Plan security support across the product lifecycle
Industrial electronics often remain in service for many years. A reliable support strategy considers expected use, component availability, the build environment and access to field devices. Under the CRA, five years is generally a minimum; a shorter expected use period determines support where applicable. Longer expected use may require longer support.
Assess support and retrofit optionsUpdates need to reach the device securely
An update plan defines verification, approval, secure distribution and recovery. Signature verification, protection against unauthorised downgrade and a tested recovery path are possible technical measures. An over-the-air connection is not a universal legal requirement; a controlled service route may also be suitable for the product.
CRA requirements on free security updates need to be addressed. These are distinct from agreed engineering and support services. Manufacturers need to be able to fulfil their own support commitments even if a component supplier ends support earlier.
A retrofit can change the product assessment
Adding remote access may affect attack surface, intended purpose or conformity and needs assessment for substantial modification before implementation. A purely risk-reducing security fix without a change of purpose is not automatically substantial. Transitional rules need product-specific application for products placed on the market before December 2027; reporting obligations already apply.
What Solvetronix helps you establish
- A technical support and update strategy with documented limitations.
- An assessment of planned modifications and required evidence.
- A basis for deciding between hardening, retrofit, component replacement and a new design.
Legal basis and sources
General information and technical guidance. The specific assessment depends on the product, role and use. Reviewed 22 October 2026.