Scenario: ending support the CRA way
A product reaches end-of-life. Notify users, ship the last update, and close out the support period on record.
A supported product reaches end-of-life — run the CRA-compliant close-out so the support period ends on the record, not in silence. Related: Scenario: answering a security questionnaire · Scenario: choosing your conformity route.
A product you've supported for years is being retired. Under the CRA the support period must be handled deliberately — at least five years unless the product was in use for less — and ending it is a process, not just an internal decision.
Where the support period stands
Value
Placed on marketMar 2021
Committed support period5 years
Support endsMar 2026
Active installs1,240
The close-out steps
- Notify users in advance. Tell affected users the end-of-support date and what it means, with enough lead time to migrate.
- Ship the last security update. Clear the open vulnerability backlog and publish a final signed update, so the product exits in a known-good state.
- Record the close-out. Log the end-of-support date, the final version, and the notice in the evidence log.
What gets recorded
ItemStatus
EOL notice sent1,240 users
Final updatev4.9.3 · signed
Open vulnerabilities0 at close
Support-period recordSealed
End-of-life isn't the absence of a decision — it's a documented one. Close the support period on purpose and you can prove the obligation was met, not abandoned.
Proofwright keeps the support-period clock and its close-out on the record.