CRA Dossier
Iterative Software and Support Periods Under the Cyber Resilience Act
One of your weekly releases may qualify as a substantial modification under the Cyber Resilience Act and require a new support-period assessment. This dossier shows which releases may create a substantially modified product requiring its own CRA support-period declaration, and how Article 13(10) may allow you to focus vulnerability handling on the latest version when users can upgrade free of charge and without additional costs.
Written for CTOs, engineering leads and compliance owners who need defensible answers before their next release ships.
Why it matters
Under the CRA, each version of a product placed on the EU market must be considered when determining the applicable support-period obligations, but continuous release software does not ship in discrete, labelled versions the way the law assumes.
Get the CRA substantial-modification test wrong and you either over-commit (running parallel support across every historical release) or under-commit (facing a market surveillance authority with an undocumented, arbitrary support period). This dossier provides both the legal reasoning and the operational checklist to get it right, release by release.
What is inside
- The legal basis in CRA Article 13 and Recitals 40 and 60.
- How the “placed once” rule applies to iterative software, and where software versions and variants count as separate products.
- The risk-based CRA substantial-modification test and its four non-exhaustive indicators.
- How Article 13(10) lets you consolidate vulnerability remediation on the latest substantially modified version, and precisely what “free of charge, no additional costs” rules out.
- The security-update availability, support-period disclosure and retention duties under Articles 13(9) and 13(19).
- Six recommended actions, including how to relocate the paywall around feature upgrades without losing the Article 13(10) free-patching defence.
Who is it for
CTOs, Heads of Engineering, Product Security and Compliance leads at software manufacturers running a rolling or continuous release cycle.
Written by Daniel Thompson-Yvetot (Aug ‘26 Rev), based on the Commission’s adopted guidance C(2026) 5252 final (27 July 2026).
