Short answer
There is no single number, because three different regimes answer the question from different directions.
- What the contract promised. Article 6(d) of the Sale of Goods Directive makes updates "as stipulated by the sales contract" part of conformity. An advertised support period is binding.
- What the consumer may reasonably expect. Article 7(3) requires updates necessary to keep the goods in conformity for the period the consumer may reasonably expect — with no fixed figure.
- What the Cyber Resilience Act requires of the manufacturer. A support period that should be no less than five years, unless the product's lifetime is shorter, and longer where the product is reasonably expected to be in use for longer.
The first two are consumer-contract rules enforced against the seller. The third is a product-regulation rule enforced against the manufacturer. They coexist rather than replace one another, and the longest applicable obligation governs in practice.
The Sale of Goods Directive: conformity, not a fixed term
Goods with digital elements are goods whose digital content or service is so integral that the goods cannot perform their functions without it. A smart thermostat, a connected doorbell, a fitness tracker.
The update obligation sits inside conformity:
"In the case of goods with digital elements, the seller shall ensure that the consumer is informed of and supplied with updates, including security updates, that are necessary to keep those goods in conformity, for the period of time: (a) that the consumer may reasonably expect given the type and purpose of the goods and the digital elements, and taking into account the circumstances and nature of the contract, where the sales contract provides for a single act of supply of the digital content or digital service; or (b) indicated in Article 10(2) or (5), as applicable, where the sales contract provides for a continuous supply of the digital content or digital service over a period of time." —
Two branches, and the distinction matters.
Single act of supply — the standard is the consumer's reasonable expectation, judged by the type and purpose of the goods. A €30 smart plug and a €900 connected oven do not attract the same expectation. Price, marketing, product category and typical replacement cycles are all relevant.
Continuous supply — the period is fixed by Article 10(2): the seller is liable for lack of conformity of the digital content or service occurring or becoming apparent within two years of delivery, and where the contract provides for continuous supply for more than two years, for the whole of that contractual period.
Note that Article 7(3) is about updates necessary to keep the goods in conformity — principally security and compatibility updates. It does not oblige a seller to keep adding features.
Article 7(4) protects the seller where the consumer fails to install an update within a reasonable time, provided the seller informed them of availability and consequences and the installation instructions were adequate.
Liability periods and the burden of proof
Article 10(1) sets the baseline: the seller is liable for a lack of conformity existing at delivery and becoming apparent within two years, and this applies to goods with digital elements too.
Article 10(3) permits Member States to maintain or introduce longer periods, and several have. Article 10(6) permits shorter agreed periods for second-hand goods, but not below one year.
The burden of proof is strongly consumer-friendly:
"Any lack of conformity which becomes apparent within one year of the time when the goods were delivered shall be presumed to have existed at the time when the goods were delivered, unless proved otherwise or unless this presumption is incompatible with the nature of the goods or with the nature of the lack of conformity." —
Article 11(2) allows Member States to extend that presumption to two years. Article 11(3) goes further for goods with digital elements under a continuous supply contract: the burden is on the seller for the whole Article 10(2) period.
Advertised support periods bind
Article 6(d) brings updates "as stipulated by the sales contract" into subjective conformity. Article 7(1)(d) brings into objective conformity the qualities and features — including durability, functionality, compatibility and security — normal for goods of the same type and which the consumer may reasonably expect, taking into account public statements by or on behalf of the seller or others in the chain, including the producer, particularly in advertising or labelling.
So a manufacturer's public "five years of security updates" commitment feeds into the seller's conformity obligation, even though the seller did not make the statement. Article 7(2) gives the seller limited escapes: it was unaware and could not reasonably have been aware of the statement, the statement was corrected comparably before conclusion, or the decision to buy could not have been influenced by it.
Article 7(5) allows deviation from the objective standard only where the consumer was specifically informed that a particular characteristic deviated and expressly and separately accepted it when concluding the contract. Burying a short support window in standard terms does not qualify.
