CRA support for SMEs and startups: what relief applies

What Cyber Resilience Act support is available to SMEs and startups?

If your business is a small manufacturer or startup that must meet the Cyber Resilience Act, the regulation gives microenterprises and small enterprises several forms of relief: simplified technical documentation, reduced conformity assessment fees, an exemption from fines for missing the 24-hour early warning, CSIRT helpdesk support, national awareness and sandbox programs, and penalties that authorities must set with your size in mind. Each form of relief is tied to a specific article, so the first task is to confirm your size category under the regulation's definitions and then map which relief applies to which obligation. Ask your national market surveillance authority and the CSIRT you expect to report to what support they currently offer, because Member State programs differ in scope and timing.

Relief changes how some obligations are met and what they cost. It does not remove them. Your product must still meet the Annex I essential requirements, you must still run a vulnerability handling process for the whole support period, and the Article 14 reporting duty applies to you whenever your product was placed on the market. The organization owns its controls and its conformity decisions. An implementation partner can help prepare systems, documentation and evidence, such as test records and vulnerability logs, but only an independent notified body or other competent conformity assessment body issues an assessment outcome. When you request a quote for outside help, ask the provider to state in writing which of your evidence items it prepares and which remain your own responsibility.

Where SMEs can get help from national authorities and CSIRTs

The CRA places several support duties on Member States and CSIRTs, aimed at microenterprises and small and medium enterprises that often lack in-house security staff. The four channels below cover awareness and contact points, reporting help, controlled testing and EU-level guidance. Availability and detail vary by Member State, so confirm each channel with the authority in the countries where you sell.

Awareness, training and a contact channel

Article 33(1) asks Member States to give microenterprises and small enterprises awareness and training activities, a dedicated communication channel, and support for testing and conformity assessment. For a small team, this is often the first place to learn which obligations apply to your product class. Ask the national authority which training is offered, how to reach the dedicated channel, whether it covers testing support, and whether the offer is free or fee-based.

CSIRT reporting helpdesk

Article 17(6) requires CSIRTs to provide helpdesk support on reporting, in particular to SMEs. This matters once you hold an actively exploited vulnerability or a severe incident that must go to the Single Reporting Platform. Before you need it, identify the CSIRT designated for your Member State, confirm how its helpdesk is reached, and check which hours and languages it supports. Record its contact details in your vulnerability handling procedure.

Regulatory sandboxes for innovative products

Article 33(2) lets Member States set up cyber resilience regulatory sandboxes, which are controlled testing environments for innovative products before they are placed on the market. A sandbox can help a start-up test a novel design against the essential requirements while the authority observes. Confirm whether your Member State runs a sandbox, who is eligible, what it costs, what it requires you to share, and whether participation affects your later conformity route.

Commission guidance and EU financial support

Article 33(3) and (4) require the Commission to issue guidance for microenterprises and SMEs and to promote the EU financial support available to them. The Commission published non-binding CRA guidance on 27 July 2026, covering scope, open-source software and reporting. Read it alongside the FAQs, then ask your national authority which EU funding programmes it promotes and which of them your product development could qualify for.

What SME compliance costs still come from your budget

This table compares the cost components an SME still funds under the CRA, who is paid for each one, and whether it is one-time or recurring. Read the first three rows for external spend and the last row for the internal cost that the impact assessment estimated, which comes from a 2022 proposal rather than the adopted text.

