Generate a CRA Product Lifecycle Policy

The CRA requires you to declare a support period (Art. 10(2)), distribute security updates (Annex I Part II) and communicate end-of-life to your users (Art. 10(6)). Fill in the fields on the left — a policy renders live on the right, ready to publish or attach to a product dossier.

Scope

Product category *

Products covered

Support period (Art. 10(2))

Support duration: 5 year(s)

The CRA does not set a fixed minimum. A 5-year window is a common industry baseline; adjust based on your product's expected service life.

How the period is calculated

Support-period justification

Annex VII (4) requires the reasoning behind your chosen support period, not just the number of years.

Expected product lifetime

Security context & threat exposure

User expectations & obligations

Technical feasibility

Additional notes

Update distribution (Annex I Part II)

Update channel

Channel details

Security-patch response window

day(s)

End-of-life (Art. 10(6))

Advance notice before EOL

day(s)

Where EOL is announced *

Ownership & version

Policy owner *

Owner role *

Effective from *

Policy version *

# Product Lifecycle Policy — —

_Version 1.0 · effective 2026-10-25_

This policy documents the support period, security-patch response, and end-of-life communication for the products with digital elements listed below, in accordance with Article 10(2), Article 10(6) and Annex I Part II of Regulation (EU) 2024/2847 (Cyber Resilience Act).

## 1. Scope
- **Product category:** —

## 2. Support period (Art. 10(2))
- **Duration:** 5 year(s) from the date each product is placed on the market.
- Security updates are made available free of charge for the whole support period.
- The support period is reflected on the product page and in the Declaration of Conformity.

## 3. Update distribution (Annex I Part II §1, §8)
- **Channel:** Over-the-air (OTA) update from a manufacturer-controlled endpoint
- Updates are digitally signed and delivered without unreasonable delay.
- Where feasible, security updates are installed automatically; users are always able to opt out per Annex I Part I §2(k).

## 4. Security-patch response window
- **Target:** a fix or mitigation is made available within **30 day(s)** of the vulnerability being confirmed by the manufacturer.
- Actively-exploited vulnerabilities are reported to ENISA under Article 14 in parallel (24h / 72h / 14-day cascade).

## 5. End-of-life communication (Art. 10(6))
- **Advance notice:** end-of-life is announced at least **365 day(s)** before the last date of security support.
- **Channels:** —
- The notice includes the exact end date, the recommended migration path, and any residual risks after that date.

## 6. Ownership
- **Policy owner:** — — —
- **Version:** 1.0    **Effective from:** 2026-10-25
- Reviewed at least annually and after any material change to the product life-cycle model.