Appendix A

AMethod

9 min read · 6 figures · 3 tables · 30 sources

Every number in the report rests on published sources or on assumptions marked as such. No survey of our own and no negotiated prices are used. Our cost model and our estimate of the number of makers of connected products (Section 1.5) rest partly on assumptions.

A.1 Sources

The evidence falls into six kinds:

  • Legal texts. Dates and obligations are taken from the application articles of the legal texts, as corrected.141, 167, 168, 169, 170, 171 The status of harmonised standards and of notified bodies is taken from the Official Journal, the Commission’s NANDO database and the European standardisation organisations.
  • Official statistics. Enterprise counts come from the German cost structure survey for 2023, Eurostat’s structural business statistics for Austria (2023) and the Swiss enterprise census STATENT (2024).56, 175, 367
  • Surveys. The share of firms that offer connected functions and the readiness signals come from published surveys of 100 to 1,003 firms, run by research institutes, associations, consultancies and vendors.36, 37, 190, 307, 330 Each reflects how firms assess themselves.
  • Prices. All prices are list prices currently published by vendors and distributors. We leave vendors that publish no price out of our cost model, and we do not estimate a price for them.
  • Compliance cost estimates. The per-product cost of the CRA and the cost of third-party testing come from the Commission’s impact assessments and support study.140, 143, 144, 410
  • Market events. Acquisitions, product launches and service closures come from the companies’ own announcements and from the business and legal press.

A.2 Measured and assumed

We calculate the cost per device with a cost model of our own for the four archetypes (Appendix C). Its only assumptions are the radio, data traffic, security hardware and update service per archetype, and every other number in the model is a list price with its source.

Our population estimate starts from official enterprise counts. The assumptions are the share of firms that make connected products, the split of the German 100-499 band by the 2017 ratio, the size structure for Austria and Switzerland, and two employment-weighted approximations for Switzerland.

A.3 Population estimate

No statistical office counts “manufacturers of connected products”. We therefore estimate 1,750-3,440 such manufacturers. To get there, we multiply official enterprise counts by industry and size band56, 175, 367 by a low and a high survey-based share. The connected share rests on surveys, not registers, and is therefore the weakest step. In a later edition we plan to replace it with signals from the RUBINLAKE platform.

A.3.1 Method in four steps

Step 1: industry classes. We count enterprises in four classes of WZ 2008 (Germany), ÖNACE 2008 (Austria) and NOGA 2008 (Switzerland), which match NACE Rev. 2 at this level: division 26 (computer, electronic and optical products, including measuring, control and navigation instruments), division 27 (electrical equipment, including motors, switchgear, wiring devices and household appliances), division 28 (machinery and equipment n.e.c., including power tools, heat pumps and machine tools) and group 32.5 (medical and dental instruments). We leave out divisions 29 and 30 (vehicles) because vehicles under EU type approval fall outside the CRA.171 We keep groups 26.1 (components and boards) and 27.3 (cables and wiring devices) in the base, since their parts can themselves be products with digital elements under the CRA.171

Step 2: size bands. The German cost structure survey (Kostenstrukturerhebung, KSE) counts legal units with 20 or more persons employed in the bands 20-49, 50-99, 100-499, 500-999 and 1,000 and more.367 We split 100-499 into 100-249 and 250-499 with the ratio of the last KSE edition that published both bands (reference year 2017). Then, 73 % of the 100-499 firms in division 26 had fewer than 250 employees, 71 % each in divisions 27 and 28, and 74 % across manufacturing.366 We use the manufacturing value for group 32.5. Austria and Switzerland publish only the bands 50-249 and 250 or more.56, 175 We apply the German structure to both. In the four classes, 47 % of German firms with 50-249 employees have 100 or more, and 18 % of those with 250 or more have 1,000 or more.367 This is an assumption. Austrian and Swiss firms in the 250+ band are smaller on average. Our 1,000+ cells for both countries are therefore more likely too high than too low.

Step 3: national adjustments. Swiss division 26 includes watch-making (NOGA 26.52), which accounts for 47.7 % of the division’s 117,217 employees.55 We remove that share from the Swiss division-26 counts. Switzerland does not publish group 32.5 by size band. We therefore scale division 32 by the 66.8 % of its employment that falls in group 32.5.55 Both are employment-weighted approximations.

