How to Plan Your CRA Compliance Budget
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, applies in full from December 11, 2027. The budgets that cover this date fund exactly the period in which the CRA obligations take full effect. If you do not anchor the effort in your CRA budget in the regular budget round, you enter that period without room to maneuver. You then have to make corrections later, when the budgets have long been allocated.
Contents
What determines your CRA budget?
Your CRA budget depends on three blocks of effort: setting up secure development and vulnerability handling processes, technical security measures in the product, and documentation including conformity assessment. The largest share rarely comes from one-off measures. It comes from ongoing obligations over the entire support period of a product.
What really drives the CRA effort?
The CRA effort spreads across three levels, which weigh differently in practice.
The first level is setting up processes. The CRA requires a secure product development process and working vulnerability handling. This includes a vulnerability disclosure policy, an incident response process, and the ability to report actively exploited vulnerabilities and severe incidents on time. For many machine and plant builders, this means building from scratch. A common process reference is IEC 62443-4-1 as the process standard for secure product development, which covers a large part of these requirements in a structured way.
The second level is technical measures in the product. Threat modeling, security by design, secure update mechanisms, authentication, encryption, and hardened interfaces follow from the essential cybersecurity requirements in Annex I, Part I. This block drives effort in particular when existing product platforms have to be secured after the fact, instead of building security in from the start.
The third level is documentation and conformity assessment. It includes the technical documentation under Annex VII, the cybersecurity risk assessment, the EU declaration of conformity and, depending on the product class, involving a notified body. Which route applies depends on the classification. Default products can use internal control (module A). Important products under Annex III may go through harmonized standards or a notified body. The classification of important and critical products under the CRA therefore directly determines the size of this block.
Why do manufacturers underestimate the CRA effort?
The most common blind spot: manufacturers read the CRA as a pure documentation and CE marking topic, something to finish at the end of development. In fact, the regulation reaches deep into processes and product architecture.
Take a connected machine controller with remote maintenance access. At first glance, it is an established product that already carries the CE marking. Under the CRA, however, new requirements apply to the product itself. It needs secured remote access and a demonstrable process for security updates over the entire support period. It also needs technical documentation that shows the security architecture. What looks like a manageable addition affects development, testing, product management, service, and legal at the same time.
Three further reasons for underestimating the effort come up regularly:
- The effort scales with the breadth of the portfolio. Every product with digital elements is in principle within scope, and product variants multiply the work. A careful CRA applicability check and scoping at the start clarifies which products are affected.
- The effort is ongoing, not one-off. Vulnerability handling accompanies the product for years.
- The CRA reaches into the supply chain, for example through software bills of materials (SBOMs) and evidence from suppliers.
Why is late CRA budgeting expensive?
If you leave the CRA effort out of the regular budget round, you end up with a change request in the middle of the financial year. Such additional requests are harder to push through. They compete with projects that have already been approved, and they often arise under time pressure, which means worse terms.
There is also a capacity problem. The closer December 2027 gets, the more manufacturers compete for the same resources. These include internal developer capacity, external specialists, and the assessment capacity of notified bodies for important and critical products. Late budgeting therefore meets a tighter market.
The most expensive item in the end is the market access risk. Products that do not meet the CRA requirements must not be placed on the market after the date of application. A delayed implementation does not just shift costs. It can put the saleability of entire product lines at risk. Parallel regulation makes this worse: the new Machinery Regulation (Regulation (EU) 2023/1230) applies from January 20, 2027, and in many companies it ties up the same teams.
Why does the CRA belong in your regular budget round?
The CRA obligations apply in stages. The reporting obligations for actively exploited vulnerabilities and severe incidents have applied since September 11, 2026. The full product requirements follow on December 11, 2027. If you do not plan the funds in the budget round that covers this date, you have no lever left in the year the requirements take full effect.
This applies in particular to manufacturers that have postponed the topic so far and plan to address it seriously only in that year. They must anchor the effort in the budget round before it. Early CRA budget planning has three advantages:
- It spreads the effort over several financial years instead of squeezing it into a single one.
- It gives you room to negotiate with external partners and testing bodies.
- It prevents crisis mode shortly before the deadline.
A rough but deliberately planned budget can be refined later. A forgotten budget has to be pushed through against resistance as an additional request.
From effort drivers to a budget figure
The real CRA effort does not come from the CE marking. It comes from processes, technical measures in the product, and ongoing obligations over the support period. In practice, these drivers are regularly underestimated because they cut across the whole company and do not occur only once. Your budget round is the right time to anchor a realistic order of magnitude, before scarce resources and fixed deadlines narrow your room to maneuver.
A reliable budget figure does not come from gut feeling. It comes from a product-specific roadmap that shows effort drivers, sequence, and timing. We develop this roadmap with manufacturers in a structured workshop. In the workshop, a CRA effort calculator translates the estimated effort into an order of magnitude that you can defend in the budget round.
Plan a realistic CRA budget
If you are looking for a reliable basis for your budget round, a first call based on your product roadmap helps put it into perspective. Get in touch.
