In machine and device engineering, it is no longer only the factory that is connected but the product that leaves it. Nearly every German maker of products with digital elements now sells devices that can be updated after delivery. Each of those devices extends the manufacturer's responsibility beyond the factory gate, and each is a possible point of attack.
Europe's answer is five pieces of legislation at once. In almost every project RUBINLAKE has worked on over the past years, the same question came up, usually too late, once the hardware was fixed: what does security cost, and who pays for it? Nobody had a reliable number. So we worked one out. The result is our free industry report Connected Products DACH 2027, and this post sums up what it found.
Five laws, one deadline, and the first duty already applies
The Cyber Resilience Act (CRA), the Data Act, the Machinery Regulation, the cybersecurity rules of the Radio Equipment Directive and the Battery Regulation take effect between August 2025 and December 2027. Together they make security, updates and data access a condition for a connected product to enter the EU market at all[1]. The European Commission puts the damage the CRA alone could spare EU companies at €180 to 290 billion a year[2].
This is not a distant prospect. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours through ENISA's single reporting platform, and the duty covers devices that have been in the field for years[1]. German mobile networks alone carried about 86 million active M2M SIM profiles at the end of 2025, 17% more than a year earlier[3]. The installed base is large, and it is growing fast.
Readiness lags far behind. Only 3% of surveyed German industrial companies consider themselves fully CRA-compliant, and half still have no external contact point for vulnerability reports, although the reporting duty is already in force[4].
The dilemma: designing without standards
This is the real conflict every product lead lives with right now. The hardware of products launching in 2027 has to be fixed now. Yet not one of the 41 harmonised standards commissioned for the CRA has reached the Official Journal, and no notified body has been designated.
Whether security belongs in the product is therefore no longer the manufacturer's decision; the law has made it. What the manufacturer still decides is how expensive it gets. And for that decision, the numbers were missing.
What we priced
The report asks which design carries the security of a connected product most cheaply over its life. It answers that for manufacturers with 100 to 4,999 staff in Germany, Austria and Switzerland, on four typical devices:
- a battery tool with a BLE tracker,
- a machine with an edge gateway,
- a controllable building device such as a heat pump under § 14a EnWG,
- a logistics tracker for assets, containers and trailers.
For each device our cost model prices the base cost of radio and cloud and the security premium the five acts add - from the secure element through signed updates and PKI to conformity assessment. It rests on published list prices, in the base case for 10,000 units per product over five years. No survey, no negotiated prices, and every figure with its source.
The three findings that matter
1. Security costs under €0.50 per device and month
In the base case the security premium lies between €0.40 and €0.48 per device and month for all four devices. It is small per device, and it is roughly the same for every product, battery tool or machine. Over five years that is €24 to 29 per unit.
For comparison, total running cost ranges from €0.50 to €3.10 a month depending on the device. On the battery tool the premium is 93% of the total, because the device costs almost nothing otherwise. On the machine, with cellular fallback and constant cloud traffic, it is 13%. Regulation is not what makes a connected product expensive. Radio and backend set the total.
2. Fleet size outweighs any component
This is the finding that turns most engineering debates on their head. The argument in development teams is usually about the secure element, whether it may cost €0.60 or €1.20. In our model it is the smallest item.
What really moves the bill is the fixed cost of conformity: the certificate authority, PKI, SBOM tooling, the reporting organisation. It is spread across every device. At 1,000 units the security premium rises to about €2.30 per device and month, five times the base case. At 100,000 units it drops below €0.30. A maker of small series therefore has to decide differently from a maker of large ones, for instance with one certificate authority shared across all product lines.
3. Trackers need a new battery concept and cellular without 2G
For logistics trackers, two dates decide the device. The last 2G networks in Germany close in 2028[5], and from 18 February 2027 users must be able to remove most device batteries themselves. Anyone still designing a sealed 2G tracker today is designing a product that will not keep its market approval for the life of its battery.
What this means for your decisions
The order of events is what matters. The architecture decisions that set the cost - radio, backend, fleet size, the trust anchor in the device - are made before the design freeze. The standards they could be measured against arrive afterwards.
Whoever fixes architecture and backend now spreads the cost of security across the whole fleet and has a clear path to conformity. Whoever waits for the standards designs under deadline pressure with less room to move. That is the short version of the report, which is why it is on the cover: security is cheap. Waiting costs markets.
The long version runs to about 100 pages, with a deadline wall, a duty matrix per device, four reference architectures, a vendor landscape for the DACH region and recommendations by role - from the Head of IoT to the compliance lead. Every table and chart downloads as Excel, CSV or JSON.
Read the report: Connected Products DACH 2027 - free to read, as PDF and EPUB, citation required.
