Iterative Software and Support Periods Under the Cyber Resilience Act
A new dossier with every issue. This one covers software developed iteratively, and how the Cyber Resilience Act decides which of its releases continue an existing support obligation and which start a new one.
Minor updates, security patches, new builds for different operating systems: under the CRA, each release either continues an existing product and its support period, or is placed on the market as a new product with its own. A new placement triggers the full obligation set: essential requirements, conformity assessment, technical documentation, a declared support period and CE marking. If upgrading to the latest version is gated behind cost or a hardware change, older versions keep their own live support obligations.
When Does a Software Update Start a New CRA Support Period?
Iterative Software and Support Periods Under the Cyber Resilience Act covers these aspects:
- Continuous-release software
- Placing on the market
- How support periods are determined
The dossier was prepared on 3 June 2026, and revised on 10 August 2026 against the Commission guidance adopted on 27 July 2026.
Get the dossier free until 8 October at comply.land/dossiers/cra-support-periods-iterative-software
Software is placed on the market once, at first distribution. Minor updates, such as a move from V1.0.0 to V1.0.1, don’t reset that date and don’t trigger a new conformity assessment. A version resulting from a substantial modification is treated as newly placed on the market and as a separate product. Variants that differ in included components, configurations or enabled functionality are also distinct products, placed on the market separately. Builds for different operating systems are one example.
The controlling question is whether an update introduces new or increased cybersecurity risks that the existing risk assessment doesn’t cover. The guidance gives four non-exhaustive indicators:
- New threat vectors
- New attack scenarios
- Changed likelihood of existing scenarios
- Changed impact of existing scenarios
Scale is irrelevant. A seemingly minor feature can be substantial, while a large change that was anticipated and assessed is not.
Under Article 13(8), each placed version must carry its own declared support period, reflecting the time the product is expected to be in use. Five years is a minimum, not a default. A new placement doesn’t reset the period automatically. If the modification leaves unchanged the factors behind the expected use time, the period aligns with the remaining expected use time of the original product, even if that is less than five years. The period runs from placing on the market, not from the date of purchase. A unit bought late in the cycle therefore carries less remaining support than the headline figure.
Article 13(10), read with Recital 40, is the provision built for iterative development. It allows a manufacturer to confine security updates to the latest version, but only if users of earlier versions can upgrade free of charge and without additional costs. Additional costs means mandatory hardware purchases, infrastructure replacement or fundamental changes to the operating environment. If the upgrade is charged for, every placed version stays supported in parallel for its full support period. Footnote 19 of the guidance suggests that, once a free upgrade path exists, manufacturers may keep patching earlier versions under paid arrangements. The dossier advises against relying on it, because it is non-binding and conflicts with the rule that security updates must be provided free of charge.
The dossier sets out six recommended actions, from a per-version placement register to charging for feature and version upgrades but never for security. It also covers the open issues the guidance leaves unresolved, including rolling releases that have no labelled version boundary.
Like every dossier in the series, it is neither legal advice nor a conformity determination.
What comes next
Issue 5 will introduce the next dossier. If taking your latest version requires a hardware purchase, how many earlier versions are still inside their support periods?
