Learn
There is one official number for Cyber Resilience Act compliance cost: EUR 29 billion, the Commission's estimate of the total burden on businesses under the option it chose. It is widely quoted and rarely divided, which is a shame, because the division is where the useful part is. The same impact assessment counts 615,272 manufacturers and products in scope, on a market it values at up to EUR 1,485 billion in turnover. Divide EUR 29 billion by 615,272 and the average lands near EUR 47,000 per manufacturer. Divide it by the turnover instead and you get roughly 2 percent.
Those two divisions do different work. The EUR 47,000 tells you the order of magnitude for a single manufacturer with a single product. The 2 percent tells you what the regulator thought it was asking the sector to absorb. Neither is a quote, and the build up underneath them is more useful than either.
| Cost line | Commission figure | What it assumes |
|---|---|---|
| Average product development cost | EUR 140,000 | The unit the whole model is built on, per product with digital elements. |
| Secure development uplift | 30.5% | Additional development cost where no comprehensive cybersecurity measures are in place. |
| That uplift in money | EUR 42,700 | 30.5% of EUR 140,000, on one average product. |
| Self assessment | EUR 18,400 | Per self tested product, about two staff months. |
| Third party assessment | EUR 25,000 | Per product, where a conformity assessment body is required. |
What does Cyber Resilience Act compliance cost?
For a manufacturer with one product and nothing in place, the Commission's own model implies roughly EUR 42,700 of secure development work plus EUR 18,400 of self assessment, so a little over EUR 60,000 before documentation. For a manufacturer whose product needs a third party conformity assessment, swap the EUR 18,400 for EUR 25,000 and add the calendar time of a notified body queue.
Those figures move on three inputs and almost nothing else: how many products with digital elements you place on the EU market, how each is classified, and how much secure development you already do. The Commission assumed half of manufacturers already have a systematic approach to secure product development. If you are in that half, the EUR 42,700 line largely does not apply to you. If you are not, it is the biggest number in your budget.
The one official estimate, and the division most articles skip
SWD(2022) 282, the impact assessment of 15 September 2022 that accompanied the CRA proposal, priced several policy options. Sub-option 4(b)(ii), covering the full software and hardware markets with third party assessment for critical products, came out at EUR 29 billion. It breaks into three lines.
| Cost line | Estimate | What it covers |
|---|---|---|
| Secure product development | EUR 13.13 billion | The Annex I engineering work: building products that ship without known exploitable vulnerabilities and can be updated. |
| Conformity assessment | EUR 8.1 billion | EUR 7 billion of self assessment plus EUR 1.1 billion of third party assessment. |
| Other conformity obligations | EUR 7.8 billion | Technical documentation, the declaration of conformity, CE marking, and reporting to ENISA. |
| Total | EUR 29 billion | Adjustment and administrative costs on businesses, EU wide. |
Two things about the third line deserve saying out loud, because nobody else says them. The EUR 7.8 billion rests on an assumption that documentation and reporting cost 9 percent of product development, and the impact assessment itself records that this came from a survey estimate which could not be verified. It is the least solid number in the table, and it is a quarter of the total. Treat the paperwork line as the one most likely to be wrong in either direction.
The comparison the Commission drew is the part worth taking to a board. It estimated that the same option would cut the cost of security incidents affecting companies by roughly EUR 180 billion to EUR 290 billion a year, and noted that the upper bound alone is around ten times the compliance cost. That is a policy argument rather than a business case for your firm, but it is the frame the regulator is working in.
What the other results get wrong
Three errors are repeated across the pages that rank for this query.
The EUR 29 billion gets quoted without the denominator. A headline aggregate for an entire EU market tells a manufacturer nothing. The impact assessment publishes the population it is spread over, 615,272 manufacturers and products, and doing that division yourself is a thirty second exercise that turns an unusable number into a usable one.
Per product costs get presented as per company costs. The Commission's model assumes one product per manufacturer, and says so, while acknowledging that large companies might develop hundreds. If you place twelve products on the market, the EUR 47,000 average is not your number. Neither is twelve times it, if those twelve products share a platform.
The support period is missing from almost every budget. Article 13(8) requires manufacturers to determine a support period reflecting the product's expected use time, and it must be at least five years unless the product is expected to be in use for less. That is five years of vulnerability handling and security updates per product, and the impact assessment's per product figures do not capture it as a separate recurring line.
Why classification is the biggest single lever
The difference between EUR 18,400 and EUR 25,000 per product looks small. The difference in calendar time does not. Self assessment closes when your own team finishes. A third party assessment closes when a conformity assessment body has capacity, and capacity is finite across the whole EU while every manufacturer is working to the same 2027 date.
