- Angle: a fix in year five depends on code, components and build steps from year one. Codekeeper keeps them in one deposit and proves, rebuild by rebuild, that the product still builds. If the manufacturer stops, the agreed protection decides who brings it back.
- Hero mock: one manufacturer's products as applications, each with its protection and latest evidence. Gateway Controller matches the other CRA pages. It deliberately shows no "end of support" dates: tracking support periods in the app isn't a confirmed feature (production's mock showed "Ends 11 Mar 2033 · 4 yrs 8 mo left").
- Also gone: the old Certified-tier seal and "A Certified rebuild", "€15M or 2.5% … if you cannot produce a patch during a routine review" (Article 64 not verified), the DORA Article 30(2)(f), NIS2 21(2)(e), FFIEC and ISO A.5.30 mappings (not verified, and off-topic here), "AES256/512" and "Live in 24 hours, with no ongoing work on your side".
Years of support ahead. Proof you can still build the fix.
The CRA asks manufacturers to handle vulnerabilities for the whole support period: at least five years, unless the product is expected to be in use for less. Codekeeper keeps what a fix needs in one deposit and proves, rebuild by rebuild, that it still builds.
Escrow Pro from $449. Resilience Pro from $649. Per application per month.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Four rebuilds a year included
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Production's "five-year support period clock starts the day you enter the EU market" isn't how Article 13(8) puts it ("when placing a product with digital elements on the market, and for the support period"), so the page doesn't say when the period starts. Legal can add that if they want it.
What the CRA asks
Support becomes a duty measured in years.
Vulnerabilities in the product and its components have to be handled for the length of the support period. By its later years, the people and tools that built the release may have moved on.
“Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I.”
“… the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.”
“Manufacturers shall ensure that each security update, as referred to in Part II, point (8), of Annex I, which has been made available to users during the support period, remains available after it has been issued for a minimum of 10 years or for the remainder of the support period, whichever is longer.”
“A manufacturer that ceases its operations and, as a result, is not able to comply with this Regulation shall inform, before the cessation of operations takes effect, the relevant market surveillance authorities as well as, by any means available and to the extent possible, the users of the relevant products with digital elements placed on the market, of the impending cessation of operations.”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
In practice
A fix in year five depends on choices from year one.
The code, the toolchain and the components a patch needs were chosen when the release shipped. Over a support period, a lot around them changes.
The team changes
The engineers who set up the build move on. What they knew has to be written down as build steps someone else can follow.
The toolchain moves on
Compilers, base images and build servers are upgraded or retired. The release in your customers' hands still has to build.
You might stop
If you cease operations, Article 13(23) asks you to tell authorities and users first. Your customers will want to know who can still fix the product.
- Article 13(9) is not in the map on purpose. Keeping updates available is the manufacturer's distribution job, and retention of earlier deposit versions isn't confirmed (to-confirm.md). The FAQ answers it without a retention claim.
- "Synced daily" is a production claim, still flagged in to-confirm.md.
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the rebuild and SBOM rows name Continuity Pro (the Pro levels); the cease-operations row stays with the three protections.
Evidence map
Evidence for each part of the support period.
What you can show a market surveillance authority, an assessor or an enterprise customer, and which protection it comes with.
| CRA | Codekeeper evidence |
|---|---|
| Art. 13(8) Vulnerabilities handled for the support period | To ship a fix, the release has to build. Each rebuild proves it does, from the deposit alone, in the Codekeeper AI Verification Lab with no help from your team. Between runs, we flag what changed in your repositories, so you know when to rebuild. Recoverability CertificateRun reportBuild stepsEscrow Pro · Resilience Pro · Continuity Pro |
| Art. 13(8) Including its components | Third-party, open-source and private components deposited with your code and synced daily, with an automated check of what's there. A rebuild flags anything missing. Third-party components Vault reportSBOMVault report with every protection · SBOM with the Pro levels |
| Art. 13(8), fifth subparagraph How the support period was set, in the technical documentation | Deposit the reasoning with the technical documentation, next to the code it describes. Keeping the technical file Vault reportSoftware Resilience CertificateEvery protection |
| Art. 13(23) If you cease operations | Your customers keep a route back: the deposit released to them under Escrow, or recovered for them by us under Resilience. With Continuity, we also keep the live environment paid and switched on for an agreed period while we recover. Escrow AgreementResilience ArrangementEscrow · Resilience · Continuity |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Choose the protection
If you can't support it, who brings it back?
Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.
Escrow Pro
From$449per application per month
Everything you need to recover.
- The deposit released to your customers under agreed conditions
- 4 rebuilds a year, on supported technology stacks
- Build steps, SBOM, Exit workbook and a deployable copy
- Recoverability Certificate
Resilience Pro
From$649per application per month
Proven before we need it.
- The deposit comes to Codekeeper and we run the recovery for your customers
- 4 rebuilds a year, on supported technology stacks
- Build steps, SBOM, Exit workbook and a deployable copy
- Recoverability Certificate
Continuity Pro
From$1,699per application per month
Full continuity, proven in advance.
- Everything in Resilience Pro
- For products with a live service behind them
- The live environment mapped at setup and kept current
- Kept paid and switched on for an agreed period while we recover
12 rebuilds a year
$299 a month moreTwelve rebuilds a year instead of four, for products you release often. For Escrow Pro, Resilience Pro and Continuity Pro.
Exit Exercise
From $12,000Our specialists rebuild the product by hand in a clean room, from the deposit alone, and test the functions your customers nominate. Added to any plan. See the Exit Exercise
Prices for software applications; SaaS and AI have their own rows. Setup $499 per arrangement, $999 for Continuity and Continuity Pro. Escrow, Resilience and Continuity, from $199, $399 and $1,449, hold the deposit with an automated check, a vault report and a Software Resilience Certificate. See full pricing
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
Before you set your support period.
What is the support period?
Article 3, point (20): “the period during which a manufacturer is required to ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I”.
How long does it have to be?
At least five years. Where the product is expected to be in use for less than five years, the support period corresponds to the expected use time (Article 13(8)). Manufacturers set it to reflect how long the product is expected to be in use, taking into account reasonable user expectations, the nature of the product and relevant Union law. The Commission may set minimum periods for specific product categories by delegated act.
Do we have to tell customers when support ends?
Yes. Article 13(19) asks manufacturers to make sure the end date of the support period, “including at least the month and the year, is clearly and understandably specified at the time of purchase”.
How long must security updates stay available?
Article 13(9): each security update made available during the support period “remains available after it has been issued for a minimum of 10 years or for the remainder of the support period, whichever is longer.” Making updates available is your distribution's job. Codekeeper keeps the code and build steps a fix is built from, and proves they still build.
Is it five years or ten?
Both, for different things. The support period is at least five years (Article 13(8)). Each security update stays available for at least ten years after it's issued, or the rest of the support period if longer (Article 13(9)). The technical documentation is kept for at least ten years after the product is placed on the market, or the support period if longer (Article 13(13)). See keeping the technical file.
What happens for our customers if we stop?
Article 13(23) asks a manufacturer that ceases operations to inform market surveillance authorities and users before it takes effect. With Escrow, the deposit is released to your customers under the agreed conditions. With Resilience, Codekeeper runs the recovery for them. With Continuity, we also keep the live environment paid and switched on for an agreed period while we recover.
When does this apply?
The CRA entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027.
Will this make our product meet the CRA?
No product can do that on its own. Codekeeper keeps what you need to support the product recoverable, and gives you evidence: certificates, run reports, build steps and SBOMs. Whether it meets a specific requirement is for you and your assessor to decide.
Plan the whole support period. Prove it as you go.
We'll look at the products you support and what a fix in year five would need from the deposit.