Step 4: connected share. The connected share sets the width of the range. We apply a low and a high share of firms that make connected products:

  • Low: the share of establishments that used, or planned by 2021 to use, IoT service platforms to offer digital services, from Fraunhofer ISI’s German Manufacturing Survey 2018, 17 % plus 14 % for 50-249 employees and 37 % plus 15 % for 250 or more.190 We use 31 % for the 100-249 band and 52 % above. The share is old and measures platform use rather than product features. We therefore treat it as the floor.
  • High: the share of German manufacturers with 100 or more employees that use IoT platforms (45 %) or plan to (33 %), Bitkom 2026, n = 555.37 That gives 78 %, which we apply to all bands. The question covers IoT platforms in production as well as in products, so it marks the ceiling.

Each estimate per country and size band is the base count times the share. The 277 German legal units with 1,000 or more employees give 144 makers at 52 % and 216 at 78 %.37, 190, 367

Top band. No official source breaks at 5,000 employees. The top band of 1,000-4,999 therefore also contains firms with 5,000 or more. The KSE’s 1,000+ class has 277 German legal units in the four classes with 867,062 persons, an average of 3,130.367 The KSE counts legal units. The subsidiaries of large groups therefore appear separately, and most of them fall below 5,000. We deduct no 5,000+ class and so overstate the top band slightly.

A.3.2 By country and size band

Germany holds more than four fifths of the population, 3,692 of the 4,410 firms in the base and 1,465-2,879 of the 1,750-3,440 estimated makers. Austria adds 132-248 and Switzerland 153-313 (Table 19).

Country Firms 100-249 250-999 1,000-4,999 Total
Germany in the base 2,170 1,245 277 3,692
of which connected 673-1,692 648-971 144-216 1,465-2,879
Austria in the base 155 133 30 318
of which connected 48-121 69-104 15-23 132-248
Switzerland in the base 262 113 25 400
of which connected 81-205 59-88 13-20 153-313
Table 19: Population and range by country and size band

Note: Size bands by employees, base year 2023 for Germany and Austria and 2024 for Switzerland, Germany in legal units, rows may not add up because of rounding. Sources: [37, 56, 175, 190, 367].

The 159 Austrian enterprises with 250 or more employees in divisions 26 to 28 employ 136,695 people.175 Switzerland has 82 enterprises with more than 249 employees in division 26 (including watch-makers), 24 in division 27 and 58 in division 28.56

A.3.3 By sector

Machinery (WZ 28) accounts for 2,075 of the 3,692 German manufacturers with 100 or more employees, more than half, and supplies three of the four archetypes.367 Only Germany publishes size bands below division level. The breakdown therefore covers Germany alone (Table 20).

WZ 2008 Products 100-499 500-999 1,000+ Total 100+ Archetype supplied
26 Electronic and optical products 533 64 52 649 Logistics tracker
26.5 of which measuring, control, navigation 262 29 22 313 Machine, logistics tracker
27 Electrical equipment 568 94 58 720 Building device
27.1 of which motors, transformers, switchgear 238 29 25 292 Machine, building device
27.5 of which household appliances 27 6 8 41 Building device
28 Machinery and equipment 1,724 207 144 2,075 Battery tool, machine, building device
28.1 of which general-purpose machinery (pumps, valves, drives, hydraulics) 381 58 45 484 Machine
28.2 of which other general-purpose machinery 533 50 46 629 Battery tool, machine, building device
28.24 of which power-driven hand tools 13 0 4 17 Battery tool
28.25 of which cooling and ventilation, incl. heat pumps 108 n/p n/p n/p Building device
28.4 of which machine tools 192 27 12 231 Machine
28.9 of which special-purpose machinery 558 64 32 654 Machine
32.5 Medical and dental instruments 201 24 23 248 Machine
Total 3,026 389 277 3,692
Table 20: German manufacturers by WZ group, 2023

Note: “n/p” marks cells suppressed for confidentiality. Source: [367].

