FAQ/Manufacturer: what is the support period for a software framework/platform used to build end-user products?

[alpianon]

@kappapiana and I run into an issue while trying to address in advance some of the issues on the future compliance with the CRA.

In many contexts, complex software products are not assembled from scratch by combining existing third-party generic components with first-party specific components, but they are developed using dedicated software frameworks or platforms, which are designed to build specific types of end-user products.

Such frameworks and platforms do not consist only of "studio" tools used to design and build the final product, but also of runtime components that are actually included in the final product -- therefore such runtime components fall under the definition of PWDE provided by Art.3.1 or CRA as software components that are placed into the market, intended to be further included by other manufacturers in end-user products.

Both manufacturers and users of such frameworks and platforms ("users" which are in turn manufacturers of end-user products based on such frameworks and platforms) need to correctly determine their respective support period of what they place into the market based on Art. 13.8 of the CRA -- but this may create a recursion problem.

If "A" is a framework/platform manufacturer, A knows that it should determine the support period of its framework/platform "X" (including runtime components intended to be included in projects built with the framework/platform)

so that it reflects the length of time during which the product is expected to be in use, taking into account, in particular, reasonable user expectations, the nature of the product, including its intended purpose[...].

If A delivers X to end-user product manufacturer "B", A should take into account that B will reasonably expect to use framework X to develop product "Y" and to sell units of Y across a period of, say, 3 years; assuming that the expected lifecycle of each unit of Y is 5 years (the default value provided by Art.13.8), B will reasonably expect to get security support from A for at least 3+5=8 years in order to be able to provide support for all units of Y sold over 3 years.

Therefore, based on Art.13.8, A should determine its support period based on such expectation (8 years).

However, always according to Art. 13.8, when determining the support period for the end-user product Y, manufacturer B

may also take into account [...] the support periods of integrated components that provide core functions and are sourced from third parties [...]

that is, in this example, the support period of the framework/platform X.

This a potential recursion: the support period of the framework X should be determined based on the (expected) support period of the end-product Y, but the support period of Y "may" be determined based on the support period of X.

It should be clarified that when integrated components constitute a framework/platform intended to build specific types of end-user products, it is the framework/platform manufacturer that should determine its support period based on the reasonably expected lifecycle and selling period of the typical end-user products built on its framework/platform, and not the other way around; it should be also clarified that the default support period of 5 years does not apply to frameworks/platforms, which should normally have a longer support period because of their nature (also based on Recital 60)¹

Footnotes

1. "Where the time the product with digital elements is reasonably expected to be in use is longer than five years, [...] manufacturers should accordingly ensure longer support periods". ↩