Security support periods: how long a device gets updates and where to read it

A connected device gets security updates for as long as its manufacturer promises, and the promise now has to be written down in more and more places. In the UK the maker must publish a defined support period for consumer connectable products. In the EU, phones, tablets and TVs already carry update obligations, and from December 2027 almost every connected product must state the end date of its support period at the time of purchase. In the U.S., the voluntary Cyber Trust Mark puts the date in an online registry.

This guide explains what each rule asks for, where the information appears, and how to read a support statement. The broader IoT security regulation guide covers the rest of each regime.

What is a support period, exactly?

A security support period is the minimum time during which the manufacturer commits to fix vulnerabilities and ship security updates. It is not a warranty, and it is not a promise to keep a cloud service or an app running.

The details differ between regimes, and the differences matter when you compare products:

What is promised. Security fixes only, or also bug fixes and new features.
How it is expressed. An end date (“until March 2031”) or a duration (“five years”).
Where the clock starts. The day you buy, the day the model was launched, or the day the last unit of the model was sold.

What does the UK PSTI regime require?

The UK PSTI product security regulations, in force since 29 April 2024, define the “defined support period” as the minimum length of time, expressed as a period with an end date, for which security updates will be provided. Schedule 1, paragraph 3 requires manufacturers to publish it: clearly, in English, free of charge, without the reader having to ask or hand over personal information, and in terms a non-technical reader understands. On the manufacturer’s own shop pages it must sit alongside, or with equal prominence to, the main product information.

A manufacturer may extend the period and must publish the new one as soon as practicable, but the requirement is not met if the period is shortened after publication. The period also appears in the statement of compliance that must accompany the product.

What does the EU Cyber Resilience Act require?

The Cyber Resilience Act, Regulation (EU) 2024/2847, covers almost every product with digital elements and applies in full from 11 December 2027. Its support period rules are in Article 13 and Annex II:

Length (Article 13(8)). The manufacturer sets the period to reflect how long the product is expected to be in use, taking into account reasonable user expectations. It must be at least five years, unless the product is expected to be in use for less, in which case it matches that time. The Commission may set longer minimums for specific product categories.
Disclosure (Article 13(19)). The end date, including at least the month and the year, must be clearly stated at the time of purchase in an easily accessible way and, where applicable, on the product, its packaging or by digital means.
Notification. Where technically feasible, the manufacturer must display a notification telling users that the product has reached the end of its support period.
User information (Annex II, point 7). The instructions must state the type of technical security support offered and the end date of the support period.
Availability (Article 13(9)). Each security update issued during the period must remain available for at least ten years, or for the rest of the support period if that is longer.
Price (Annex I, Part II). Security updates are free of charge, except for tailor-made business products where agreed otherwise.

What do EU rules for phones, tablets and TVs add?

Some product groups already have update rules under EU ecodesign and energy labelling law.

Smartphones and tablets. Regulation (EU) 2023/1670, applying from 20 June 2025, says that if a manufacturer provides security, corrective or functionality updates to the operating system, it must make them available free of charge for all units of the model until at least five years after the last unit of that model is placed on the market. Security and corrective updates must reach users no later than four months after the source code of the underlying operating system update is published, or, when the source is not published, after the operating system provider releases the update. The clock starts when the model stops being sold, so an early buyer can get well over five years.

The energy label. The phone and tablet label, Delegated Regulation (EU) 2023/1669, adds a field to the product information sheet in the EU’s EPREL database: the minimum guaranteed availability of operating system updates, in years. The label’s repairability score awards points for five, six and seven or more years.

TVs and monitors. The ecodesign rules for electronic displays, Regulation (EU) 2019/2021, require the latest firmware and the latest security update to remain available for at least eight years after the last unit of a model is placed on the market, and the minimum guaranteed availability of updates to appear in the product information sheet. Note the wording: the latest update must stay downloadable, which is not the same as a commitment to keep writing new patches.

What does the U.S. Cyber Trust Mark show?

The U.S. has no general support period law. The voluntary Cyber Trust Mark, adopted by the FCC in Report and Order FCC 24-26, pairs a logo with a QR code that leads to a registry entry. Among the required registry fields is the date until which the manufacturer promises to identify critical vulnerabilities and issue updates, described as the minimum support period, or a statement that the device is unsupported. The registry also says whether updates are automatic.

The FCC chose not to print an expiry date on the label itself, citing research in which consumers misread such dates as the day the device would stop working. Manufacturers can extend the period in the registry.

How do the rules compare?

Rule	Products	What must be stated	Where
UK PSTI	Consumer connectable products	Support period with an end date	Maker’s website and statement of compliance
EU CRA (from Dec 2027)	Products with digital elements	End date, at least month and year	Point of sale, product or packaging, instructions
EU 2023/1670 and 2023/1669	Phones and tablets	Years of OS updates	EPREL product information sheet
EU 2019/2021	TVs and monitors	Years of firmware and security update availability	Product information sheet
U.S. Cyber Trust Mark	Labeled consumer products	Support end date or “unsupported”	Online registry via QR code

How do you read a support statement?

Five checks catch most problems:

Is there an end date? “Five years” from an unstated start is hard to hold anyone to. A month and year is.
What does it cover? Security fixes, bug fixes, new features and cloud services are separate promises.
When does the clock start? For phones, it runs from the end of sales of the model; for many other products, from the maker’s own reference point. Buying a model late in its life shortens your share.
Who said it? A study of EU online stores found retailers, manufacturers and the EU database often giving different periods for the same model, with retailers usually stating less. The manufacturer’s statement is the one the CRA and PSTI make binding on the manufacturer.
Keep a copy. Save the page or a screenshot with the date. Under PSTI the period can be extended but not shortened, and a record makes any later dispute simpler.

For a household, compare end dates the way you compare prices, and plan to replace or isolate a device when its date arrives. For a building or a business, record the end date per model alongside the firmware version as part of device lifecycle management.

Where to go next

What happens when a smart device stops getting updates? covers documented shutdowns and what owners can do.
IoT security regulation explains the CRA, PSTI and Cyber Trust Mark beyond support periods.
EU online stores rarely say how long IoT devices get security updates reports how often the information reaches buyers.
Device management and over-the-air updates shows what keeping that promise takes in engineering terms.

Topics: support period, security updates, PSTI, Cyber Resilience Act, Cyber Trust Mark, ecodesign, everyday questions