Skip to main content

Support period (Annex II)

Draft — not customer-binding until legal and commercial sign-off. Duration, clock start, SKU coverage, and how “free of charge” security updates sit next to a support subscription are TBD.

CRA Annex II requires manufacturers to state the security-update support period with the product. Art. 13 requires the manufacturer to determine and state that period (five years is the usual expectation unless a shorter period is justified by the nature of the product). This page is the collected draft, not a signed Annex II statement.

Proposed wording (unsigned)​

Roasthubs provides security updates for a minimum of five (5) years, measured from the later of:

  1. Date of delivery (handover / go-live of the commissioned IPC), or
  2. Date of the last major version of Roasthubs software installed under that contract.

During the period, security remediation updates would be without additional charge for the security fix itself. Feature work, hardware replacement, and custom engineering remain under the commercial contract. Operational delivery of updates may still require an active support or remote-access relationship.

From existing SLA / lifecycle answers (confirm before reuse as Annex II):

  • OS end-of-life notice: at least 12 months.
  • Hardware lifecycle review: annual for support-contract customers.
  • OS upgrades: included in the support contract (manual remote).
  • Security updates: monthly under Enterprise support when a maintenance window can be agreed.
  • Hardware replacement: not included in the support contract.

Full draft in git: rhsos-infra/docs/support-period.md. Notion: Support Period (CRA Annex II).

See also secure updates and SBOM (retain release assets for the support period).