Cost component	Who is paid	One-time or recurring	What drives it up or down
Notified body or conformity assessment body	The notified body, only where module B with C or module H applies	One-time per assessment, recurring on reassessment after substantial modification	Article 32(6) requires fees to be reduced proportionately for microenterprises and SMEs. Ask for the reduced fee in writing and confirm which modules apply to your product class.
Simplified technical documentation	Internal staff or an implementation partner, if you hire one	One-time preparation, then updates with each release	Article 33(5) allows Annex VII elements in a simplified format, which notified bodies must accept. Fewer product variants and a clear architecture keep scope and document count down.
Implementation partner evidence and system work	The implementation partner, on a fixed scope agreed in writing before work starts	One-time for the initial scope, with optional retainers for upgrades and ongoing support	Number of products, age of the codebase, existing security testing and how much vulnerability handling process must be built. Request a quote that separates the initial scope from any retainer.
SBOM and vulnerability tracking tooling	Tool vendors or hosting costs for open-source or commercial tools	Often recurring, with setup as a one-time task	Number of components, release frequency and whether tooling is self-hosted. Open-source options reduce license fees but still need staff time to triage findings.
Security testing and reports	Testing providers, including penetration testers for the regular testing the CRA requires	Recurring, scaled to risk and release cadence	Attack surface, release frequency and whether test reports go into the technical documentation. Confirm the test types and cadence with your notified body before buying.
Internal engineering time for Annex I work	Your own staff, or contractors you hire	Recurring across the support period	The impact assessment estimated that a secure product development lifecycle adds on average 30.5% to development costs where no comprehensive security measures exist (2022 proposal estimate, citing an academic calibration model). Treat it as an indication only, since the adopted regulation differs from the 2022 proposal.
Vulnerability handling and reporting duties	Your own staff, plus any CSIRT helpdesk or tooling you use	Recurring once reporting duties apply	Reporting duties under Article 14 have applied since 11 September 2026. Small teams can lower the load by agreeing response roles in advance and by using CSIRT helpdesk support, which Article 17(6) requires.
Fines exposure if obligations are missed	Not a purchase, but a cost if breaches occur	Contingent	Article 64(10)(a) exempts microenterprises and small enterprises from fines for missing the 24-hour early warning, and Article 64(5) requires authorities to weigh size. Confirm how your national authority applies these rules.

How authorities weigh size when setting CRA penalties

Size lowers how a penalty is set, but it does not lower the obligations themselves. Article 64 sets maximum administrative fines in three tiers: up to EUR 15 million or 2.5% of total worldwide annual turnover for breaches of the Annex I essential requirements and Articles 13 and 14, up to EUR 10 million or 2% for other listed obligations, and up to EUR 5 million or 1% for supplying incorrect, incomplete or misleading information to authorities. In each tier the ceiling is the higher of the two figures, so for a company with modest turnover the fixed amount generally sets the ceiling. A small company is not capped at a lower number by its size alone.

Article 64(5) controls how an authority moves within those ceilings. It requires the authority to consider the nature, gravity and duration of the infringement, any previous fines for similar infringements, and the size and market share of the operator, with particular regard to microenterprises and SMEs. In practice, a small manufacturer that acts promptly once it learns of a problem, can show a documented process, and has no record of similar breaches is positioned differently from a large vendor that ignored a known exploited vulnerability. Ask your advisers to show you how your records would read under those five factors, and keep dated evidence of your risk assessment, vulnerability handling and reporting decisions so you can demonstrate them.

Confirm how your national market surveillance authority applies Article 64(5) before you rely on it. Enforcement is carried out by national authorities, and their published penalty guidance, staffing and early enforcement decisions will shape outcomes more than the abstract ceilings do. Ask the authority or your national standards and cybersecurity bodies for any written enforcement policy, and check the Commission's CRA implementation page for updates. Treat size as a factor that can moderate a penalty, not as a reason to defer the work, because the regulation applies to your products whatever your headcount.

Which SME relief applies to your product situation

If your enterprise is a microenterprise or small enterprise and you place a product with digital elements on the EU market, several provisions work in your favor. The regulation lets you provide the technical documentation elements of Annex VII in a simplified format, which a Commission implementing act is to set out, and notified bodies must accept that format where a notified body is involved. The fee relief in Article 32(6) also applies where a conformity assessment is needed, and the penalty rules in Article 64 take your size into account.

Simplified technical documentation: Article 33(5) allows Annex VII elements in a simplified format, subject to the implementing act.
Fee reduction: Article 32(6) requires conformity assessment fees to be reduced proportionately for your size.
Penalty weighing: Article 64(5) requires authorities to consider the size and market share of the operator, with particular regard to microenterprises and SMEs.
Support channels: Article 33(1) asks Member States to offer awareness, training and a dedicated communication channel.
Default route: Most products still follow self-assessment under module A, so the simplified format matters mainly where a third-party assessment applies.

