A manufacturer with 20 to 50 staff should budget about €96,000 per product line to reach Cyber Resilience Act conformity by 11 December 2027 when Module A self-assessment is open, and about €141,000 when a notified body must assess the product. Engineering fixes for the Annex I Part I requirements are the largest cost line in both routes.
The figures are a CVD Portal PERT estimate, in 2026 euros without VAT, for one product line at Western European labour rates. They assume that the Article 14 reporting process has been in place since 11 September 2026. Every input is in the tables below, so a finance team can replace each one with its own number.
Key takeaways
- The conformity route changes the budget by about €45,000 per product line, so the product classification must come before the budget.
- On 5 November 2026 no harmonised standard under Regulation (EU) 2024/2847 was cited in the Official Journal, and the CEN project records expect no citation for EN 40000-1-1 and EN 40000-1-2. A budget for an important Class I product should therefore carry the notified body route.
- On 5 November 2026 the NANDO database listed no notified body under the CRA, so the fee for EU-type examination has no public price yet. This estimate uses the Commission impact assessment figure of €25,000 per product as the most likely value.
- Engineering fixes for Annex I Part I have an expected cost of €39,200 and the widest spread of any cost line, with a standard deviation of €10,800.
- No proposal to delay the 11 December 2027 date was on the table on 5 November 2026. The Digital Omnibus of 19 November 2025 does not amend the CRA.
What must be in place by 11 December 2027?
From 11 December 2027 a product with digital elements placed on the EU market must meet the essential requirements of Annex I and carry a completed conformity assessment, an EU declaration of conformity and the CE marking. Article 71(2) sets that date, after Article 14 reporting on 11 September 2026 and the notified body rules of Chapter IV on 11 June 2026.
The work has eight parts, and each part maps to one or more cost lines in the model.
| Obligation | Where in the CRA |
|---|---|
| Cybersecurity risk assessment, kept up to date | Article 13(2) and (3) |
| Product security properties, from secure defaults to secure updates | Annex I Part I |
| Vulnerability handling, including an SBOM and security updates | Annex I Part II |
| Support period of at least five years, or the expected use time if shorter | Article 13(8) |
| Information and instructions for the user | Annex II |
| Technical documentation | Annex VII |
| Conformity assessment by the route for the product class | Article 32 |
| EU declaration of conformity and CE marking | Articles 28 and 30, Annex V |
A product line that stays on sale after 11 December 2027 needs this work for every unit placed on the market from that date. Units placed on the market before that date need it only after a substantial modification (Article 69(2)). Article 14 reporting applies to them in either case (Article 69(3)).
Which conformity route does the product take?
The product class decides the route. Article 32 gives four cases, and Commission Implementing Regulation (EU) 2025/2392 describes the categories of important and critical products in technical terms.
| Product class | Conformity route under Article 32 | Notified body | Route in this model |
|---|---|---|---|
| Default (outside Annex III and IV) | Module A, or Module B+C, Module H or a certification scheme by choice (Article 32(1)) | No | Module A |
| Important, Class I (Annex III Part I) | Module A only with full application of a cited harmonised standard, a common specification or a certification scheme at level substantial. Otherwise Module B+C or Module H (Article 32(2)) | Yes, while no fitting standard is cited | Notified body |
| Important, Class II (Annex III Part II) | Module B+C, Module H, or a certification scheme at level substantial (Article 32(3)) | Yes | Notified body |
| Critical (Annex IV) | A certification scheme under an Article 8(1) delegated act, or else the Class II procedures (Article 32(4)) | Yes | Outside this model |
Module A self-assessment is open to default-class products. Annex III Class I products need a notified body or a European cybersecurity certification scheme for as long as no CRA harmonised standard is cited in the Official Journal. Class II and critical products always need one.
The Class I condition is strict. Commission guidance C(2026) 5252 of 27 July 2026 says in paragraph 149 that the manufacturer must apply all the applicable requirements of the standard, and that the standard's scope must cover "at least all the cybersecurity risks associated to that product's core functionality".
On 5 November 2026 the Commission's list of harmonised standards for Regulation (EU) 2024/2847 had no entry. CEN ratified EN 40000-1-1 and EN 40000-1-2 on 2 November 2026, and the CEN project records for both say "No citation expected for Directive 2024/2847". The record for prEN 40000-1-3, the vulnerability handling part, says a citation is expected. The product-specific standards were drafts in public enquiry in autumn 2026, and no primary source gives a citation date for them. A Class I budget built on Module A is therefore a bet on a citation that has no date.
How was the estimate built?
The estimate uses PERT, the same method as the CVD Portal estimate for the September 2026 deadline. Each task gets three values, optimistic (O), most likely (M) and pessimistic (P).
