Appendix A
AMethod
Every number in the report rests on published sources or on assumptions marked as such. No survey of our own and no negotiated prices are used. Our cost model and our estimate of the number of makers of connected products (Section 1.5) rest partly on assumptions.
A.1 Sources
The evidence falls into six kinds:
- Legal texts. Dates and obligations are taken from the application articles of the legal texts, as corrected.141, 167, 168, 169, 170, 171 The status of harmonised standards and of notified bodies is taken from the Official Journal, the Commission’s NANDO database and the European standardisation organisations.
- Official statistics. Enterprise counts come from the German cost structure survey for 2023, Eurostat’s structural business statistics for Austria (2023) and the Swiss enterprise census STATENT (2024).56, 175, 367
- Surveys. The share of firms that offer connected functions and the readiness signals come from published surveys of 100 to 1,003 firms, run by research institutes, associations, consultancies and vendors.36, 37, 190, 307, 330 Each reflects how firms assess themselves.
- Prices. All prices are list prices currently published by vendors and distributors. We leave vendors that publish no price out of our cost model, and we do not estimate a price for them.
- Compliance cost estimates. The per-product cost of the CRA and the cost of third-party testing come from the Commission’s impact assessments and support study.140, 143, 144, 410
- Market events. Acquisitions, product launches and service closures come from the companies’ own announcements and from the business and legal press.
A.2 Measured and assumed
We calculate the cost per device with a cost model of our own for the four archetypes (Appendix C). Its only assumptions are the radio, data traffic, security hardware and update service per archetype, and every other number in the model is a list price with its source.
Our population estimate starts from official enterprise counts. The assumptions are the share of firms that make connected products, the split of the German 100-499 band by the 2017 ratio, the size structure for Austria and Switzerland, and two employment-weighted approximations for Switzerland.
A.3 Population estimate
No statistical office counts “manufacturers of connected products”. We therefore estimate 1,750-3,440 such manufacturers. To get there, we multiply official enterprise counts by industry and size band56, 175, 367 by a low and a high survey-based share. The connected share rests on surveys, not registers, and is therefore the weakest step. In a later edition we plan to replace it with signals from the RUBINLAKE platform.
A.3.1 Method in four steps
Step 1: industry classes. We count enterprises in four classes of WZ 2008 (Germany), ÖNACE 2008 (Austria) and NOGA 2008 (Switzerland), which match NACE Rev. 2 at this level: division 26 (computer, electronic and optical products, including measuring, control and navigation instruments), division 27 (electrical equipment, including motors, switchgear, wiring devices and household appliances), division 28 (machinery and equipment n.e.c., including power tools, heat pumps and machine tools) and group 32.5 (medical and dental instruments). We leave out divisions 29 and 30 (vehicles) because vehicles under EU type approval fall outside the CRA.171 We keep groups 26.1 (components and boards) and 27.3 (cables and wiring devices) in the base, since their parts can themselves be products with digital elements under the CRA.171
Step 2: size bands. The German cost structure survey (Kostenstrukturerhebung, KSE) counts legal units with 20 or more persons employed in the bands 20-49, 50-99, 100-499, 500-999 and 1,000 and more.367 We split 100-499 into 100-249 and 250-499 with the ratio of the last KSE edition that published both bands (reference year 2017). Then, 73 % of the 100-499 firms in division 26 had fewer than 250 employees, 71 % each in divisions 27 and 28, and 74 % across manufacturing.366 We use the manufacturing value for group 32.5. Austria and Switzerland publish only the bands 50-249 and 250 or more.56, 175 We apply the German structure to both. In the four classes, 47 % of German firms with 50-249 employees have 100 or more, and 18 % of those with 250 or more have 1,000 or more.367 This is an assumption. Austrian and Swiss firms in the 250+ band are smaller on average. Our 1,000+ cells for both countries are therefore more likely too high than too low.
Step 3: national adjustments. Swiss division 26 includes watch-making (NOGA 26.52), which accounts for 47.7 % of the division’s 117,217 employees.55 We remove that share from the Swiss division-26 counts. Switzerland does not publish group 32.5 by size band. We therefore scale division 32 by the 66.8 % of its employment that falls in group 32.5.55 Both are employment-weighted approximations.
