Product Security Support for the Cyber Resilience Act (CRA)

In 2024, the European Union introduced the Cyber Resilience Act (CRA), a new regulatory framework that requires all digital products with network connectivity to implement enhanced cybersecurity measures across the entirety of a product's lifecycle.

Under the CRA, manufacturers must implement security requirements, manage vulnerabilities, report incidents, and maintain a Software Bill of Materials (SBOM) from both the design and development stages through to post-shipment maintenance and updates. Ensuring product reliability and transparency is a core objective of this regulation.

Furthermore, the CRA enforces manufacturers to provide security updates, disclose vulnerability information, and clearly define the support period during which security updates will be delivered. This makes transparency regarding product security lifecycles a critical element.

In response to these global regulatory developments, Ricoh will disclose the security support periods (vulnerability response periods) for each of our products.

This initiative is designed to:

To ensure transparency, Ricoh already publishes information on product vulnerabilities. Details can be found on the page below.

The information disclosed here is limited to the vulnerability response periods, as required under the CRA, for products that are currently on the market.

It does not represent our company’s comprehensive strategy for full CRA compliance. Our overall approach to CRA compliance is currently under review, and we will provide further updates once preparations are complete.

Please note that the information published here represents only part of our ongoing efforts and could be subject to changes or updates in the future.

The security support periods indicated on this page represent our current plans and may be extended at our discretion.

The security support periods for MFPs and printers are as follows: