20 May 2026 5 min read CRA
The CRA expects security updates over a defined support period — how to set and communicate yours.
Support period
Manufacturers must provide security updates for a period appropriate to the product and its expected use. The period must be communicated to users.
Update mechanics
- A secure update channel (signed, verified).
- A cadence for routine and emergency updates.
- Clear end-of-support communication.
Evidence
Document the support period, the update mechanism, and your track record of shipping updates.
This is an educational explainer. For the canonical regulation reference, see the dedicated CRA page — or run an assessment to see how it applies to your product.