End of Support Dates Are Hidden

UK law already requires every connectable device to publish its end of support date. The objection is that a web page is enough for anyone who cares. It is not, because the buyer decides at the till, and that date sits where the buyer is least likely to look. Every connected device should print it at the point of sale.

Why the end of support date stays hidden

The end of support date stays hidden because the UK rule asks makers to publish it on a web page, not to show it in the shop, so a buyer at the shelf sees nothing the rule requires.

The UK product security regime came into force on 29 April 2024. Schedule 1, paragraph 3 says a maker must state the minimum security update period along with an end date, published clearly, without a request, free, and in English. Read that closely and the box is absent. So is the shelf. The buyer gets the date only from a page they must first think to open.

Ask who carries the cost of this gap. The maker has had two and a half years to comply, yet the shopper pays for the uncertainty at the till. A date that arrives after the purchase is a date the buyer cannot use to choose.

Four figures frame the gap, and each one answers a question a buyer has at the shelf.

Read the cards together. The compliance window is long and the conditions are many, yet the place a shopper stands appears in none of them. The 2.5 years is our own arithmetic from the April 2024 start date to October 2026, not a figure any regulator published. The end date is required, and still not required where it would change a purchase.

Does a device maker have to tell me when support ends?

Yes, if the product is a connectable device sold in the UK, the maker must state the minimum security update period together with an end date, but the law does not say where you will see it. That answer is the whole legal question in one line.

Schedule 1 paragraph 3 pairs the period with the date, which is the number a shopper needs. It does not fix the place, so the maker chooses it. For the same design in another rule, our piece on how the default password ban treats labels shows a floor set by law with the packaging left to the seller.

What is the minimum security update period under UK law?

Under the UK regime, the minimum security update period is the shortest support commitment the maker states for a connectable product, and it must come with an end date. The law makes the maker state it, not promise any particular length.

The figure belongs to the maker, not the regulator. Two phones sold side by side can carry very different commitments, and both can be lawful. That is the reason to compare the stated period rather than assume a standard. If you buy from the EU, the clock runs faster, as our note on the Cyber Resilience Act reporting deadline explains.

How long will my phone get security updates?

It depends on the period the maker has stated, which the law requires them to publish alongside an end date, and that figure can differ from one model to the next in the same brand range. Check the product page for that date before you buy, because the box will not tell you.

Two rules of thumb follow. Read the end date rather than the marketing, and when the page gives no date, treat the product as one with no promised support.

Which situation are you in?

The right step depends on whether you are buying a phone, a connected car part or something sold with no UK page at all, and the table sets out what to do in each case.

Scenarios matter because the rule treats a phone on a UK shelf differently from a car head unit, and the buyer needs to know which one is in front of them.

The default row matters most. A product with no date gives you no promise to rely on, and that is worth a question to the seller before you pay.

Where the rule runs out

The end-date rule has gaps, because some products sit on an exception list, a car carve-out is still being drafted, and a seller with no UK page leaves the buyer with nothing to check.

Schedule 3 lists excepted products, and automotive is expected to be carved out by a statutory instrument that is not yet in force. A connected car head unit can therefore fall outside the rule, and the buyer cannot tell which list applies from the showroom floor. Disclosure is thin elsewhere too, as our note on how few top domains publish a security.txt file shows.

• Check whether the product sits on the Schedule 3 exception list before relying on a date.
• Ask for the security update period in writing if the product page shows none.

Make the date a condition of the sale. If the product page shows no end date by the time you reach the till, ask the seller for it in writing, and walk away if they cannot give one this week.