Step 4: connected share. The connected share sets the width of the range. We apply a low and a high share of firms that make connected products:
- Low: the share of establishments that used, or planned by 2021 to use, IoT service platforms to offer digital services, from Fraunhofer ISI’s German Manufacturing Survey 2018, 17 % plus 14 % for 50-249 employees and 37 % plus 15 % for 250 or more.190 We use 31 % for the 100-249 band and 52 % above. The share is old and measures platform use rather than product features. We therefore treat it as the floor.
- High: the share of German manufacturers with 100 or more employees that use IoT platforms (45 %) or plan to (33 %), Bitkom 2026, n = 555.37 That gives 78 %, which we apply to all bands. The question covers IoT platforms in production as well as in products, so it marks the ceiling.
Each estimate per country and size band is the base count times the share. The 277 German legal units with 1,000 or more employees give 144 makers at 52 % and 216 at 78 %.37, 190, 367
Top band. No official source breaks at 5,000 employees. The top band of 1,000-4,999 therefore also contains firms with 5,000 or more. The KSE’s 1,000+ class has 277 German legal units in the four classes with 867,062 persons, an average of 3,130.367 The KSE counts legal units. The subsidiaries of large groups therefore appear separately, and most of them fall below 5,000. We deduct no 5,000+ class and so overstate the top band slightly.
A.3.2 By country and size band
Germany holds more than four fifths of the population, 3,692 of the 4,410 firms in the base and 1,465-2,879 of the 1,750-3,440 estimated makers. Austria adds 132-248 and Switzerland 153-313 (Table 19).
| Country | Firms | 100-249 | 250-999 | 1,000-4,999 | Total |
|---|---|---|---|---|---|
| Germany | in the base | 2,170 | 1,245 | 277 | 3,692 |
| of which connected | 673-1,692 | 648-971 | 144-216 | 1,465-2,879 | |
| Austria | in the base | 155 | 133 | 30 | 318 |
| of which connected | 48-121 | 69-104 | 15-23 | 132-248 | |
| Switzerland | in the base | 262 | 113 | 25 | 400 |
| of which connected | 81-205 | 59-88 | 13-20 | 153-313 |
Note: Size bands by employees, base year 2023 for Germany and Austria and 2024 for Switzerland, Germany in legal units, rows may not add up because of rounding. Sources: [37, 56, 175, 190, 367].
The 159 Austrian enterprises with 250 or more employees in divisions 26 to 28 employ 136,695 people.175 Switzerland has 82 enterprises with more than 249 employees in division 26 (including watch-makers), 24 in division 27 and 58 in division 28.56
A.3.3 By sector
Machinery (WZ 28) accounts for 2,075 of the 3,692 German manufacturers with 100 or more employees, more than half, and supplies three of the four archetypes.367 Only Germany publishes size bands below division level. The breakdown therefore covers Germany alone (Table 20).
| WZ 2008 | Products | 100-499 | 500-999 | 1,000+ | Total 100+ | Archetype supplied |
|---|---|---|---|---|---|---|
| 26 | Electronic and optical products | 533 | 64 | 52 | 649 | Logistics tracker |
| 26.5 | of which measuring, control, navigation | 262 | 29 | 22 | 313 | Machine, logistics tracker |
| 27 | Electrical equipment | 568 | 94 | 58 | 720 | Building device |
| 27.1 | of which motors, transformers, switchgear | 238 | 29 | 25 | 292 | Machine, building device |
| 27.5 | of which household appliances | 27 | 6 | 8 | 41 | Building device |
| 28 | Machinery and equipment | 1,724 | 207 | 144 | 2,075 | Battery tool, machine, building device |
| 28.1 | of which general-purpose machinery (pumps, valves, drives, hydraulics) | 381 | 58 | 45 | 484 | Machine |
| 28.2 | of which other general-purpose machinery | 533 | 50 | 46 | 629 | Battery tool, machine, building device |
| 28.24 | of which power-driven hand tools | 13 | 0 | 4 | 17 | Battery tool |
| 28.25 | of which cooling and ventilation, incl. heat pumps | 108 | n/p | n/p | n/p | Building device |
| 28.4 | of which machine tools | 192 | 27 | 12 | 231 | Machine |
| 28.9 | of which special-purpose machinery | 558 | 64 | 32 | 654 | Machine |
| 32.5 | Medical and dental instruments | 201 | 24 | 23 | 248 | Machine |
| Total | 3,026 | 389 | 277 | 3,692 |
Note: “n/p” marks cells suppressed for confidentiality. Source: [367].
