Funding programmes for CRA compliance — currently open or announced programmes.
A curated, link-checked overview of programmes for companies in Germany and – where available – Switzerland, as well as suitable European programmes. Funding rates and caps are programme-specific; each programme states its own rate and ceiling.
No guarantee is given – funding conditions, deadlines and available funds may change at short notice. The information does not give rise to any entitlement to funding. Eligibility and approval are decided solely by the respective funding body.
Programmes with a currently open or announced call
Funding rates and funding amounts are programme-specific. The overview is reviewed every 14 days and updated where necessary.
SECURE – funding directly for CRA implementation
EU · EEA
Funding: up to EUR 30,000 per project at a co-financing rate of 50%; the total budget of the second call is EUR 11.5 million.
CRA relevance: the call funds concrete projects through which micro, small and medium-sized enterprises align their processes, products, technologies, infrastructures or services with the requirements of the CRA.
Status: the second call is open from 1 October to 11 December 2026. Eligible applicants are individual legal entities that qualify as micro, small or medium-sized enterprises and are legally established in an eligible country. Eligible countries include the EU Member States as well as Norway, Iceland, Liechtenstein and Switzerland. The project must have a direct and substantive link to the CRA; the same costs may not receive double EU funding. Applications are submitted through opencall.secure4sme.eu.
Mittelstand-Digital Zentren
DE
Type of support: Free, practice-oriented guidance; no direct funding or grant.
CRA relevance: indirectly relevant; the centres support SMEs free of charge with digitalisation and IT security, for example through initial consultations, workshops, checks and practical guidance. This allows CRA-relevant security measures and areas for action to be identified and prepared at an early stage. No specific CRA funding or financing of the implementation is associated with this.
Status: active.
Digitalbonus (German federal states)
DE · e.g. Bavaria
Funding amount: up to 50%; Digitalbonus Standard a maximum of EUR 7,500, Digitalbonus Plus a maximum of EUR 30,000 for particularly innovative projects.
CRA relevance: expenditure on suitable ICT software and external services for digitalisation or improving IT security may be eligible for funding. The eligibility of the specific crAIready project must be checked before applying.
Status: active – programme runs until 31.12.2027.
CYBER-11-EULEG — DIGITAL EUROPE
EU · EEA
Funding amount: 50% funding rate; expected EU contribution EUR 3–5 million per project — for larger EU projects.
CRA relevance: explicitly supports the implementation of the CRA and other EU cybersecurity legislation, including through compliance tools and reporting platforms.
Status: open — deadline 14.01.2027 (opened on 01.09.2026); participation restricted to the EU and EEA.
CYBER-11-AI4SME — DIGITAL EUROPE
EU · EEA
Funding amount: 50% funding rate, 75% for SMEs; expected EU contribution EUR 3–5 million per project — for larger EU projects.
CRA relevance: indirectly relevant; funding is provided for cybersecurity solutions for SMEs, including for risk management, threat detection, incident response and reporting. The call is not specifically limited to the CRA compliance of individual companies.
Status: open — deadline 14.01.2027 (opened on 01.09.2026); participation restricted to the EU and EEA.
Programmes currently covered
The overview covers programmes for companies in Germany and Switzerland as well as suitable European programmes. It is reviewed every 14 days and updated where necessary.
Funding amount, funding rate and requirements differ by programme and project. Selected SME programmes provide for grants of up to EUR 30,000; other programmes have different volumes or offer advice instead of direct funding.
For each programme, the source, date, funding rate, ceiling and status are stated. No specific funding or approval is promised.