E = (O + 4M + P) / 6
σ = (P − O) / 6
The expected values add up to the total. The variances add up too, and the total standard deviation is the square root of their sum. The 90% interval is E ± 1.645σ.
The model rests on five assumptions.
- Company. A manufacturer with 20 to 50 staff, one product line with embedded software and a network interface, and some secure development practice already in place.
- Internal rate. €500 per person-day. Eurostat puts the 2025 hourly labour cost in the ICT sector at €58.50 in Germany and €59.20 in France, which is about €470 for an eight-hour day. The 2026 estimate used the same €500, so the two budgets compare directly.
- External rate. €1,200 per person-day for penetration testing and regulatory review. The German go-digital funding guideline of December 2021 capped a funded consultant day at €1,100 net.
- Article 14. The reporting process from 2026 is in place. Its cost was estimated at €39,700 and is outside this budget.
- Independence. Each task is estimated on its own. The variance section below explains why this makes the interval too narrow.
What does the Module A route cost?
The Module A route has an expected cost of €96,100 per product line, with a standard deviation of €11,700 and a 90% interval of €76,800 to €115,400. Internal work is €76,700 of the total.
| # | Task | O (€) | M (€) | P (€) | E (€) | σ (€) |
|---|---|---|---|---|---|---|
| 1 | Scope and classification check (2, 4, 8 days) | 1,000 | 2,000 | 4,000 | 2,167 | 500 |
| 2 | Cybersecurity risk assessment (8, 15, 30 days) | 4,000 | 7,500 | 15,000 | 8,167 | 1,833 |
| 3 | Annex I Part I gap analysis and applicability (5, 10, 20 days) | 2,500 | 5,000 | 10,000 | 5,417 | 1,250 |
| 4 | Engineering fixes for Annex I Part I gaps (30, 70, 160 days) | 15,000 | 35,000 | 80,000 | 39,167 | 10,833 |
| 5 | Vulnerability handling additions, SBOM and update delivery (6, 12, 25 days) | 3,000 | 6,000 | 12,500 | 6,583 | 1,583 |
| 6 | External penetration test (5, 8, 15 days) | 6,000 | 9,600 | 18,000 | 10,400 | 2,000 |
| 7 | Technical documentation, Annex VII (10, 18, 35 days) | 5,000 | 9,000 | 17,500 | 9,750 | 2,083 |
| 8 | User information and support period (2, 4, 8 days) | 1,000 | 2,000 | 4,000 | 2,167 | 500 |
| 9 | EU declaration of conformity and CE marking (1, 2, 4 days) | 500 | 1,000 | 2,000 | 1,083 | 250 |
| 10 | External regulatory review (2, 4, 8 days) | 2,400 | 4,800 | 9,600 | 5,200 | 1,200 |
| 11 | Training (2, 4, 8 days) | 1,000 | 2,000 | 4,000 | 2,167 | 500 |
| 12 | Tooling, first year | 1,000 | 3,000 | 10,000 | 3,833 | 1,500 |
| Total | 42,400 | 86,900 | 186,600 | 96,100 | 11,732 |
Line 4 decides most of the spread. Annex I Part I asks for properties that a product either has or lacks, such as secure boot, signed updates, no default password and a limited attack surface. A product with a signed update chain already in place lands near the optimistic value. A product that needs a new update mechanism lands near the pessimistic one.
Line 6 sits inside the testing range of the Commission's 2021 supporting study, which quotes €7,000 to €15,000 for a simple internet-connected product and €20,000 to €30,000 for a complex one.
Line 12 covers SBOM generation and vulnerability monitoring. OWASP Dependency-Track is free. Commercial composition analysis tools publish list prices of about $20 to $50 per developer or per project per month.
What does a notified body add?
A notified body adds about €44,800 per product line, and the route then has an expected cost of €140,900, with a standard deviation of €13,600 and a 90% interval of €118,500 to €163,300.
| # | Task | O (€) | M (€) | P (€) | E (€) | σ (€) |
|---|---|---|---|---|---|---|
| 13 | Notified body fee, EU-type examination (Module B) | 15,000 | 25,000 | 50,000 | 27,500 | 5,833 |
| 14 | Preparation for the notified body and answers to findings (8, 15, 35 days) | 4,000 | 7,500 | 17,500 | 8,583 | 2,250 |
| 15 | Fix and retest round after findings (5, 15, 40 days) | 2,500 | 7,500 | 20,000 | 8,750 | 2,917 |
| Total with lines 1 to 12 | 63,900 | 126,900 | 274,100 | 140,933 | 13,610 |
No notified body had a public CRA fee on 5 November 2026, because none was notified. The fee values come from the two Commission sources. The impact assessment SWD(2022) 282 uses €25,000 per product for third-party assessment, built from French CSPN certification at €25,000 to €35,000, Dutch BSPA assessment at about €40,000 and Radio Equipment Directive costs. The 2021 supporting study gives €15,000 to €50,000.