Battery tool with BLE tracker. WZ 28.24 is a narrow class of large firms. It has 31 legal units with 20 or more employees, and the four with 1,000 or more account for 11,841 of the class’s 16,054 persons.367 Firms classified elsewhere also sell battery tools with trackers, for instance in metal products (division 25). The class therefore undercounts the archetype.
Machine with gateway. Division 28 alone has 2,075 legal units with 100 or more employees and 1.10 million persons in all units with 20 or more.367 Machine builders also show the highest connected share. In 2018, 24 % of them used IoT service platforms and a further 20 % planned to.190
Building device under § 14a EnWG. The archetype sits mainly in 28.25 (395 legal units with 20 or more employees, of which 108 with 100-499), in 28.21 (furnaces and burners, 127) and in division 27.367 Heat pump sales in Germany rose 55 % to 299,000 units in 2025, more than gas condensing boilers (229,000).81 Each heat pump that a grid operator can control under § 14a EnWG has a communication interface and is therefore a product with digital elements.171
Logistics tracker. Makers of equipment and trackers are spread across divisions 26 and 27. Specialist tracker makers are often below the 100-employee threshold. The large buyers of trackers are the tool and machine makers in this population.
A.3.4 Cross-check with the associations
The associations define their industries differently from official statistics. Their counts therefore confirm the order of magnitude of the official base but not its cells (Table 21).
| Association | Association figure | Official comparison figure |
|---|---|---|
| VDMA (Germany, machinery) | 6,459 enterprises, average 178.9 employees (2016); 6,653 enterprises, average 182.8 (2018) | WZ 28: 5,688 legal units with 20+ employees, 1,102,436 persons, average 194 (2023) |
| ZVEI (Germany, electrical and digital industry) | 872,700 employees end of 2025; turnover €226.8 bn in 2025 | WZ 26 + 27: 858,294 persons in legal units with 20+ employees (2023) |
| FEEI (Austria, electrical and electronics industry) | 71,932 employees, production €23.6 bn (2025) | ÖNACE 26 + 27: 86,938 employees (2023) |
| FMTI (Austria, metal technology industry) | 130,694 employees (December 2025), production €47.0 bn | ÖNACE 28: 104,506 employees (2023) |
| Swissmem (Switzerland, tech industry) | 322,900 employees in Q4 2025; exports CHF 68.1 bn in 2025 | NOGA 26-28: 233,716 employees (2024) |
| Swiss Medtech (Switzerland, medical technology) | about 1,400 firms, about 72,000 employees | NOGA 32.5: 1,472 institutional units, 19,990 employees (2022) |
VDMA. The official count for 2023 is lower than the VDMA’s, but the series are not comparable. The KSE covers only legal units with 20 or more persons, each classified by its main activity.367 The VDMA combines Destatis data with its own.404 It represents about 3,500 German and European member companies itself.406 On either count, about 2,000 German machine builders have 100 or more employees.367
ZVEI. Official employment in divisions 26 and 27 is of the same size as the ZVEI’s figure.367 The electrical and digital industry employed 1.9 % fewer people at the end of 2025 than a year before.416 The ZVEI expects real production to grow 2 % in 2026, with capacity utilisation at 78 % against a long-term average of 83 %.417
FEEI, FMTI and Swissmem. Swissmem and the FMTI define their industries more widely than the classes used here. Swissmem includes metal processing, the FMTI metal products. The FEEI’s count is lower than the ÖNACE 26 and 27 total because its membership does not cover every firm classified there.175, 181
Sources in this chapter30
Numbered as in the full reference list and the PDF.
- [36] Bitkom e.V. (2026). Cyber Resilience Act: Nur 3 von 10 Unternehmen sind vorbereitet. https://www.bitkom.org/Presse/Presseinformation/Cyber-Resilience-Act-3-von-10-Unternehmen-vorbereitet
- [37] Bitkom e.V. (2026). Industrie 4.0 - Wie digital ist Deutschlands Industrie? (Präsentation 2026). https://www.bitkom.org/sites/main/files/2026-04/bitkom-praesentation-industrie-4-0-wie-digital-ist-deutschlands-industrie-2026.pdf
- [55] Bundesamt für Statistik (BFS). (2025). Institutionelle Einheiten und Beschäftigte nach Jahr, Kanton, Wirtschaftsart und Beobachtungseinheit (px-x-0602010000_105). https://www.pxweb.bfs.admin.ch/pxweb/de/px-x-0602010000_105/px-x-0602010000_105.px/
- [56] Bundesamt für Statistik (BFS). (2026). Marktwirtschaftliche Unternehmen nach Wirtschaftsabteilungen und Grössenklasse (T 6.2.1.1), STATENT 2011-2024. https://dam-api.bfs.admin.ch/hub/api/dam/assets/36734571/master
- [81] Bundesverband der Deutschen Heizungsindustrie (BDH). (2026). Absatz Heizungen 2025 in Deutschland: Marktentwicklung Wärmemarkt 2025. https://www.bdh-industrie.de/fileadmin/user_upload/Downloads/PresseMeldungen/Absatzzahlen_Heizungen_Deutschland_2025.pdf
- [140] European Commission. (2021). Impact assessment accompanying Commission Delegated Regulation (EU) 2022/30 (Radio Equipment Directive, Article 3(3)(d), (e) and (f)), SWD(2021) 302 final. https://publications.europa.eu/resource/cellar/bc0a31a7-38a0-11ec-8daf-01aa75ed71a1.0001.02/DOC_1
- [141] European Commission. (2022). Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (RED) with regard to cybersecurity. https://eur-lex.europa.eu/eli/reg_del/2022/30/oj
- [143] European Commission. (2022). Impact assessment report accompanying the proposal for a Data Act, SWD(2022) 34 final. https://publications.europa.eu/resource/cellar/490c2d61-961f-11ec-b4e4-01aa75ed71a1.0001.02/DOC_1
- [144] European Commission. (2022). Impact assessment report accompanying the proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements, SWD(2022) 282 final. https://ec.europa.eu/newsroom/dae/redirection/document/89545
- [167] European Parliament and Council. (2023). Corrigendum to Regulation (EU) 2023/1230 on machinery (OJ L 169, 4.7.2023, p. 35): application dates corrected to 20 January 2027 and 20 January 2024. https://eur-lex.europa.eu/eli/reg/2023/1230/corrigendum/2023-07-04/oj
- [168] European Parliament and Council. (2023). Regulation (EU) 2023/1230 on machinery (Machinery Regulation). https://eur-lex.europa.eu/eli/reg/2023/1230/oj
- [169] European Parliament and Council. (2023). Regulation (EU) 2023/1542 concerning batteries and waste batteries (battery passport). https://eur-lex.europa.eu/eli/reg/2023/1542/oj
- [170] European Parliament and Council. (2023). Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). https://eur-lex.europa.eu/eli/reg/2023/2854/oj
- [171] European Parliament and Council. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). https://eur-lex.europa.eu/eli/reg/2024/2847/oj
- [175] Eurostat. (2026). Enterprise statistics by size class and NACE Rev. 2 activity (from 2021 onwards), dataset sbs_sc_ovw. https://ec.europa.eu/eurostat/databrowser/view/sbs_sc_ovw/default/table
