After the attack: five years of security updates, as a rule. The EU line for connected physical AI.

A robot can work on a factory floor for years. How long must its maker keep it safe from attackers?

In Europe, the Cyber Resilience Act sets a floor. Article 13(8):

the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.

The maker sets the period to match how long people will really use the product. Five years is the floor for any product expected to last that long.

Article 13(9) goes further. Each security update stays available "for a minimum of 10 years or for the remainder of the support period, whichever is longer".

Annex I Part II adds two rules for how fixes ship. They must reach users free of charge, in general. And they shall come apart from feature updates, where technically feasible:

where technically feasible, new security updates shall be provided separately from functionality updates

For a physical AI, that second rule matters. A feature update can change how the robot moves. A security fix shouldn't.

These duties apply from 11 December 2027. They don't apply today. The reporting clocks already do.

Now connect it to liability. The new Product Liability Directive names one defect source directly: "a lack of software updates or upgrades necessary to maintain safety". From 8 December 2026, if that's within the maker's control, the maker can't escape liability for it. So the support period isn't only a security promise. It's the time a maker can show it kept the robot safe.

The US has no general rule like this. Medical devices come closest. Section 524B asks makers to provide updates and patches "on a reasonably justified regular cycle". For consumer devices, the FCC's voluntary label asks, among other things, for a disclosed support period, or a statement that the device is unsupported.

Here's the honest limit. The CRA doesn't name robots. It covers products with digital elements and a data connection. A connected robot fits that. An offline one might not.

Bottom line: from December 2027, a connected robot sold in Europe will need a security support period that matches its expected use. Five years, if it's built to last that long. Does that cover the AI model inside? The Act doesn't mention AI models.

Robot makers: what support period will you print on the box?

Part 11 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.

@misc{melchior2026security,
  author       = {Melchior, Mati},
  title        = {{After the attack: five years of security updates, as a rule. The EU line for connected physical AI.}},
  howpublished = {Physical AI Safety},
  year         = {2026},
  month        = nov,
  date         = {2026-11-04},
  url          = {https://physical-ai-safety.com/blog/security-updates-for-a-robots-whole-life}
}