Article 32(6) requires fees for conformity assessment procedures to be reduced in proportion to the interests and needs of SMEs. No notified body has published how it applies that rule, so the model gives no discount.
How does the estimate compare with the Commission figures?
The model lands close to the Commission impact assessment where the two measure the same work.
| Cost item | Commission impact assessment (2022) | This model, expected value |
|---|---|---|
| Secure development | 30.5% of an average development cost of €140,000, so €42,700 per product | Line 4, €39,167 |
| Self-assessment | €18,400 per product, one-off and recurrent | Lines 2, 3, 7, 8 and 9, about €26,600 |
| Third-party assessment | €25,000 per product | Line 13, €27,500 |
| Documentation and reporting | 9% of development cost, so €12,600 per product | Line 7, €9,750. Reporting sits in the 2026 Article 14 budget |
The impact assessment is the best public anchor and it is weak in three places. The €140,000 average development cost rests on two web sources. The targeted survey had 24 valid responses. Annex 4 says that the quantitative cost estimates "could not be triangulated and verified". Use the Commission figures to test a budget, and use your own development cost to set one.
What does the variance hide?
The interval assumes that tasks are independent, and they are not. A risk assessment that misses a threat sends the gap analysis, the engineering fixes, the technical documentation and the notified body review back for a second round. The 2026 estimate put that effect at 30 to 50% on the upper end.
A board figure should therefore hold a reserve of 20 to 30% above the expected value. That is €19,000 to €29,000 on the Module A route and €28,000 to €42,000 on the notified body route. The notified body route carries one more risk that money cannot remove, which is the date of the first available examination slot.
What moves the number?
Four factors move the total more than any single task.
- Starting maturity. The impact assessment assumes that 50% of manufacturers already practise secure development. A product with signed updates, unique credentials and an SBOM already in the build moves line 4 toward €15,000.
- Labour location. Eurostat's 2025 ICT-sector labour cost per hour is €29.30 in Poland, €34.80 in Spain, €38.40 in Italy, €58.50 in Germany and €62.50 in Sweden. Scale the €76,700 of internal work by your own rate.
- Number of product lines. Lines 1, 10, 11 and 12 are shared across the company and come to €13,400. Most of the other €82,700 repeats for each further product line, less what a shared code base lets you reuse.
- Product class. The route decides whether lines 13 to 15 exist at all, which is the €44,800 difference above.
When does the money go out in 2027?
The spend follows the order of the work, and the notified body sets the end date.
| Quarter | Work | Lines |
|---|---|---|
| Q1 2027 | Scope and classification, risk assessment, gap analysis, training. Contact a notified body as soon as one is notified | 1, 2, 3, 11 |
| Q2 and Q3 2027 | Engineering fixes, vulnerability handling additions, tooling, penetration test | 4, 5, 6, 12 |
| Q3 2027 | Technical documentation and user information. EU-type examination for the notified body route | 7, 8, 13, 14 |
| Q4 2027 | Fixes after findings, regulatory review, declaration of conformity and CE marking before 11 December | 9, 10, 15 |
On 5 November 2026 NANDO listed 16 notifying authorities in 15 Member States and no notified body under the CRA. Article 35(2) asks Member States to "strive to ensure, by 11 December 2026" a sufficient number of notified bodies. A manufacturer on the notified body route should ask for an examination slot in Q1 2027, even before the technical documentation is complete.
What does the estimate leave out?
Five costs sit outside the two totals.
- Article 14 reporting, estimated at €39,700 in the 2026 budget and running since 11 September 2026.
- Critical products in Annex IV. No Article 8(1) delegated act required certification on 5 November 2026, so these products follow the Class II procedures (Article 32(4)).
- Other Union law for the same product, such as the Radio Equipment Directive.
- Recurring cost after placing on the market. The impact assessment puts recurrent self-assessment costs at €3,000 to €5,000 per product, and the recurrent part of third-party assessment at €7,500 a year. Security updates continue for the whole support period of at least five years.
- A real incident, a recall or a corrective action ordered by a market surveillance authority.
How can an SME lower the budget?
Two measures open on 5 November 2026 lower the cost for a small manufacturer, and a third lowers the risk.
- The SECURE open call 2 pays 50% of an SME project, up to €30,000, for a project of up to 180 days, and closes on 11 December 2026. Its Annex 2 excludes third-party CRA assessment, so the notified body fee is outside the grant. Work such as a gap analysis or a penetration test can be inside it. See CRA funding for SMEs for the terms.
