Eu Cyber Resilience Act Cra Cost

Scope and evidence must be confirmed before any paid tests or filings.

CRA compliance cost: what to budget

There is no single EU Cyber Resilience Act (CRA) price or mandatory certification fee for every product. Budget the product-specific work, the assessment route and security support after launch separately. A CE mark is not a purchased CRA certificate.

Is there an official CRA fee?

Regulation (EU) 2024/2847 does not prescribe one EU-wide tariff for the manufacturer’s internal assessment or CE marking. An internal-control route does not automatically require a paid notified body. Where third-party assessment is required, obtain a scope-specific commercial quotation; testing and consultancy are separate purchases. No reliably sourced universal euro estimate is stated here.

Article 14 reporting obligations apply from 11 September 2026, including to products already made available in the EU. Most other obligations apply from 11 December 2027. A budget prepared in 2026 should fund reporting operations now, not treat all work as a 2027 expense.

First classify the product: the assessment route changes the bill

Under Article 32, assess the product’s core functionality against Annexes III and IV and the official technical descriptions. These are budget routing rules, not a substitute for a formal classification.

Product route	Possible conformity pathway	Budget consequence
Default products	Manufacturer internal control (module A) is generally available.	Internal risk assessment, engineering evidence and documentation; outside testing may be useful but is not automatically mandatory.
Important class I	Internal control only where applicable harmonised standards, common specifications or a qualifying EU cybersecurity certification scheme are used; otherwise notified-body assessment. Check special open-source exception.	Price both a documented self-assessment route and an external assessment contingency until the route is verified.
Important class II / critical	Third-party notified-body assessment or, where legally available and applicable, a recognised EU cybersecurity certification route. Check the precise conditions and open-source exception for important products.	Request the correct assessment scope, module, product variants and retest terms; do not assume self-declaration is sufficient.

Build a cost ledger before asking for a quote

Separate one-off development costs from recurring lifecycle costs; record owner, units and evidence for each item.

Cost line	What drives it	What to request
Classification and gap review	Intended use, core security functions, components and existing controls.	Written scope, regulatory route and assumptions.
Remediation and technical file	Secure design, risk analysis, vulnerability processes, supplier evidence, user instructions.	Work packages, person-days, acceptance criteria.
Verification and retesting	Threat surface, interfaces, test environment, samples, number of firmware/software versions.	Test plan, sample count, defect triage and retest price.
External conformity assessment	Only if the applicable route calls for it or it is selected; module B+C or H may differ.	Body’s CRA notification/scope, deliverables, surveillance and change fees.
Production and release control	Manufacturing sites, outsourced development, variant management, release gates.	Which site or process checks are included; no assumed universal factory audit.
Post-market security and EU roles	Support period, monitoring, updates, incident reports and any actual representative/importer services.	Annual owner and service-level budget; specify contractual role.

Three budgeting scenarios—not price promises

Single ordinary software product with mature security processes — Lower external assessment exposure may be possible; most spend is gap closure, evidence and a staffed reporting/update process.
Class I product with uncertain standards coverage — Carry two scenarios: eligible documented internal control versus notified-body review if conditions are not met. Resolve standards status before signing a fixed fee.
Class II connected device family with frequent firmware releases — Plan for third-party assessment or an available qualifying scheme, representative models/samples and a priced change-and-retest mechanism; assess the reuse that can be justified across variants.

A quote-ready information pack

A defensible quotation needs these inputs; without them a number is a non-binding assumption.

Manufacturer, trademark, EU supply route, named importer/representative if relevant and allocation of responsibilities.
Product description, intended purpose, core functions, connectivity, deployment environment and affected markets.
Proposed CRA class with rationale; known harmonised standards, common specifications or certification scheme and their verified applicability.
Hardware/software versions, variants, suppliers, software bill of materials (SBOM), third-party and remote-processing dependencies.
Existing risk assessment, test results, incident response, vulnerability disclosure, security-update and technical-file evidence.
Support period, release calendar, likely substantial modifications, expected test samples and available internal staff.

Sequence the spend and prevent repeat work

Freeze the product boundary and record uncertainty about CRA scope or category; do not buy certification first.
Choose the lawful assessment pathway and check current standards/scheme availability; validate notified-body authority for the precise scope.
Reuse credible prior security evidence, then price only the documented gaps and required independent work.
Agree test entry criteria, version/sample count, retest triggers, change handling and quote exclusions in writing.
Ring-fence recurring monitoring, security fixes, support and Article 14 reporting capacity from the one-off launch budget.

Compare quotes and account for ongoing cost

Ask each supplier to separate fixed deliverables, optional work, internal labour, travel/site activity if justified, retests, certificate or surveillance costs if applicable, taxes and post-launch support. A “CRA certificate for €X” without the product category, route and assessment scope is not a reliable comparable quote.

For implementation deliverables see CRA implementation services; for deciding the classification and strategy see CRA classification advice; costs of other CE regimes belong under CE marking cost. These are different questions, not interchangeable CRA price lists.

Official sources

Questions about CRA compliance cost

Is CE marking or a CRA declaration subject to a fixed EU payment?

The CRA does not set one general payment for affixing the CE marking or drawing up the EU declaration. Internal work still costs money; a notified body may charge when its assessment is used.

Do I have to buy laboratory testing for a class I product?

Not automatically. Confirm whether lawful self-assessment conditions are met and what technical evidence proves conformity. An independent test can be useful even where not expressly obligatory.

Can one assessment cover a whole product family?

Only to the extent justified by the chosen procedure, documented shared architecture, differences and assessment body’s accepted scope. Price model variants, firmware changes and potential retests explicitly.

Does a non-EU manufacturer always have to pay an EU authorised representative?

Do not assume so. An authorised representative under the CRA can be appointed by written mandate; importer and other EU economic-operator responsibilities must be assessed separately for the actual supply model.

Why budget for vulnerabilities before December 2027?

Article 14 reporting duties already apply from 11 September 2026. Budget operational readiness, while remaining general product requirements principally apply from 11 December 2027.