CCost model

C.1 Model assumptions

We set the radio, data traffic, security hardware and update service per archetype by design rather than measuring them (Table 23). The base case assumes 10,000 units over 60 months. We convert prices in USD and CHF at the ECB reference rates of 15 October 2026, €1 = USD 1.1208 = CHF 0.9305.¹³⁷ Prices exclude VAT where the vendor says so. Most B2B price lists do not say.

For components we take the highest quantity break that DigiKey publishes (500 to 5,000 units), not from a negotiated price for 10,000 units. Contract prices for an order of that size are usually lower. The hardware lines are therefore an upper bound. We neither discount nor inflate, count staff time only inside the Commission’s per-product estimates, and cost the Data Act per company rather than per device.

C.2 Measured list prices

Cellular tariffs span the widest range of any input, from €10 per SIM for ten years with o2 to €2.07 per SIM and month with Telekom.^{97, 381}

Connectivity tariffs. DACH IoT tariffs follow three pricing models:

• One-off packages for the device’s life. 1NCE IoT Lifetime Flat: €12 per SIM for 500 MB and 250 SMS over ten years. A top-up of the same size also costs €12 net.³ o2 Business Easy IoT (Telefónica): €10 net per SIM for ten years with 750 MB (world), 1,000 MB (Europe) or 1,500 MB (Germany), no minimum order, business customers based in Germany only.³⁸¹ Telekom IoT Business LPWA: €14.50 one-off per SIM for ten years with 6.5 MB a month in Europe over NB-IoT and LTE-M.⁹⁶ Magenta (Austria): IoT Tarif 5 at €9.99 for 60 months (6.5 MB) and IoT Tarif 10 at €18.99 for 120 months (8.33 MB), minimum 10 SIMs.²⁵⁶
• Monthly fees per SIM. Telekom IoT Business Classic: €2.07 a month per SIM with 100 MB, minimum 10 SIMs and 12 months.⁹⁷ The tariff family starts at €1.43.⁹⁶ Swisscom CMP Mobile Lite: from CHF 1.00 per SIM, CHF 69 activation, no roaming.³⁷⁶ Sunrise IoT Starter Services, at their launch in June 2022: CHF 1.50 to 9.00 per SIM per month for 2 MB to 5 GB, plus CHF 205 one-off, minimum 12 months.³⁷⁰
• Usage-based pricing. Onomondo: data from €0.0025 per MB, plan fees on request.³¹⁰

LPWAN and satellite.

• The Things Stack Cloud: Standard plan €190 a month including a licence for 1,000 end devices, or €0.19 per device. The plan covers the network server only, without gateways or roaming.³⁸⁵
• Swisscom LPN: LoRaWAN connectivity at CHF 1.00 per device on the Lite plan, or from CHF 0.45 on the Smart plan with a CHF 49 monthly platform fee.³⁷⁶
• Myriota: satellite plans from USD 0.99 per device per month.²⁷⁴

Cloud. AWS IoT Core in Frankfurt:¹⁵

• USD 0.096 per million connection minutes
• USD 1.20 per million messages for the first billion a month, metered in 5 KB increments
• USD 0.18 per million rules triggered and the same again per million actions
• USD 1.50 per million shadow and registry operations
• USD 0.001 per location fix

Azure IoT Hub, per unit and month, messages metered in 4 KB blocks on paid tiers:²⁶⁶

• S1: USD 25 for 400,000 messages a day
• S2: USD 250 for 6 million messages a day
• S3: USD 2,500 for 300 million messages a day

At 8,640 messages per machine and day, 10,000 machines fit in one S3 unit. That is USD 0.25 per device per month against USD 0.41 on AWS.^{15, 266} For the other three archetypes both clouds cost under €0.07 a month.

Device management and OTA.

• Golioth: USD 0.25 per active device per month, no platform tiers.¹⁹⁹
• AWS IoT Device Management: USD 0.003 per remote action (job), USD 2.25 per million index updates, USD 1.00 per secure tunnel.¹⁶
• Azure Device Update: USD 0.07 per device per month plus USD 70 per instance.²⁶⁶
• nRF Cloud: from USD 0.10 per device per month.²⁸⁵
• balena: Production plan USD 1,439 a month for 110 devices, plus USD 2 per additional device.²⁸
• Mender: USD 291 a month for up to 250 devices, fleets above 2,000 devices on request.²⁹²
• Memfault: from USD 3,495 a month for 1,000 monthly active devices.²⁶⁰

PKI and SBOM. AWS Private CA:¹⁹

• USD 400 per CA per month in general-purpose mode, or USD 50 in short-lived certificate mode
• certificates at USD 0.75 each for the first 1,000, USD 0.35 up to 10,000 and USD 0.001 above

We use a pre-provisioned Trust&GO part in place of a factory provisioning service where such a part is on sale. OWASP Dependency-Track is free.³²¹ FOSSA Business costs USD 20 per project per month, and the vendor’s example plan comes to USD 207 a month.¹⁸⁹ Snyk Team starts at USD 25 a month.³⁶³

C.3 Line items per archetype

The machine’s cellular tariff, at €2.07 per device per month, is the largest single line in any archetype.⁹⁷ The monthly figures add each one-off cost divided by 60 to the recurring fees.

For the battery tool, the premium is almost the whole cost (Table 24).

For the machine, the cellular tariff is two thirds of the cost (Table 25).

For the building device, signed OTA is the largest line (Table 26).

For the logistics tracker, radio and SIM are half the cost (Table 27).

The tracker uses about 1 MB a month. The 1NCE package allows 8.3 MB a month over five years and so lasts the device’s life.³ The battery tool and the building device carry no SIM. Their base cost is the radio chip and the cloud traffic.

C.4 Per-product compliance block

In our model the compliance block costs €104,781 per product over five years and is the same for all four archetypes (Table 28). We take the Commission’s per-product CRA estimates in full.¹⁴⁴ For secure development we use 30.5 %, the Commission’s central value from a range of 19 to 42 % in its model.¹⁴⁴ The Commission puts recurring testing at €3,000 to 5,000 per product without a period. We take the midpoint, €4,000, as a yearly cost.¹⁴⁴ For tooling we assume one FOSSA Business subscription, paid for by a single product line.¹⁸⁹

C.5 Conformity assessment fees

Notified bodies rarely publish fees. The one public offer is an EU-type examination by LCIE (notified body 0081), offered through Serma Safety & Security from €3,900.³⁵⁹ It lies below every Commission estimate of third-party assessment^{140, 144, 410} (Table 29).

Per unit sold, the Commission puts third-party testing under the RED at €3 to 13 for a connected lawnmower and €0.35 for a router.¹⁴⁰ Third-party assessment at €25,000 and €50,000 raises the premium by €0.01 and €0.05 per device per month respectively (Table 30).

C.6 Sensitivity

Fleet size moves the premium more than any other input. The assessment route changes it by cents. The radio leaves it unchanged and moves only the base cost (Table 30).

The Swisscom case leaves out the CHF 69 activation fee and covers no roaming.³⁷⁶ In the LoRaWAN case we price a Murata Type 1SJ module at USD 11.11 and a u-blox MAX-M10S at USD 9.33, both at DigiKey, plus €0.19 a month for the network server.^{109, 115, 385}