Confirm with your national market surveillance authority which support channels it offers and when the implementing act setting the simplified format is adopted.

How an SME prepares to use the relief in practice

This sequence turns the CRA's SME provisions into a working file: a confirmed size category, a clear product classification, a dated view of obligations, and documentation and reporting routes ready before the relevant deadlines. Each step ends with an output you can check.

Confirm enterprise size and product classification
Start by establishing whether your organization counts as a microenterprise, a small enterprise or a medium-sized enterprise, using the headcount and turnover or balance sheet thresholds in the EU SME definition, and check the group and partner enterprises that may count toward those thresholds. Then assess which product category your product falls into under the regulation's scope and classification rules, since that determines whether you can self-assess or need a notified body. The output is a short written record of both findings, signed off by someone accountable for compliance. Confirm any borderline result with your national authority or legal counsel before relying on it.
Map the CRA dates against your product lifecycle
Build a dated view of your obligations. The Article 14 reporting duty for actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, and it covers in-scope products whenever they were placed on the market. The wider regulation applies from 11 December 2027, and products already on the market before that date fall under it only if they are substantially modified. The output is a obligation calendar listing each product, its market placement date and any planned substantial modification.
Request sandbox or national support
Contact your national market surveillance authority, national cybersecurity agency or designated support body to ask which awareness, training, testing and conformity assessment support is available to microenterprises and small enterprises, and whether a cyber resilience regulatory sandbox is set up in your Member State. Ask specifically about access conditions, eligibility and how sandbox testing interacts with market placement. The output is a written response or a documented request, plus a note of the contact route and the named person who will handle it.
Prepare Annex VII documentation in simplified format
Where you are a microenterprise or small enterprise and need a conformity assessment, you may provide the Annex VII technical documentation elements in the simplified format that the Commission sets by implementing act. Check whether that implementing act is in force and what it requires before drafting, and confirm that your notified body accepts it. Your team, or an implementation partner you engage under a written scope, prepares the material from your risk assessment, test records and vulnerability handling evidence. The output is a versioned technical file that a notified body can review without a second round of documentation requests.
Request a fee quote from a notified body
If your product requires a notified body, send a written request that states your product category, the assessment module you expect to use, your size category and the documentation you hold. Ask the body to confirm how the reduced conformity assessment fee for microenterprises and SMEs is applied, what it covers, and which items are charged separately, such as re-assessment after a substantial modification. Compare quotes on identical scope. The output is a written quote and a fee breakdown that you can check against the SME reduction, which the regulation requires to be proportionate to your needs.
Set up the reporting route to the CSIRT
Identify the CSIRT that will receive your notifications and confirm the helpdesk channel it offers for reporting, which the regulation requires to support SMEs. Register or confirm access to ENISA's Single Reporting Platform, assign named staff to submit early warnings and notifications, and write a short internal procedure for when a vulnerability is actively exploited or a severe incident occurs. Note that microenterprises and small enterprises are exempt from fines for missing the 24-hour early warning deadline, but the duty itself still applies. The output is a tested contact path and a one-page reporting procedure approved by management.

What a small team needs in place before using the relief

The CRA relief for microenterprises and small enterprises only helps if the organization can show it qualifies and can act within the deadlines that remain. The four items below are the records a small team should have in hand before relying on simplified documentation, reduced fees or the fine exemption, and each one must be owned and signed off by the organization itself.

Documented size and classification decision

Before claiming any relief, record whether the company is a microenterprise, a small enterprise or neither, using headcount and turnover or balance sheet totals, and record the product's classification as default, important or critical. The size test must cover the whole group and any linked enterprises, not only the legal entity that ships the product. Check the decision against the Annex III and Annex IV descriptions and the Commission's implementing regulation, then have a named founder or officer sign and date it. Revisit it when headcount, ownership or product scope changes.

Product technical file mapped to Annex VII

Simplified documentation under Article 33(5) still has to cover the Annex VII elements, only in a reduced format that notified bodies must accept. Keep one file per product version with the risk assessment, the list of Annex I requirements applied, the vulnerability handling records and the test results. Ask the notified body or market surveillance authority which simplified format applies once the implementing act is adopted. The manufacturer owns the file, and an implementation partner can help assemble the evidence, but the manufacturer signs the declaration.

