CRA Extended Security Maintenance and Market Placement

Does Extended Security Maintenance Change CRA Obligations?

Security updates after the CRA support period create a difficult commercial question: what can a manufacturer charge for without turning routine maintenance into a new placing on the market? Placing a product on the market triggers the CRA’s obligations: the Annex I essential requirements, conformity assessment, the EU declaration of conformity and the CE marking. If every CRA security update or maintenance patch counted as a new placing, every patch would reopen that assessment against a moving state-of-the-art baseline. Manufacturers would have every reason to stop maintaining older products.

The question becomes particularly important when a manufacturer continues providing security updates after the declared CRA support period through a paid extended security maintenance service.

The Commission’s adopted CRA guidance of 27 July 2026 asks manufacturers whether the update is a substantial modification. The modification is substantial when a security-driven update modifies the product’s intended purpose beyond what was originally foreseen, or introduces new or increased cybersecurity risks not covered by the existing risk assessment.

The guidance leaves a conflict unresolved. Its footnote 19 accepts paid remediation of earlier versions once Article 13(10) applies. Instead, Annex I, Part II, point (8) requires security updates to be disseminated free of charge. This dossier takes the stricter line: CRA security updates are never charged for, inside or after the support period. An ESM offering can charge only for support services, response-time commitments and compatibility work.

What is inside

• The legal framework: the definitions of placing on the market, making available and substantial modification; the Article 13 CRA support period; Annex I, Parts I and II; and the transitional provisions in Article 69 and application dates in Article 71, read with Recitals 39, 40, 41 and 42.
• The case for and against treating maintenance as a placing on the market. This covers paid extended security maintenance (ESM) as commercial supply, free and open-source software (FOSS) where paid access to maintained builds places the software on the market, and the anti-circumvention argument.
• A classification table of eight common CRA software-update and maintenance scenarios, each marked for whether it is a substantial modification and what follows for placing on the market. The actions run from a security-only patch to a parallel ESM edition and patching beyond the declared support period.
• What changes once the CRA support period ends: the vulnerability-handling duties stop, Article 14 reporting continues, and a paid ESM offering needs structuring so it does not read as a stream of fresh placings.
• Products placed before 11 December 2027: when a substantial modification brings them into scope, and why compliance then focuses on the modified parts.
• Nine recommended actions, including classifying every maintenance release in advance against the guidance’s risk indicators (threat vectors, attack scenarios, changed likelihood of existing scenarios, and impact of existing scenarios).
• Six open issues left unresolved by the guidance.

Who is it for

Product security and compliance leads, engineering and product leadership responsible for release classification, and commercial teams pricing CRA extended support or ESM subscriptions.

Written by Daniel Thompson-Yvetot, as an analysis of Regulation (EU) 2024/2847 against the Commission’s adopted guidance C(2026) 5252 final (27 July 2026) and the Commission’s CRA FAQs, version 1.4 (4 September 2026). It is current as at 8 October 2026. The guidance is non-binding, and only the Court of Justice can interpret the Regulation authoritatively. Not legal advice, not a conformity determination.