support period should be considered in procurement, alongside price, security, compatibility and expected lifespan.
Recording end-of-support dates in the inventory makes it possible to anticipate renewals, identify risks and prepare budgets.
The new obligations do not automatically apply to all existing equipment; legacy products require a specific assessment.

A new piece of information enters the purchasing process

Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA), establishes cybersecurity requirements for products with digital elements placed on the European Union market, including network equipment, connected devices and software within its scope. General application is scheduled for 11 December 2027, although the obligations to report actively exploited vulnerabilities and certain severe incidents already apply from 11 September 2026. One of the most relevant changes for those who buy technology is the obligation for manufacturers to define and communicate the period during which they ensure vulnerability handling. For an IT manager, this information makes it possible to assess not only price and features, but also how long the product can continue to be used with adequate security support. The support period thus becomes an important element in the purchasing decision and in technology lifecycle planning.

The support period has minimum rules

Article 13(8) of the CRA establishes that the manufacturer must determine a support period that reflects the time during which the product is expected to be used. As a rule, this period cannot be shorter than five years. Where the expected use time is shorter, the support must match that duration; where it is longer, the manufacturer must consider a longer period. This distinction is especially relevant for network equipment, industrial systems and other products that remain in operation for many years. During the declared period, the manufacturer must comply with the applicable vulnerability handling obligations, including making security updates available. However, it is important to distinguish security support from commercial warranty or functional maintenance: the CRA does not guarantee that every flaw will be fixed, nor that the product will receive new features indefinitely.

The gap between support and actual use creates risk

Many organisations keep switches, Wi-Fi controllers, video surveillance systems and industrial equipment in production for longer than originally planned. When security support ends before replacement, the organisation may stop receiving fixes for new vulnerabilities, increasing its risk exposure. In these cases, risk-based patch management is no longer sufficient, because updates from the manufacturer are not necessarily available any more. Temporary measures may be needed, such as network isolation, access restrictions, enhanced monitoring or early replacement. Therefore, before acquiring a product, it is important to compare the announced support period with the expected lifespan, especially when the installation requires significant investment, integration with other systems or planned downtime for replacement.

Criteria to include in procurement specifications

The support period should be considered right from the definition of procurement requirements. In tender specifications, the procurement team can request the security end-of-support date, the update policy, the vulnerability reporting channels and the conditions under which fixes are made available. Where relevant, it can also ask for information on software components, including a software bill of materials (SBOM), and on dependence on external services. These elements should be assessed together with the total cost of ownership, the criticality of the equipment and its expected duration of use. A product with a lower initial price may require early replacement if support ends too soon. On the other hand, requirements should be proportionate: a low-impact peripheral device does not necessarily require the same level of assessment as a firewall or a core network device. The goal is to buy technology with a realistic view of its lifecycle.

From inventory to multi-year budget

End-of-support information only creates value when it is integrated into asset management. Recording the manufacturer, model, version, end-of-support date and dependent services in the CMDB makes it possible to identify equipment that needs attention before it becomes a problem. This information can feed alerts, renewal plans and multi-year budgets, aligning with IT infrastructure management. For equipment that is already installed, it is important to distinguish the contractual end-of-support date from the obligations introduced by the CRA. Products placed on the market before 11 December 2027 are not automatically subject to all the new requirements, as there are transitional rules and specific exceptions. In these cases, it may be necessary to request clarification from the manufacturer, consult published lifecycle policies and assess mitigation or replacement measures.

A decision criterion that requires method

The Cyber Resilience Act directs its main obligations at manufacturers and other economic operators involved in making products with digital elements available on the European market. For organisations that buy technology for their own use, the regulation creates an opportunity to improve procurement criteria, asset management and renewal planning. The support period should not be analysed in isolation: it must be related to the criticality of the equipment, exposure to threats, technology dependencies and the cost of replacement. Entities covered by NIS2 or by sector-specific regulation should also assess how these criteria fit with their respective risk management and supply chain security obligations. Buying technology with support suited to its intended use is a security decision, but also a matter of operational continuity and investment sustainability.