Update obligation for CRA-compliant products: Minimum 5 years of security updates

CRA Update Management: Security Updates per Art. 10

The Cyber Resilience Act requires manufacturers under Art. 10 and Annex I Part II to provide security updates throughout the entire product lifecycle, with a minimum of 5 years.

  • 01CRA Art. 10/Annex I compliant update processes
  • 02Minimum 5-year security updates and 10-year archival
  • 03Separation of security and feature updates
  • 0424h reporting obligation for actively exploited vulnerabilities
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

CRA Update Management: Manufacturer Obligations

The Cyber Resilience Act (EU 2024/2847) establishes clear requirements for update management of products with digital elements. Manufacturers must provide free security updates for the entire support period, minimum 5 years. Art. 10(6) and Annex I Part II define the specific obligations: timely vulnerability remediation, secure update distribution, automatic updates as default setting, and transparent user information about security status and end-of-support.

ADVISORI supports manufacturers in implementing CRA-compliant update processes: from gap analysis of existing patch management systems through development of a compliant update strategy to implementation of automated vulnerability detection and secure update distribution. We ensure your products meet the requirements of Art. 10, Annex I and Annex II.

2 service modules

Service scope

01

CRA Update Strategy Development

Development of comprehensive update strategies that align CRA requirements with business objectives.

  • CRA-compliant update policies and processes
  • Risk assessment and prioritization frameworks
  • Update lifecycle management concepts
  • Stakeholder communication strategies
02

Automated Vulnerability Management

Implementation of automated systems for continuous monitoring and assessment of security vulnerabilities.

  • Continuous vulnerability scanning
  • Automated risk assessment and classification
  • Integration into CI/CD pipelines
  • Real-time threat intelligence integration

5 phases

Our Approach

We develop a CRA-compliant update management system with you that systematically implements the requirements of Art. 10 and Annex I.

  1. CRA Gap Analysis - Assessment of existing update processes against Art

    10, Annex I Part II and Annex II documentation requirements

  2. Update Strategy - Definition of support period (min

    5 years), update architecture design and rollback mechanisms

  3. Step 3

    Implementation - Secure update distribution with cryptographic signing, automatic updates as default, separation of security and feature updates

  4. Step 4

    Vulnerability Handling - Integration of CVE monitoring, SBOM reconciliation and 24h reporting process to ENISA for actively exploited vulnerabilities

  5. Step 5

    Documentation and Conformity - Technical documentation per Annex II and VII, preparation for conformity assessment

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Why ADVISORI for this

  • 01Deep CRA expertise focused on Art. 10 and Annex I update requirements
  • 02Experience with patch management systems for IoT, software and embedded systems
  • 03Proven methodologies for CRA-compliant update governance
  • 04Holistic approach from vulnerability handling to conformity documentation

Further reading

6 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about CRA Cyber Resilience Act Update Management

What update obligations does the Cyber Resilience Act impose on manufacturers?

Under Art. 10 and Annex I Part II of the CRA (EU 2024/2847), manufacturers of products with digital elements must handle vulnerabilities effectively for the entire support period. This means identifying and documenting vulnerabilities and components — including a software bill of materials (SBOM) — addressing vulnerabilities without delay, and distributing security updates free of charge through secure mechanisms. Updates must be made available promptly after a fix exists, accompanied by advisory information describing the vulnerability and the action users should take. Security updates must be deliverable separately from functionality updates, and the product must be designed so that updates can be installed reliably, with automatic installation as the default where the product category supports it. These obligations apply regardless of whether the product is sold once or licensed continuously.

How long must security updates be provided, and how is the support period determined?

The CRA requires manufacturers to define a support period that reflects the time the product is reasonably expected to be in use — as a rule, at least five years. For products with a demonstrably shorter expected lifetime, a shorter period may be justified; for long-lived products such as industrial components, a longer period is expected. The support period must be stated transparently at the time of purchase, including a clearly indicated end-of-support date. In addition, manufacturers must keep technical documentation and make security updates that were issued during the support period available for at least ten years. Defining the support period is therefore a strategic product decision: it drives engineering capacity, component selection and contractual commitments across the entire portfolio.

What reporting obligations apply for actively exploited vulnerabilities?

The CRA establishes a strict multi-stage reporting process for actively exploited vulnerabilities and severe incidents affecting product security.

🔍 The key stages:

• Early warning within 24 hours of becoming aware, submitted via the single reporting platform to the designated CSIRT and ENISA
• A vulnerability notification within 72 hours with available details on the nature of the exploit and corrective measures
• A final report after remediation, describing the vulnerability, its severity and the fix provided. These reporting obligations apply from 11 September 2026 — ahead of the main CRA obligations. Manufacturers therefore need functioning detection, triage and reporting processes early: clear internal criteria for "actively exploited", defined roles, prepared report templates and rehearsed escalation paths. We integrate this process with existing PSIRT and incident response structures.

Do security updates have to be free of charge and installed automatically?

Yes — security updates within the support period must be provided free of charge and made available without delay. For many product categories, particularly consumer products, the CRA additionally expects automatic security updates to be enabled as the default setting, with a clear and easy opt-out mechanism for users who need to control update timing. Users must be informed about available updates, and the update mechanism itself must be secure: cryptographically signed packages, integrity verification before installation and rollback capability if an update fails. For enterprise and industrial products where automatic installation could disrupt operations, manufacturers can offer deferred deployment, but they must still notify users promptly and make installation straightforward. The guiding principle is that staying secure must not depend on user effort or payment.

Why must security updates be separated from feature updates, and what does this mean for our release process?

The CRA requires that security updates can be delivered separately from functionality updates wherever technically feasible. The rationale is user protection: customers must be able to close vulnerabilities without being forced to accept new features, changed behavior or new license terms. For many manufacturers this is the most disruptive requirement, because established release trains bundle fixes and features into combined versions. In practice it means maintaining patchable release branches for every supported version, building CI/CD pipelines that can produce security-only packages, and defining a backporting strategy for older versions still within the support period. We help you redesign the release architecture and versioning policy so that security-only updates become routine rather than exceptional effort — a prerequisite for meeting the "without delay" expectation.

When do the CRA update obligations apply, and how should manufacturers prepare now?

The CRA entered into force in December 2024. The reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026, and the main obligations — including the full update and vulnerability handling requirements — apply from 11 December 2027 to products placed on the market from that date. Products undergo conformity assessment against these requirements, so update management directly affects market access and CE marking. A realistic preparation sequence: gap analysis of current patch and vulnerability management against Art. 10 and Annex I, definition of support periods per product line, implementation of secure update distribution and SBOM-based vulnerability monitoring, and preparation of the technical documentation per Annex VII. Starting early matters because architecture changes — signed update channels, separable security releases — need full development cycles to land.