Extended Security Maintenance and “Placing on the Market”
A new dossier with every issue. This one covers whether continuing to maintain a product places it on the market again under the Cyber Resilience Act, and what a paid extended security maintenance (ESM) offering may charge for.
Placing a product on the market is the moment the CRA’s up-front obligations attach: the Annex I essential requirements, conformity assessment, the EU declaration of conformity and CE marking. If every security patch counted as a fresh placing, every patch would reopen that assessment against a moving state-of-the-art baseline. The rational response would be to stop maintaining older products, the opposite of the security outcome the Regulation seeks.
Does Extended Security Maintenance Change CRA Obligations?
Extended Security Maintenance and “Placing on the Market” sets out where the Commission’s adopted guidance draws the line between maintaining a product and placing it on the market again. It also explains why a paid ESM offering should never charge for the security update itself. It is written for product security and compliance leads, engineering and product leadership responsible for release classification, and commercial teams pricing extended support.
Get the dossier free until 15 October.
The dossier’s general answer is that the two are distinct. Maintenance is a duty that follows from a product having already been placed on the market: a manufacturer can only maintain a product that is already there, so maintaining it cannot itself be the event that places it.
The Commission’s adopted guidance of 27 July 2026, which is non-binding, sets the test. A security update that keeps the intended purpose and adds no new cybersecurity risk is not a substantial modification, even when it makes significant technical changes. What the update delivers is what counts. A security-driven fix that opens a new external interface, moves processing off the device or changes the data flows can still count as a new placing on the market, and so can a minor feature.
The transitional rules follow the same logic. Products placed on the market before 11 December 2027 come into scope only if they later undergo a substantial modification. The Commission’s FAQs (version 1.4) give the example of a smart TV placed on the market in 2027: a later non-substantial bug fix creates no duty to bring it into conformity.
Paid ESM is where the dossier takes a position of its own. Footnote 19 of the guidance accepts paid remediation of earlier versions once Article 13(10) applies, while Annex I, Part II, point (8) requires security updates to be disseminated free of charge. The dossier does not rely on the footnote. It holds that security updates are never charged for, inside or after the support period, so a paid ESM offering may charge only for what is not a security update, such as support services, response-time commitments or compatibility work.
The dossier classifies eight common maintenance actions in a single table and sets out nine recommended actions. Like every dossier in the series, it is neither legal advice nor a conformity determination.
What comes next
Issue 6 will introduce the next dossier. If your team sells extended support today, which part of the fee pays for something other than the security update?
