An additional regulation that will come into effect soon (fully only in 2027) is the Cyber Resilience Act which will require all manufacturers to provide at lea

An additional regulation that will come into effect soon (fully only in 2027) is the Cyber Resilience Act which will require all manufacturers to provide at least security updates for however long a "reasonable user" expects to get security updates. The recitals say: "In determining a support period, a manufacturer should take into account in particular reasonable user expectations, the nature of the product, as well as relevant Union law determining the lifetime of products with digital elements." and "The support period for which the manufacturer ensures the effective handling of vulnerabilities should be no less than five years, unless the lifetime of the product with digital elements is less than five years[...]" So....it's a bit up to us to ask vendors for updates for older devices so that we can maybe slowly move the baseline of what a "reasonable user expectation" is.