8Recommendations

8.1 Management

Management decides on the fleet over which security is spread and on the backend that carries it. Both set the cost (F4, F5).

• Make one shared device backend the rule for all product lines, with one update service, one PKI and one vulnerability process. In our cost model the security premium falls from about €2.30 a month per device at 1,000 units to under €0.30 at 100,000 (F5).
• Budget security as a running cost of about half a euro per device and month, priced into the product and its service contracts, not as a one-off project (F4). Budget the Data Act once for the whole company, as one export interface and one data-sharing process.¹⁴³
• Give one person the responsibility for product security and the authority to file a report without further sign-off (F1).
• Fund the twelve-month plan below from January 2027 and review it every quarter. The deadlines do not move when the standards are late (F1, F2).
• Choose the OTA service and the cellular tariff by their cost over five years, not by the price of the chip (F4). Ask every platform and OTA vendor for a written commitment that covers your products’ support period, and for a documented export path.
• Decide whether tracking is sold as a service, and price it against all-in fees per asset, not against the tag’s bill of materials.³⁵⁷ Plan tool tracking as integration with the contractors’ site gateways, not as a gateway network of your own.^{207, 391}

8.2 Product and engineering

Engineering fixes the design choices that cannot be changed after shipment (F3, F4, F6).

• Fix secure boot, a hardware root of trust, a unique device identity and the factory provisioning route before the board layout of every product launched in 2027. None of them can be added by a firmware update, and in our cost model the secure element is the smallest cost item (F4, F5).
• Design gateways as part of the machine, sold and documented with it, and describe their core function as machine connectivity, not network protection, so that they stay in the CRA default class¹⁴⁹ (F3).
• Keep the gateway’s write path to safety functions closed by design, and sign PLC firmware separately from the gateway’s own packages, so that customers can install security fixes without requalifying their process.^{168, 171}
• Release no firmware without an SBOM in the format of BSI TR-03183 and a check against known vulnerabilities,⁵⁴ and route every match to a named product security team that can report to ENISA within 24 hours (F1).
• Run device identities, update keys, the update service and the location solver behind an interface of your own that survives a vendor sale or a cloud retirement.
• Remove 2G fallbacks from tracker and gateway designs, and make batteries removable by the user or document the exemption, before the designs freeze^{77, 169} (F6).

8.3 Compliance

Compliance owns the duty that applies today and the classification that sets every later cost (F1, F3).

• Own the reporting path through ENISA’s single reporting platform and test it in a drill before a real case arrives^{133, 171} (F1). Run one reporting process for the CRA and NIS 2 where the company also falls under NIS 2. It sends product vulnerabilities to the platform and incidents in the company’s own systems to the national authority.¹⁶⁶
• Bring the installed base into the reporting duty, not only current production (F1).
• Own the CRA classification of every product, measured against the Commission’s implementing regulation on product categories¹⁴⁹ (F3).
• Assess conformity against the essential requirements of Annex I now, instead of waiting for harmonised standards, and keep the evidence for each requirement (F3). Certified radio modules and secure elements save work but do not replace the assessment of the whole product.¹⁷¹
• For any important product, contact early the bodies that have announced a CRA notification (F3).
• For Swiss products, designate the legal representative under the Data Act and write the CRA duties into every contract with an EU importer: documentation, contact details on the product, cooperation on vulnerabilities.^{170, 171} For Swiss machinery, also name an EU importer or authorised representative and keep an EU notified body in reserve for Annex I machinery, as long as the machinery chapter of the mutual recognition agreement has not been brought into line with the new Machinery Regulation.^{343, 349}

8.4 The twelve-month plan

The obligations set the order of the plan. The reporting duty, which already applies, comes first, and the conformity assessment for products placed on the market after 11 December 2027 comes last¹⁷¹ (Table 18). The plan starts in January 2027 and is written for a manufacturer with one to five connected product lines and one engineering organisation.

8.5 Funding for CRA compliance

No national grant pays for CRA compliance in Germany, Austria or Switzerland (Appendix E). The two open calls that name the CRA are European. SECURE pays SMEs up to €30,000 at a 50 % funding rate,³⁵³ and a Digital Europe topic funds the implementation of EU cyber legislation.²⁸⁰

The year 2026 narrowed the choice further. ZIM has accepted no new applications since 7 July 2026,³⁸⁷ KMU.DIGITAL will not return in 2027,⁴¹⁴ and the state digitalisation grants ended in Baden-Württemberg, Lower Saxony and Thuringia.^{250, 282, 386} The successors of the KfW ERP-Digitalisierungs- und Innovationskredit pay a grant of 3 or 5 % only from Stage 2.^{235, 237}

Few programmes still have a dated window. MID-Digitale Prozesse opened on 19 October 2026.²⁹⁴ SECURE closes on 11 December 2026,³⁵³ the FFG Basisprogramm’s 2026 call on 31 December 2026,³¹³ KIRAS on 26 February 2027³¹⁷ and Digitalbonus.Bayern at the end of 2027.²⁹ The other programmes are closed or rolling. A maker can, for example, request the KfW ERP-Förderzuschuss at any time with the loan through its house bank,^{237, 238} and L-Bank, the aws erp-Kredit, Innosuisse and the tax credits have no deadline either.

A German maker will therefore realistically finance CRA work with a KfW Stage 2 or 3 loan and its grant plus the Forschungszulage, whose assessment base rose to €12 million a year.^{35, 62} An Austrian maker uses the FFG Basisprogramm and the Forschungsprämie, a Swiss maker an Innosuisse project with a research partner.

8.6 Five guiding questions

Five questions show whether a company is ready. Each should be answered with yes.

1. Would an early warning on an exploited vulnerability reach ENISA within a day today, including for a product sold years ago?
2. Could you justify the CRA class of every gateway and every other borderline case to a market surveillance authority today?
3. Is security anchored in hardware in every product you launch in 2027, from boot to device identity?
4. Does a single backend carry the updates, certificates and vulnerability reports of all your product lines?
5. Will every tracker and gateway you sell in 2027 still work after the 2G shutdown, and can the user replace its battery where no exemption applies?

A no to the first question means that a duty already in force is not met. A no to any of the others is a cost or a market risk for products launched in 2027.