Agent Wranglers

IOT-35Recommended

Publish the support end date for every model

Publish, for each model, the date until which it gets security updates, as a calendar date. Show it on the product page, in the app and through the device's own status. Extend it when you can, and never shorten it.

By Agent Wranglers. Updated .

How to do it

Buyers compare how long a device stays safe, and some laws now ask for this date. ETSI EN 303 645 provision 5.3-13 asks manufacturers to publish the defined support period. The UK PSTI regulations have required it since 29 April 2024 and count a shortened period as a breach. The Cyber Resilience Act sets the minimum length, which handle vulnerabilities for the whole support period states. Record for each model whether that law covers it, as decide whether the Cyber Resilience Act covers your product says, and keep its technical file. Certificates must last at least as long, as plan certificates for the device's whole life says.

Examples

Python example

from datetime import date

def support_dates_match(registry_date: date, product_page_date: date, device_status_date: date) -> bool:
    return registry_date == product_page_date == device_status_date

def may_change_support_end(old: date, new: date) -> bool:
    return new >= old

Go example

func SupportDatesMatch(registry, productPage, deviceStatus time.Time) bool {
	return registry.Equal(productPage) && registry.Equal(deviceStatus)
}

func MayChangeSupportEnd(old, proposed time.Time) bool {
	return !proposed.Before(old)
}

How to check

Every model in the registry has a support end date. A test fetches each product page and the device status endpoint and finds the same date. A change that moves a date earlier fails review.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/support-end-date">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.