CRA support period calculator
The support period end date, how long security updates must stay available, and how long to keep the technical file, for one app version.
Under the Cyber Resilience Act every manufacturer decides a support period for its product, handles vulnerabilities for that whole period and tells users when it ends. Enter when an app version was placed on the market and how long people are expected to use it, and get the dates that follow from Article 13, a sentence you can publish, and a calendar file.
What the CRA says
| Rule | What it means for an app |
|---|---|
| Length of the support period Article 13(8) | At least five years. If the product is expected to be in use for less than five years, the support period corresponds to the expected use time. The information used to decide it goes into the technical documentation. |
| Availability of security updates Article 13(9) | Each security update made available during the support period stays available for at least 10 years after it is issued, or for the rest of the support period, whichever is longer. |
| Successive versions Article 13(10) | If you place substantially modified versions on the market, you may fix vulnerabilities (Annex I, Part II, point 2) in the latest version only, provided users of earlier versions can get it free of charge and without extra costs to adjust their hardware or software. |
| Keeping the technical file Article 13(13) | The technical documentation and the EU declaration of conformity stay available to market surveillance authorities for at least 10 years after the product is placed on the market, or for the support period, whichever is longer. |
| Telling users the end date Article 13(19) | The end date of the support period, at least month and year, is stated clearly at the time of purchase and is easy to find. Where technically feasible, users are notified when support has ended. |
How this works for app releases
Our reading, for planning: app stores deliver updates free of charge, so for a typical app the latest version is the one you keep secure, and users of older versions are asked to update. That is the arrangement Article 13(10) describes, and it only works if an older device can still install the latest version. When you drop support for an operating system version, users on it cannot update, so check your support period promise before you raise the minimum OS version.
Each version you place on the market needs a declared support period (see Does the CRA apply to mobile apps?). For an app that ships through the stores, a simple record is one line per release in the technical file: version, release date, end of support and the reasoning. Repeat the current end date in the store listing, on the website and in the in-app information, so users can find it easily (Article 13(19)).
Maintaining apps for clients? Shipmark keeps an SBOM, daily vulnerability checks and the support period for every client app in one place. Founding agencies use it free until 1 April 2027.
Join the free betaSources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), consolidated text, EUR-Lex: Article 13(8) to 13(10), 13(13) and 13(19).
The calculator runs in your browser and stores nothing. It is a planning aid based on Article 13 of Regulation (EU) 2024/2847, not legal advice. Related: Does the CRA apply to mobile apps? · Does the CRA apply to my app? · security.txt generator.