SECURE Open Call Offers up to €30,000 in CRA Funding for SMEs
The second open call of the EU project SECURE has been open since October 1, 2026. Small and medium-sized enterprises (SMEs) can apply for up to €30,000 in CRA funding by December 11, 2026. If you are selected, however, your project will only start in spring 2027 and finish shortly before the deadline.
SECURE is a project under the EU's Digital Europe Programme. In several rounds, it awards grants to SMEs that manufacture, import, or distribute products with digital elements and are preparing for the Cyber Resilience Act. The first round, with €5 million, is still running.
What the SECURE open call funds
The second round has a budget of €11.5 million. It funds 50% of the project costs, up to €30,000 per company. A project may last no more than 180 days. Eligible activities include:
- CRA gap analysis, risk analysis, and action plan
- Vulnerability and penetration testing
- Security by design in software development
- Supply chain assessment
- Training on the CRA requirements
- Tools such as SBOM tools or vulnerability scanners
Your own staff or external service providers can do the work. This round does not fund certification, third-party conformity assessment, or support with the technical documentation.
Individual SMEs from the EU and the European Economic Area (EEA) can apply; consortia are excluded. You must apply in English. Results come about three months after the submission deadline.
You are paid for the objectives you achieve
The grant is a lump sum. It is paid out when the project achieves and documents the objectives promised in the application. On request, you receive 40% as an advance and the rest after the final report. If you achieve your objectives only in part, you receive proportionally less. So plan objectives that you can reliably achieve and document within 180 days, for example a specific number of tested interfaces.
Two points the call leaves open
Support with documentation is excluded, but risk analysis is funded. Yet the risk analysis is itself part of the technical documentation. The call does not say where the line runs. In your application, put the analysis and implementation work first.
The National Coordination Centre (NCC) for cybersecurity in your Member State checks whether a company is eligible. The call documents do not show whether every national center takes part in the call. Check this with your NCC before you apply.
The funded project ends shortly before the CRA deadline
| Step | Date |
|---|---|
| Submission deadline | December 11, 2026 |
| Funding decision | around March 2027 |
| Project start | around April 2027 |
| Project end | around October 2027 |
| CRA applies in full | December 11, 2027 |
Costs incurred before the project start are not funded. The reporting obligations for exploited vulnerabilities have applied since September 11, 2026 (see registering for the CRA single reporting platform).
Start CRA implementation on your own
The Secuvise CRA template package contains editable process descriptions, RACI matrices, mapping tables, and checklists. Modules are available individually or as a package.
Apply for CRA funding and start now anyway
We recommend applying for the funding but not waiting for it. If you are selected, the grant takes pressure off your budget. If you only start after the decision, you have just eight months from April 2027 for the gap analysis, risk assessment, vulnerability handling process, technical documentation, and declaration of conformity. For most products, that is not enough.
Because work before the project start is not funded, your application should contain tasks that are due later anyway. Take the manufacturer of a connected machine control system with remote maintenance. It clarifies its product category, gaps, and risks now. In the application, it includes the penetration test of the remote maintenance access, an SBOM tool, and the assessment of its suppliers. If the application is rejected, only the money is missing; the schedule stays intact.
A completed gap analysis also strengthens the application, because the evaluators assess how specifically the gap to the CRA is described.
You will find the call and its documents on the SECURE website. Applications are submitted through the application platform.
Start CRA implementation with a workshop
In two days, we work with your team to clarify whether you are affected, your product category, and the main gaps. The result is the basis for your implementation plan and for a funding application.
