How long must you support it? Five years is not the answer
The five-year figure is a safeguard, not a default. The Commission's guidance is explicit, and getting this wrong is the easiest way to publish a support period that does not comply.
Ask most teams how long they must support a product under the CRA and the answer comes back instantly: five years. It is the number everyone remembers, and treating it as the answer is one of the more common ways to get this wrong.
What Art. 13(8) actually says
The support period reflects the time the product is expected to be in use. Five years enters as a floor for products expected to be in use for at least that long, and where a product is genuinely expected to be in use for less, the support period corresponds to that shorter time.
The guidance, at para 126, is blunt about the consequence: the minimum operates only as a safeguard, and a support period of five years is not to be considered the default. Recital 60 says products reasonably expected to be in use for longer than five years should have correspondingly longer support periods.
So a sensor with a ten-year service life and a five-year declared support period is not compliant because it cleared the minimum. It is non-compliant because the period does not reflect the expected use time.
How to arrive at the number
Art. 13(8) points at reasonable user expectations, the nature of the product including its intended purpose, and relevant Union law on product lifetimes. The guidance adds the support periods of comparable products from other manufacturers, the availability of the operating environment, and the support periods of third-party components that provide core functions.
That last one bites. If your product depends on a third-party component supported for three years, promising eight means owning that gap yourself.
Software released iteratively
Para 128 addresses the pattern where substantially modified versions reach the market often. Each substantially modified version placed on the market needs a declared support period that complies with Art. 13(8), including the five-year minimum unless the expected use time of that version is demonstrably shorter.
Art. 13(10) offers relief. For software, the duty to address and remediate vulnerabilities may attach to the last version placed on the market alone, provided users of earlier versions can obtain that version free of charge and without additional cost to adjust the environment they run it in. Worth noting: you may still choose to support earlier versions, including commercially. The CRA simply stops requiring it.
Telling people when it ends
Art. 13(19) is easy to miss and easy to satisfy. The end date of the support period must be stated at the time of purchase, clearly and understandably, giving at least the month and year. Once it expires, users must be shown a notification where that is technically feasible for the product.
A date buried in a PDF three clicks into a support portal is not at the time of purchase. It belongs where someone decides to buy.
Vandorisk compares the support period you declare against the expected time in use you recorded in the risk assessment, and flags the mismatch rather than waving through anything above five.