Before buying a device, check how long it will receive security support

Verified on 12 October 2026

Corrected on 12 October 2026: we clarify when the manufacturer’s obligation starts to apply.

When you buy a computer or phone for your office, you rarely ask when the manufacturer will stop providing security patches. You look at price, memory, or delivery dates. However, as soon as the manufacturer stops updating the operating system or firmware, any new flaw discovered on the network remains permanently open.

What the regulation actually says

The regulation is the European Cyber Resilience Act (CRA), or Regulation (EU) 2024/2847. It entered into force on 10 December 2024 and its general application starts on 11 December 2027. It places no burden on the small business buying equipment: the requirements apply to manufacturers, importers and distributors of products with digital elements sold in the European Union.

What does this change for your business?

The entity required to certify security and maintain patches is the manufacturer, not the small firm connecting equipment to its local network to get work done.

Regulation (EU) 2024/2847, in Article 13, paragraph 19, will require manufacturers, from 11 December 2027, to indicate clearly and intelligibly at the time of purchase the end date of the support period, including at least the month and year. This applies to products placed on the market from that date; earlier products are covered only if they undergo substantial modification afterwards (Article 69, paragraph 2).

In practice, for you: today this regulation does not yet require you to do anything, but you can already ask for that information before paying, and from 11 December 2027 the manufacturer will have to state it for new equipment.

That is the real benefit of the regulation. Although it targets manufacturers, it will give you information that today is often buried in technical pages: how many years of actual coverage you are paying for. A discounted device whose official support ends in six months is a risk that will force you to replace it early.

What to check before approving a purchase

You only need to apply three simple checks before signing an equipment renewal quote:

First, request in writing the manufacturer’s committed security support end date for each quoted model, not just the physical hardware replacement warranty. The warranty covers a broken screen; security support guarantees patches against critical vulnerabilities.

Second, beware of steep clearance discounts on discontinued models. Distributors often liquidate stock that manufacturers are about to drop from maintenance cycles. If a device has a support end date around the corner, its total cost of ownership is far higher than the invoice price.

Third, keep a simple inventory of your office’s primary equipment alongside support expiration dates. Knowing which computers or firewalls will lose patch coverage in the next twelve months allows you to budget replacements calmly, without last-minute emergencies.