Vulnerability intake contact and process

The fine exemption for missing the 24-hour early warning applies only if the company can still identify, triage and report an actively exploited vulnerability through the CSIRT and ENISA platform on time. Set up a monitored security contact address, a named person who can decide on reporting within hours, and a written step for escalation outside working time. Confirm which CSIRT is designated as coordinator for your Member State and test the helpdesk route before you need it. Record each intake and decision so the exemption can be proven.

Record of the support period

The support period is the length of time the manufacturer must keep providing security updates, and it is a core part of the evidence for the whole lifecycle. Write down the period you committed to for each product, the date each version was placed on the market, and how updates are delivered to users. Keep the record with the technical file so an authority can see what was promised and what was delivered. Ask your notified body or advisor to confirm how the Commission's guidance on support periods applies to your product before you publish a figure.

Who owns SME compliance and who can help

The manufacturer owns CRA compliance, including the controls, the technical documentation and the EU declaration of conformity. Relief for microenterprises and SMEs changes how some obligations can be met, such as the simplified format for Annex VII elements under Article 33(5) and reduced conformity assessment fees under Article 32(6), but it does not move responsibility away from the manufacturer. National market surveillance authorities enforce the regulation, and CSIRTs offer reporting helpdesk support under Article 17(6). Neither the authorities nor the CSIRTs issue certificates or confirm that a product conforms. Before you rely on any relief, confirm with your national authority which support channels, awareness activities and sandboxes it has actually set up, since Member States decide how to deliver them.

Where a conformity assessment is required, a notified body issues the outcome. Your product's classification determines whether that step applies at all, and the notified body route should be confirmed against the regulation and the Commission's guidance before budgets are set. An implementation partner such as DeployOpen can plan, build and document the systems, processes and evidence the regulation expects, including the technical file, under a written scope with agreed deliverables and timelines. That work is preparation. DeployOpen does not issue reports, attestations or certificates, does not act as a notified body, and does not guarantee a conformity outcome or any fine outcome. Ask any provider to state in writing which parts of the work they perform and which parts the notified body or your own staff must perform.

Questions SMEs ask about CRA relief

Does simplified technical documentation remove any Annex I requirement?

No. Article 33(5) lets microenterprises and small enterprises provide the Annex VII elements of technical documentation in a simplified format, which a Commission implementing act will set and which notified bodies must accept. The change affects how the documentation is presented, not what the product must do. The Annex I essential cybersecurity requirements still apply to every product with digital elements, and your cybersecurity risk assessment still has to show how each applicable requirement is met. Before you start, confirm whether the implementing act setting the format has been adopted, and ask any notified body you approach which format it will accept for your product class.

How much does a notified body reduce fees for a startup?

The regulation does not set a fixed percentage. Article 32(6) requires conformity assessment fees to take account of the specific interests and needs of microenterprises and SMEs, including start-ups, and to be reduced proportionately. The notified body prices the work itself, so the reduction appears in its written quote rather than in a published rate. The main drivers are the conformity assessment module that applies, the complexity of the product, the number of assessment rounds, and whether a later substantial modification triggers a reassessment. Ask each notified body for a line-item quote that shows the reduction applied, the basis for it, what is included, and what would be charged separately if the scope changes.

Does the 24-hour exemption mean no vulnerability reporting is needed?

No. Article 64(10)(a) exempts microenterprises and small enterprises from fines for missing the 24-hour early warning deadline. It does not remove the Article 14 duty to notify actively exploited vulnerabilities and severe incidents, which has applied since 11 September 2026 to in-scope products placed on the market. Notifications go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator, and Article 17(6) requires CSIRTs to offer helpdesk support, particularly to SMEs. Set up a vulnerability intake channel, name the person who decides on notifications, and rehearse the steps before an incident happens. Ask counsel to confirm how the exemption interacts with any other enforcement measures that apply to your product.

Can a small team do CRA compliance work in-house?

