Back your CRA support period with verified custody.

The CRA support period is the time during which a manufacturer must handle vulnerabilities and provide security updates for a product with digital elements. Under Article 13(8) of Regulation (EU) 2024/2847 it must be at least five years, unless the product is expected to be in use for less, and it starts when the product is first placed on the EU market, not when a customer buys it. The end date must be stated at the point of sale.

Support-Period Custody is escrowed, verified storage of everything needed to keep a product patchable across its declared support period: source code, third-party components, the build environment, and the CRA technical file, with certificates proving the product can still be rebuilt. Codekeeper holds it independently, so the obligation survives changes to your team, your suppliers, and your company priorities.

No. A manufacturer cannot transfer the CRA support obligation to a component supplier. Under Article 13, the maker of the final product stays responsible for the security of every component, including open-source and third-party code, for the whole support period. A supplier failing upstream does not reduce what you owe your users, which is why independent custody of what you need to patch matters.

Support-Period Custody differs from your own repositories and backups because a repository proves the code exists today, while custody proves an independent party holds it, that it rebuilds into a patchable product, and that your customers keep access if you stop trading. Those are the things a notified body, an auditor, or a buyer checks about a five-year commitment, and a private backup cannot evidence them.

Under the CRA, each security update must stay available for at least 10 years after it is released, or for the remainder of the support period if that is longer, under Article 13(9). Technical documentation and the EU Declaration of Conformity carry a similar retention duty under Article 31. Custody keeps every shipped update and the technical file reissuable across those windows.

The CRA support-period obligation applies from December 11, 2027, when the Regulation reaches full application. Products placed on the EU market from that date carry the support period, the security-update duty, and the CE-marking and technical-documentation requirements that go with them. The Regulation is already in force, so the time to put custody in place is before that date.

Support-Period Custody supports the CRA most directly, covering the support-period duty under Article 13 and technical-file retention under Article 13(13). The same deposit serves as continuity evidence under DORA Article 30, secure-maintenance evidence under NIS2 Article 21(2)(e), ICT readiness under ISO 27001 A.5.30, and the vendor-failure contingency FFIEC examiners look for.

The CRA support period is at least five years, and the ten-year figures cover two separate duties that outlast it. Article 13(8) sets the support period at a minimum of five years, or longer where the product is expected to be in use for longer. Article 13(9) then requires every security update you issue to stay available for ten years after release, or the rest of the support period if that runs longer. Article 13(13) requires your technical documentation and EU declaration of conformity retained for ten years after the product is placed on the market, on the same whichever-is-longer basis.