CLAIM-2026-09-29-10

CRA Article 13(8) requires manufacturers to ensure that vulnerabilities of a product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements in Part II of Annex I for the duration of the support period; Article 13(9) requires each security update issued during the support period to remain available for at least ten years or the remainder of the support period, whichever is longer.

Why it matters

The law guarantees the update stays available. Nothing live today guarantees it gets installed, which is exactly the gap the 38.9% measures.

Sources

• europeancyb2024article