Many small teams can, provided they cover security engineering, product documentation, vulnerability handling and the legal reading of the regulation. For most products, the manufacturer demonstrates conformity through self-assessment under module A, so the regulation itself does not require an outside body. Your team still has to produce the risk assessment, evidence for each Annex I requirement, technical documentation, a software bill of materials, a vulnerability handling process, the EU declaration of conformity and CE marking. Products in class I important categories without full application of harmonized standards, and class II or critical products, need a notified body. Article 33(1) asks Member States to provide awareness and training activities for microenterprises and SMEs, which can cover the gaps. Assign an owner to each control and check whether that person has time to maintain the evidence through every release.

What should you ask a CRA consultant before hiring one?

Start by confirming the role split. A consultant prepares systems, controls and evidence, but only an independent notified body issues a certificate, and the manufacturer remains responsible for the EU declaration of conformity and CE marking. Ask for a written scope listing deliverables, the evidence each deliverable produces, and what is excluded. Ask how they will map the work to the Annex I essential requirements and the Annex I Part II vulnerability handling requirements, how they handle third-party and open-source components and SBOM tooling, and which notified body or standards they assume. Confirm the timeline is agreed before work starts, who keeps the documentation after handover, and whether support or updates are a separate retainer. DeployOpen, for example, works to a fixed scope agreed in writing and does not issue reports or certificates. Ask every provider for the same written answers so you can compare them.

Which national authority should a small company contact about the CRA?

Contact the national market surveillance authority of the Member State where you place the product on the market. National market surveillance authorities enforce the regulation under Regulation (EU) 2019/1020, and an administrative cooperation group coordinates uniform application across Member States. For reporting, the notification goes to the CSIRT designated as coordinator in that country, which is reached through ENISA's Single Reporting Platform. Article 33(1) asks Member States to provide a dedicated communication channel and support for testing and conformity assessment for microenterprises and SMEs, so ask the authority which channel and programs it offers. Notified bodies are listed in the Commission's NANDO system. Confirm the designated authority and CSIRT for each country where you sell, because the answer depends on the market, not on where your company is incorporated.

How do authorities weigh company size when setting penalties?

Authorities must consider the nature, gravity and duration of the infringement, any previous fines for similar infringements, and the size and market share of the operator, with particular regard to microenterprises and SMEs under Article 64(5). Size therefore affects the amount within the range, but it does not change the maximum ceilings. Article 64 sets maximum administrative fines of EUR 15 million or 2.5% of total worldwide annual turnover for breaches of Annex I and Articles 13 and 14, EUR 10 million or 2% for other listed obligations, and EUR 5 million or 1% for incorrect or misleading information to authorities, whichever is higher. The practical lesson is that documented, proportionate controls and a timely response record are what authorities can weigh in your favor. Keep a dated record of risk assessments, vulnerability decisions and notifications.

How DeployOpen scopes SME CRA readiness work

DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure, and prepares the systems, controls and evidence a small manufacturer needs for the Cyber Resilience Act. We do not issue conformity declarations or certificates; the manufacturer owns its obligations, and independent assessment bodies make any formal determination.

How we scope

Engagements are fixed-scope, with the products, deliverables and timelines agreed in writing before work starts.
The written scope states which products, components and support periods are covered by the readiness work.
We confirm with you which simplified documentation route and conformity module your product class points to, and what that means for effort.

How we build

We set up the engineering and release tooling needed to produce technical documentation and SBOM evidence as a routine output.
We run security testing against the product and its interfaces, and record findings and fixes in a form you can keep in the technical file.
We implement vulnerability intake and handling workflows so that reporting duties can be met within the timelines the regulation sets.

How we hand over

You receive the documentation, runbooks and configuration records in your own repositories and under your control.
We walk your team through how to maintain evidence, update the SBOM and run the vulnerability process after handover.
We identify open items and the points where an independent notified body or assessor must be engaged, so you can plan that step.

How we support

Ongoing support, upgrades and continuous testing are available as retainers once the initial scope is delivered.
A retainer can cover updates to documentation when the product changes, including substantial modifications that affect conformity.
Before engaging us, ask for a written scope that separates our deliverables from the obligations you keep as the manufacturer.

Cyber Resilience Act support for SMEs and startups