- Article 32(6) requires fees for conformity assessment procedures to be reduced in proportion for micro, small and medium-sized enterprises. Ask each notified body for its SME fee before you choose one.
- Article 64(10) exempts micro and small enterprises from fines for a missed 24-hour early warning under Article 14. The exemption lowers the risk, and the cost of the reporting process stays the same.
Article 33(5) gives micro and small enterprises the right to a simplified form for the technical documentation. The Commission had not adopted that form on 5 November 2026, so the model gives no saving for it.
What should go into the 2027 budget now?
Set two numbers per product line and pick one by class.
- Classify each product line against Annex III and Annex IV with the free CRA product classifier.
- Enter €96,000 for each default-class product line and €141,000 for each Class I or Class II product line, with the reserve above.
- Replace the €500 internal rate and line 4 with your own figures before the budget is final.
- Apply to SECURE before 11 December 2026 if the company is an eligible SME.
- Ask for a notified body slot in Q1 2027 if any product line needs one.
CVD Portal supports lines 1, 2, 3, 5, 7, 8 and 9 in one workspace, from the classification to the declaration of conformity. For line 11, the free CRA course for manufacturers gives the training material, and the staff days stay in the budget. The CVD Portal subscription is line 12 spend. It checks the SBOM components for known vulnerabilities, and a build tool still generates the SBOM. For a product that needs a notified body, CVD Portal prepares the technical file and the Annex I evidence the assessment body asks for, and does not replace it. Start a trial to set up the first product line.
Sources
- Regulation (EU) 2024/2847, the Cyber Resilience Act, CELEX 32024R2847, Articles 13, 14, 28, 30, 32, 33, 35, 64, 69 and 71, Annexes I, II, V and VII. EUR-Lex
- Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 on the technical description of important and critical products. EUR-Lex
- European Commission, guidance on the Cyber Resilience Act, C(2026) 5252, annex, 27 July 2026, paragraph 149. European Commission
- European Commission, impact assessment SWD(2022) 282, 15 September 2022, Part 1 pages 39 to 48 and 82 to 84, Part 2 Annex 4. European Commission
- Study on the need of cybersecurity requirements for ICT products, supporting study to the impact assessment, 2021. European Commission
- European Commission, harmonised standards for Regulation (EU) 2024/2847, read on 5 November 2026. Single Market Compliance Space
- European Commission, NANDO notified bodies for Regulation (EU) 2024/2847, read on 5 November 2026. Single Market Compliance Space
- CEN and CENELEC project records, read on 5 November 2026, for EN 40000-1-1 (JT013095), EN 40000-1-2 (JT013089) and prEN 40000-1-3 (JT013090).
- Eurostat, labour cost levels by NACE Rev. 2 activity (lc_lci_lev), 2025, updated 23 April 2026. Eurostat
- SECURE project, second open call, Annexes 1 and 2. SECURE
- German Federal Ministry for Economic Affairs and Climate Action, go-digital funding guideline, BAnz AT 27.12.2021 B1, point 6.1.2. IHK Bonn copy
Frequently asked questions
How much does CRA conformity cost for one product line?
A CVD Portal PERT estimate for a manufacturer with 20 to 50 staff puts Cyber Resilience Act conformity by 11 December 2027 at about €96,000 per product line under Module A self-assessment, with a 90% interval of €76,800 to €115,400. With a notified body the expected cost is about €141,000, with a 90% interval of €118,500 to €163,300.
How much does a notified body cost under the CRA?
No CRA notified body fee was public on 5 November 2026, and NANDO listed no notified body under Regulation (EU) 2024/2847. The Commission impact assessment of 2022 estimates third-party assessment at €25,000 per product, and its 2021 supporting study gives €15,000 to €50,000. Article 32(6) requires fees for conformity assessment procedures to be reduced in proportion for SMEs.
Can an important Class I product use self-assessment in 2027?
Only when the manufacturer fully applies a harmonised standard cited in the Official Journal, a common specification or a European cybersecurity certification scheme at assurance level substantial (Article 32(2)). Commission guidance C(2026) 5252 adds that the standard must cover all the cybersecurity risks of the product's core functionality. On 5 November 2026 no CRA harmonised standard was cited.
What does CRA conformity cost after December 2027?
The Commission impact assessment of 2022 puts the recurrent operating cost of self-assessment at €3,000 to €5,000 per product, from a targeted survey. It splits third-party assessment into €17,500 one-off and €7,500 a year, a split that it says could not be corroborated. Article 13(8) sets a support period of at least five years unless the expected use time is shorter.