3Cost per device

3.1 Monthly running cost

For this report we built a cost model of our own. It calculates four archetypes: a battery tool with a BLE tracker, a machine with a cellular gateway, a building device under § 14a EnWG and a logistics tracker. The model covers the connectivity and security layer from the radio chip to the conformity assessment at published list prices, but not the host product’s motor, battery, enclosure and main controller. We spread one-off costs per device, such as chips, SIM packages and certificates, over 60 months. We spread one-off costs per product, such as secure development, documentation and conformity assessment, over all devices of the fleet and over 60 months, and monthly fees at fleet level, such as a certificate authority (CA) or a tooling subscription, over all devices of the fleet. The base case is 10,000 units over five years (line items, assumptions and sensitivity in Appendix C).

In our model a compliant battery tool costs €0.50 a month in the base case and the machine €3.10. The building device lies in between at €0.59, the logistics tracker at €0.99. For the machine, the cellular tariff and the always-on cloud traffic together make up almost four fifths of the total (€2.44 of €3.10). The radio therefore sets the total (Figure 4).

The security premium, by contrast, costs almost the same for every archetype, €0.40-0.48 per device per month. It covers the secure element, the public key infrastructure (PKI), signed over-the-air (OTA) updates, software bill of materials (SBOM) and vulnerability tooling, secure development, documentation and conformity assessment. Because the premium barely varies, its weight depends on the base. It is 13 % of the machine’s monthly cost but 93 % of the battery tool’s (Table 6). For devices without a SIM, compliance costs more than connectivity; for devices with one, the tariff matters more than the law.

3.2 The CRA compliance share

In our model the per-product compliance block for the CRA adds €0.175 per device per month in the base case, about two fifths of the premium (36-44 %). For it we take the Commission’s per-product estimates, the only published figures of their kind. On an average development cost of €140,000, the Commission adds 30.5 % for secure development (€42,700), 9 % for documentation and reporting (€12,600) and €18,400 for self-assessment.¹⁴⁴ It puts third-party assessment at €25,000 and recurring testing at €3,000-5,000 per product.¹⁴⁴

We have costed this block deliberately on the cautious side and apply all figures in full, as if the manufacturer had no comprehensive security measures today. Yet the Commission itself counts about half of the secure-development cost as business as usual. It calls its own documentation figure unverified and probably too high.¹⁴⁴

Across the EU the Commission expects compliance costs of up to about €29 billion. Against this stand €180-290 billion a year in avoided incident costs for businesses, extrapolated from Bitkom’s damage estimate for Germany.^{142, 144} The German government’s implementation bill states no compliance cost of its own for business.¹⁰⁰

Fees of notified bodies are the least transparent item. Few bodies publish their prices. Serma offers an EU-type examination under the Radio Equipment Directive (RED) by LCIE (notified body 0081) from €3,900.³⁵⁹ For the RED, the Commission puts third-party testing at €5,000-15,000 per model for simple products and €50,000 or more for software-heavy equipment.¹⁴⁰

3.3 Data Act cost at company level

The Data Act adds cost per company, not per device. The Commission caps the cost of making product data accessible at €300,000 a year per small or medium-sized enterprise (SME) and €1 million per large company.¹⁴³ For the whole IoT market it estimates €410 million one-off and €88 million a year, and it gives no cost per product.¹⁴³

Spread over a fleet, the cap can exceed the whole security premium. An SME at the €300,000 ceiling would carry €2.50 per device per month at 10,000 units. A large company spreading €1 million over 100,000 devices would carry €0.83.¹⁴³ Where a product already exports its data through a documented cloud API, the cost per device should be a fraction of these bounds.

3.4 Security cost over the lifecycle

Over five years the security premium in our model comes to €24-29 per unit, from €24.09 for the machine to €28.92 for the building device. It has four parts:

• Signed OTA: about half the premium. Golioth’s USD 0.25 per device per month is €0.22, or 48 % of the battery tool’s premium.¹⁹⁹ On AWS IoT Device Management the machine’s OTA costs €0.15 a month, most of it for secure tunnels rather than update jobs.¹⁶
• CRA compliance per product: €0.175 a month.
• PKI: €0.04 a month. The USD 400 monthly fee of AWS Private CA is shared across the fleet. Certificates cost USD 0.35-0.75 each up to 10,000.¹⁹
• Secure hardware: under €0.05 a month, or €1.13-2.56 per unit once.^{112, 114}

The secure element is the smallest item. At reel prices the ATECC608B costs USD 0.725 at 3,000 units, the STSAFE-A110 USD 1.27 at 5,000 and the SE050C2 USD 2.87 at 3,000.^{108, 112, 114} The pre-provisioned Trust&GO variant costs USD 1.91, more than twice the bare part. The difference pays for factory key injection.¹⁰⁸ Saving on the chip saves a few cents a month. The running services decide the lifetime cost.

3.5 Fleet size as the main cost driver

Fleet size matters more than any component. In our model the security premium rises to about €2.30 per device per month at 1,000 units (€2.30-2.38), about five times the base case. At 100,000 units it falls below €0.30 (€0.21-0.29). In the small fleet, the per-product compliance block is spread over a tenth of the devices. The USD 400 monthly CA fee alone then comes to €0.36 per device.¹⁹ Two measures cut the PKI part: AWS’s short-lived certificate mode at USD 50 a month,¹⁹ or one CA shared across all of a manufacturer’s product lines.

At 100,000 units OTA becomes the largest part of the premium. The choice of update service then matters more than any other line. Azure Device Update costs USD 0.07 per device per month,²⁶⁶ nRF Cloud from USD 0.10²⁸⁵ and Golioth USD 0.25.¹⁹⁹ balena charges USD 2.00 per additional device, almost thirty times Azure’s rate.²⁸

Radio choice changes the base, not the premium. For the machine, Swisscom’s CMP Mobile Lite at CHF 1.00 lowers the base from €2.70 to €1.70, but includes no roaming.³⁷⁶ For the building device, LTE-M instead of the customer’s Wi-Fi raises the base from €0.11 to €0.57, with an nRF9151 and Telekom’s LPWA package at €14.50.⁹⁶ For the tracker, LoRaWAN on The Things Stack costs about the same per month as LTE-M (€0.52 against €0.53) but needs its own GNSS chip (MAX-M10S, USD 9.33 at 500).^{115, 385} LoRaWAN reaches trailers and containers only within range of own or roaming gateways.³⁸⁵ A Myriota satellite plan on top of LTE-M raises the base to €1.41 before the satellite modem, for which Myriota publishes no price.²⁷⁴

Product class changes little per device. Third-party assessment at the Commission’s average of €25,000 adds €0.011 a month to the premium in the base case.¹⁴⁴ At €50,000, the Commission’s estimate for software-heavy radio equipment, it adds €0.053.¹⁴⁰ The premium falls by €0.036 if half of the secure-development cost is already business as usual.¹⁴⁴ The product class is a question of lead time, not of cost per device.