The Cyber Resilience Act floor
Regulation (EU) 2024/2847 approaches the same problem as product regulation, imposing obligations on manufacturers of products with digital elements rather than on sellers.
Manufacturers must determine a support period reflecting how long the product is expected to be in use. The Regulation's recitals explain the benchmark:
"The support period for which the manufacturer ensures the effective handling of vulnerabilities should be no less than five years, unless the lifetime of the product with digital elements is less than five years, in which case the manufacturer should ensure the vulnerability handling for that lifetime. Where the time the product with digital elements is reasonably expected to be in use is longer than five years, as is often the case for hardware components such as motherboards or microprocessors, network devices such as routers, modems or switches, as well as software, such as operating systems or video-editing tools, manufacturers should accordingly ensure longer support periods." —
Recital 59 requires manufacturers, in setting the period, to take into account reasonable user expectations, the nature of the product and relevant Union law on product lifetime — and to supply market surveillance authorities with the supporting information on request.
Two further features are worth noting. Recital 62 anticipates published statistics and guidance on appropriate support periods by category, and the possibility of delegated acts specifying minimum support periods for specific categories. Recital 61 encourages manufacturers to consider releasing source code at end of support so vulnerabilities can still be handled.
The Regulation's obligations phase in over time, so check the applicable application dates for the specific obligation before relying on it.
How the three interact
For a consumer with a connected product that stops receiving security updates:
- Check what was advertised or stated. A stated support period is contractual and binding via Article 6(d), and public statements feed in via Article 7(1)(d).
- If nothing was stated, apply the reasonable-expectation standard in Article 7(3)(a) by reference to the product type, price and purpose. The Cyber Resilience Act's five-year benchmark is a useful reference point for what is reasonable, even though it binds manufacturers rather than sellers.
- If there is continuous supply, the period is at least two years and the full contractual period where longer.
- Remedies run against the seller under Article 13 — repair or replacement, then price reduction or termination.
- The Cyber Resilience Act route is regulatory, engaging market surveillance authorities rather than giving a direct contractual claim.
Where the Digital Content Directive applies instead
If the digital element is supplied under a separate contract rather than with the goods, the Digital Content Directive governs it. Article 8(2) of that Directive imposes a parallel update obligation for the contractual supply period, or for the period the consumer may reasonably expect where supply is a single act.
Article 3(4) of the Digital Content Directive resolves doubt in favour of the sales contract: where it is unclear whether incorporated or inter-connected digital content forms part of the sale, it is presumed to be covered by the sales contract.
Operational checklist
For consumers:
- Find any advertised support period; it is binding.
- Absent one, argue reasonable expectation from product type, price and purpose.
- Claim against the seller, not the manufacturer, for contract remedies.
- Remember the one-year presumption, extended to two in some Member States.
- For continuous supply, the seller carries the burden throughout the supply period.
For traders and manufacturers:
- State the support period clearly and meet it.
- Remember that producer statements bind the seller through Article 7(1)(d).
- Use Article 7(5) properly if a characteristic deviates — specific information and separate express acceptance.
- Determine the Cyber Resilience Act support period on the recital 59 factors and keep the supporting analysis for market surveillance authorities.
- Assume five years unless the product's expected use is genuinely shorter; assume longer for infrastructure-type products.
- Provide clear update instructions to preserve the Article 7(4) defence.
Conclusion
EU law does not give one number, but it is converging on one. The Sale of Goods Directive ties updates to conformity and to reasonable expectation; advertised support commitments are contractually binding on the seller; and the Cyber Resilience Act sets a manufacturer-side benchmark of not less than five years, longer where the product is expected to be in use for longer.
For a consumer, the practical sequence is: what was promised, then what is reasonable for this kind of product, then the two-year liability floor and the one-year presumption. For a manufacturer, the safest approach is to state a support period at or above five years and honour it — because that figure now anchors both the regulatory obligation and the consumer's reasonable expectation.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.