Software Updates and Support

Support periods and the Cyber Resilience Act

Ask every vendor for a support end date in writing before you buy. In the EU, the Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements, which covers many connected robots. It requires manufacturers to handle vulnerabilities throughout a support period that reflects how long the product is expected to be used, at least five years unless the expected use is shorter, and to tell buyers when that period ends. Its main obligations apply from 11 December 2027, while the duty to report actively exploited vulnerabilities has applied since 11 September 2026. Outside the EU, no equivalent rule may apply, so treat the support period as a contract term and compare it with how long you plan to keep the robot.

Patching as planned maintenance

NIST's guide to enterprise patch management, Special Publication 800-40 Revision 4, describes patching as identifying, prioritising, acquiring, installing and verifying patches, updates and upgrades across an organisation, and compares it to preventive maintenance on fleet vehicles. It also calls patching a standard cost of doing business. Robots fit that model well. Keep an inventory of every robot's software, firmware and controller versions, subscribe to the vendor's security notices, and decide how quickly each class of update must be applied. Agree with the vendor how patches are delivered, whether over the air or by a technician, and whether security fixes come separately from feature updates, so you can take one without the other.

Rolling out updates without stopping work

An update that changes how a robot moves or reports can disrupt a whole shift. Ask for release notes before every update, and test it first on one robot or in a test cell running real tasks. Schedule fleet roll-outs for quiet periods and in stages, so a fault reaches a few robots rather than all of them. Make sure you can roll back to the previous version, and find out whether the vendor can push updates without your approval, because a forced update during a peak can be costlier than the bug it fixes. Recheck safety settings, maps and integrations after each update, and record the version each robot runs so faults can be traced.

Planning for the end of support

Every robot model reaches a point where the vendor stops releasing fixes. NIST's patch management guide warns that once software reaches end of life, a patch for a known vulnerability may never be released, and it advises planning other long-term mitigations for such assets. For robots, that can mean isolating them on a separate network segment, removing remote access, disabling unused services and limiting who can connect. Put commercial protections in the contract too: notice of end of support, a final software release, offline operation without cloud services and, for critical fleets, a software escrow arrangement in case the vendor ceases trading. Then decide in advance when a robot without updates should be retired.

Sources and further reading

• Regulation (EU) 2024/2847, the Cyber Resilience Act — EUR-Lex, European Union.
  EU rules for products with digital elements, including support periods and how makers handle vulnerabilities.
• NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning — National Institute of Standards and Technology.
  NIST guidance treating patching as preventive maintenance, with risk options for end-of-life software.

Common questions

Should robots be updated automatically?

Security fixes should be applied quickly, but fully automatic updates suit only low-risk robots. For robots in production or near people, prefer vendor notification followed by your own test and approval, so you control the timing and can check safety settings afterwards.

What happens if a robot maker stops supporting a model?

The robot usually keeps working, but new faults and security gaps go unfixed and cloud features may stop. Check your contract for notice and final-release terms, contain the robot on its own network, and start planning a replacement before parts and skills also become hard to find.