Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
System 6 / 6
End dates and warnings, on paper
For procurement, the CFO and the CRA owner
What it is
Written promises from suppliers about how long they will fix security flaws in their parts, and how quickly they will warn you.
Why it matters
You are responsible for every part in your product. If a supplier stops fixing theirs, the problem becomes yours.
It works when
Every critical part is supported for at least as long as you promise your customers.
What the law says
The CRA requires due diligence when integrating components from third parties (Article 13(5)) and a support period of normally at least five years (Article 13(8)), when setting which manufacturers may take into account the support periods of integrated components. Written support commitments from suppliers are our recommendation: a contracts folder does not warn you when a supplier's support is about to end.
Example: ABC Heating Systems, a fictional Danish maker of connected thermostats.
Sofie Lund
Procurement
Asks every supplier in writing: how long will you fix security flaws, can we have your parts list, and how fast will you warn us?
Wi-Fi module supplier
Outside the company
Answers in writing. In the example: security fixes until June 2028, and a warning within 10 working days.
Anders Holm
CFO
Prices the options for a part that loses support: source code escrow, taking over its software in house, or swapping it in a new product version.
Jonas Brandt
Head of Engineering, CRA owner
Puts every supplier end date in the calendar, so one never passes unnoticed again.
A small team can run this system too. Here is what it takes.
Do it yourself
A dated review of every supplier, support end dates in one sheet, a calendar reminder a year before each one.
Half a day of help
Someone to read your existing contracts and flag which ones say nothing about support.
Where SPS Digital Tech helps
We help you review your supplier contracts and work out what to ask each supplier for in writing.
The story behind it: The supplier who stopped answering, December 2020
"Nobody looks after that software anymore. There won't be a fix."
Read the storyWe will send you the step-by-step checklist we use with clients, and answer any questions about your setup.