Support period decision (Article 13(8))

Product: COOK version 2.0.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Article 13(8): the support period reflects the length of time the product is expected to be in use, taking into account reasonable user expectations, the nature of the product including its intended purpose, and relevant Union law determining the lifetime of products; the manufacturer may also consider support periods of similar products by other manufacturers, the availability of the operating environment, the support periods of integrated third-party components providing core functions, and ADCO and Commission guidance. It is at least five years unless the product is expected to be in use for less, in which case it corresponds to the expected use time. The information taken into account goes into the technical documentation (Annex VII, point 4). Guidance C(2026) 5252, section 5, paragraphs 125 to 131: five years is a floor, not a default; each substantially modified software version carries its own declared support period; Article 13(10) lets the manufacturer remediate only the latest version where users can upgrade free of charge without additional costs.

Decision

• Support period: 5 years from first placing on the market (2026-07).
• End date shown at the time of purchase (Article 13(19), month and year at least): [HUMAN: YYYY-MM].
• Rationale (Annex VII, point 4): [HUMAN: why this period: user expectations, product nature, comparable products, operating environment (for example Android version support), third-party component support (for example the SDKs and runtime below)]

Factors from the repository

• Operating environment: Expo / React Native, Android.
• Core third-party components whose own support matters: wallet and blockchain: @meteora-ag/dynamic-bonding-curve-sdk, @pump-fun/pump-sdk, @solana-mobile/mobile-wallet-adapter-protocol-web3js, @solana/web3.js; cryptography: buffer, react-native-get-random-values; device capabilities (camera, location, contacts, media): expo-clipboard, expo-file-system, expo-image-picker, expo-sharing; local storage: expo-secure-store.
• Release cadence: 480 commits, 2 recent tags, last commit 2026-10-15.

Obligations that follow

• Handle vulnerabilities per Annex I, Part II for the whole period (Article 13(8)).
• Keep each issued security update available for at least 10 years after issue or the rest of the support period, whichever is longer (Article 13(9)).
• Where technically feasible, notify users when the support period ends (Article 13(19), second subparagraph).
• Keep the technical documentation and the declaration for at least 10 years after placing on the market or the support period, whichever is longer (Article 13(13)).
• Inform authorities and users before ceasing operations (Article 13(23)).