The Commission assumed third party assessment would apply to about 10 percent of products, those considered critical. If your portfolio sits above that share, your cost profile is not the average one and your schedule is the constraint rather than your budget. Our guide to who must comply with the Cyber Resilience Act covers how the classification test works, and how long CRA compliance takes covers what the queue does to a plan.
What the estimate does not include
Four things, and together they are the difference between a project budget and an operating budget.
Familiarisation
The impact assessment states plainly that familiarisation costs for manufacturers, importers and distributors could not be estimated but would occur under every option. For a distributor with a wide catalogue, working out which products are in scope is the whole cost.
The support period
At least five years of vulnerability handling per product under Article 13(8), plus the Article 13(19) duty to specify the end date of the support period, at least the month and the year, clearly at the time of purchase. A product line with a ten year life carries ten years of this.
Reporting readiness
Article 14 reporting for actively exploited vulnerabilities and severe incidents applies from 11 September 2026, over a year ahead of the main obligations on 11 December 2027. Being able to file inside the clock is an on call rota and a rehearsed process, not a document.
Getting it wrong
Not a compliance cost, but it belongs in the same conversation: the Article 64 ceilings reach EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher. We set out the tiers in Cyber Resilience Act fines and penalties.
Who actually carries this?
Mostly small companies. The impact assessment records that 99.58 percent of enterprises in the market for products with digital elements are SMEs, while SMEs generate about 34.4 percent of its turnover. The cost model, though, is per product: EUR 42,700 of secure development and EUR 18,400 of assessment are the same numbers whether the manufacturer has eight employees or eight thousand.
That asymmetry is the real distributional story in the CRA, and it is why the smaller the manufacturer, the more the classification question is worth answering carefully before anything else is bought. There is one structural consolation, noted in the same document: one off self assessment costs are high because they require building internal capability, but the recurrent cost falls once that capability exists, whereas third party assessment carries a higher recurring cost every time.
Size your own CRA budget
Fill this in with the Commission's per product figures and your own portfolio. Any row you cannot complete is the first thing to go and find out.
| Question | Your answer | What to multiply it by |
|---|---|---|
| How many products with digital elements do you place on the EU market? | This is the multiplier for every line below. | |
| How many share a platform or a build pipeline? | Shared components collapse the secure development line. Ten products on one stack is not ten programmes. | |
| How many already ship with a systematic secure development process? | For those, the EUR 42,700 uplift largely does not apply. | |
| How many are Annex III important or Annex IV critical? | EUR 25,000 each rather than EUR 18,400, plus notified body lead time. | |
| What support period will you commit to per product? | At least five years of vulnerability handling, priced as an operating cost. | |
| Could you file an Article 14 report inside the clock today? | If not, this is a process to build, and it is already live. |
If most of those rows are blank, the useful next step is a baseline rather than a budget. A free compliance check will show you which CRA areas you can already evidence, and the CRA framework page sets out the controls behind each one.
Frequently asked questions
What is the total cost of the Cyber Resilience Act?
The Commission estimated EUR 29 billion in compliance costs on businesses across the EU under the option it chose. Spread across the 615,272 manufacturers and products the same document counts, that averages near EUR 47,000 each, or roughly 2 percent of the affected market's turnover.
What does one product cost to make compliant?
On the Commission's assumptions, about EUR 42,700 of secure development if nothing is in place, plus EUR 18,400 for a self assessment or EUR 25,000 for a third party assessment. Documentation and reporting sit on top, and that component is the least well evidenced in the source.
Are these figures the cost of the adopted Regulation?
No. They price the 2022 proposal. The Regulation entered into force on 10 December 2024 and changed in the negotiation. Use the figures as an anchor for scale, not as a quote.
Does the cost recur?
Yes, and the impact assessment's per product model is not the place to find it. The support period is at least five years under Article 13(8), and vulnerability handling, security updates and reporting readiness run for all of it.
Can other compliance work reduce it?
Some of it. Secure development, asset inventory and incident process overlap with NIS2 and ISO 27001. The product level parts, the classification, the SBOM, the CE marking and the technical file, do not.
Is there a cheaper route for small manufacturers?
Not a discount, but there is a lever: classification. Default products self assess, which is both cheaper and faster than a third party route, so establishing your class early is the single highest value hour in the programme.
Primary sources
Cost figures are taken from SWD(2022) 282 final, the Commission impact assessment of 15 September 2022 accompanying the CRA proposal, specifically the Policy Option 4 cost table, the market analysis in Section 5 and the assumptions in Annex 4. Obligations and article references are from Regulation (EU) 2024/2847, and application dates from the European Commission's Cyber Resilience Act policy pages. The estimates price a proposal for an entire EU market and are not a quote for any single manufacturer. Confirm the current text before relying on a figure.