- [181] Fachverband der Elektro- und Elektronikindustrie (FEEI). (2026). Zahlen, Daten, Fakten 2026: Die Elektro- und Elektronikindustrie in Österreich. https://www.feei.at/wp-content/uploads/2026/07/feei-zahlen-daten-fakten-folder-2026.pdf
- [182] Fachverband Metalltechnische Industrie (FMTI). (2026). Jahreszahlen MTI 2025 (vorläufig). https://www.metalltechnischeindustrie.at/fileadmin/content/Dokumente/Zahlen_Daten_Fakten/Metalltechnische_Industrie_Jahr_2025vorl.pdf
- [190] Fraunhofer-Institut für System- und Innovationsforschung ISI. (2020). Digitale Plattformen im Verarbeitenden Gewerbe (Mitteilungen aus der ISI-Erhebung Modernisierung der Produktion, Nr. 77). https://www.isi.fraunhofer.de/content/dam/isi/dokumente/modernisierung-produktion/erhebung2018/PI_77_B2B_Plattformoekonomie.pdf
- [307] ONEKEY GmbH. (2026). IoT & OT Cybersecurity Report 2026. https://www.onekey.com/resource/onekey-iot-ot-cybersecurity-report-2026
- [330] PwC Deutschland. (2026). Product Security Survey 2026: Digital vernetzt, aber auch sicher? https://www.pwc.de/de/cyber-security/product-cyber-security/pwc-product-security-survey-2026.html
- [366] Statistisches Bundesamt (Destatis). (2019). Kostenstruktur der Unternehmen des Verarbeitenden Gewerbes sowie des Bergbaus und der Gewinnung von Steinen und Erden 2017 (Fachserie 4 Reihe 4.3). https://www.destatis.de/DE/Themen/Branchen-Unternehmen/Industrie-Verarbeitendes-Gewerbe/Publikationen/Downloads-Struktur/kostenstruktur-2040430177004.pdf?__blob=publicationFile
- [367] Statistisches Bundesamt (Destatis). (2025). Statistischer Bericht - Kostenstrukturerhebung im Verarbeitenden Gewerbe sowie im Bergbau und der Gewinnung von Steinen und Erden - 2023 (Tabelle 42251-01: Rechtliche Einheiten nach Wirtschaftszweigen und Beschäftigtengrößenklassen). https://www.destatis.de/DE/Themen/Branchen-Unternehmen/Industrie-Verarbeitendes-Gewerbe/Publikationen/Downloads-Struktur/statistischer-bericht-kostenstruktur-2040430237005.html
- [371] Swiss Medtech. (2026). Medtech-Branchenstudie 2026: Zahlen und Fakten im Überblick. https://www.swiss-medtech.ch/sites/default/files/2026-09/2026_SMTI_Faktenblatt_DE.pdf
- [378] Swissmem. (2026). Die Tech-Industrie zwischen Stagnation und Lichtblicken. https://www.swissmem.ch/de/mediencorner/medienmitteilungen/die-tech-industrie-zwischen-stagnation-und-lichtblicken.html
- [404] VDMA. (2018). Maschinenbau in Zahl und Bild 2018. https://www.messe.de/apollo/hannover_messe_2020/obs/Binary/A1004789/1004789_02146924.pdf
- [405] VDMA. (2020). Maschinenbau in Zahl und Bild 2020. https://www.vdma.eu/documents/34570/0/MbauinZuB2020.pdf
- [406] VDMA. (2026). Maschinenbau in Zahl & Bild. https://www.vdma.eu/de/maschinenbau-zahl-bild
- [410] Wavestone and ICF and CEPS and CARSA. (2021). Study on the need of cybersecurity requirements for ICT products, No. 2020-0715, final study report. https://ec.europa.eu/newsroom/dae/redirection/document/82006
- [416] ZVEI e.V. (2026). Elektro- und Digitalindustrie stabil ins Jahr gestartet. https://www.zvei.org/presse-medien/pressebereich/elektro-und-digitalindustrie-stabil-ins-jahr-gestartet
- [417] ZVEI e.V. (2026). ZVEI: Elektro- und Digitalindustrie 2026 wieder mit Wachstum. https://www.zvei.org/presse-medien/pressebereich/zvei-elektro-und-digitalindustrie-2026-wieder-mit-wachstum