Battery tool with BLE tracker. WZ 28.24 is a narrow class of large firms. It has 31 legal units with 20 or more employees, and the four with 1,000 or more account for 11,841 of the class’s 16,054 persons.367 Firms classified elsewhere also sell battery tools with trackers, for instance in metal products (division 25). The class therefore undercounts the archetype.

Machine with gateway. Division 28 alone has 2,075 legal units with 100 or more employees and 1.10 million persons in all units with 20 or more.367 Machine builders also show the highest connected share. In 2018, 24 % of them used IoT service platforms and a further 20 % planned to.190

Building device under § 14a EnWG. The archetype sits mainly in 28.25 (395 legal units with 20 or more employees, of which 108 with 100-499), in 28.21 (furnaces and burners, 127) and in division 27.367 Heat pump sales in Germany rose 55 % to 299,000 units in 2025, more than gas condensing boilers (229,000).81 Each heat pump that a grid operator can control under § 14a EnWG has a communication interface and is therefore a product with digital elements.171

Logistics tracker. Makers of equipment and trackers are spread across divisions 26 and 27. Specialist tracker makers are often below the 100-employee threshold. The large buyers of trackers are the tool and machine makers in this population.

A.3.4 Cross-check with the associations

The associations define their industries differently from official statistics. Their counts therefore confirm the order of magnitude of the official base but not its cells (Table 21).

Association Association figure Official comparison figure
VDMA (Germany, machinery) 6,459 enterprises, average 178.9 employees (2016); 6,653 enterprises, average 182.8 (2018) WZ 28: 5,688 legal units with 20+ employees, 1,102,436 persons, average 194 (2023)
ZVEI (Germany, electrical and digital industry) 872,700 employees end of 2025; turnover €226.8 bn in 2025 WZ 26 + 27: 858,294 persons in legal units with 20+ employees (2023)
FEEI (Austria, electrical and electronics industry) 71,932 employees, production €23.6 bn (2025) ÖNACE 26 + 27: 86,938 employees (2023)
FMTI (Austria, metal technology industry) 130,694 employees (December 2025), production €47.0 bn ÖNACE 28: 104,506 employees (2023)
Swissmem (Switzerland, tech industry) 322,900 employees in Q4 2025; exports CHF 68.1 bn in 2025 NOGA 26-28: 233,716 employees (2024)
Swiss Medtech (Switzerland, medical technology) about 1,400 firms, about 72,000 employees NOGA 32.5: 1,472 institutional units, 19,990 employees (2022)
Table 21: Association figures and the official base

Sources: [55, 56, 175, 181, 182, 367, 371, 378, 404, 405, 416].

VDMA. The official count for 2023 is lower than the VDMA’s, but the series are not comparable. The KSE covers only legal units with 20 or more persons, each classified by its main activity.367 The VDMA combines Destatis data with its own.404 It represents about 3,500 German and European member companies itself.406 On either count, about 2,000 German machine builders have 100 or more employees.367

ZVEI. Official employment in divisions 26 and 27 is of the same size as the ZVEI’s figure.367 The electrical and digital industry employed 1.9 % fewer people at the end of 2025 than a year before.416 The ZVEI expects real production to grow 2 % in 2026, with capacity utilisation at 78 % against a long-term average of 83 %.417

FEEI, FMTI and Swissmem. Swissmem and the FMTI define their industries more widely than the classes used here. Swissmem includes metal processing, the FMTI metal products. The FEEI’s count is lower than the ÖNACE 26 and 27 total because its membership does not cover every firm classified there.175, 181

Sources in this chapter30

Numbered as in the full reference list and the PDF.

  1. [36] Bitkom e.V. (2026). Cyber Resilience Act: Nur 3 von 10 Unternehmen sind vorbereitet. https://www.bitkom.org/Presse/Presseinformation/Cyber-Resilience-Act-3-von-10-Unternehmen-vorbereitet
  2. [37] Bitkom e.V. (2026). Industrie 4.0 - Wie digital ist Deutschlands Industrie? (Präsentation 2026). https://www.bitkom.org/sites/main/files/2026-04/bitkom-praesentation-industrie-4-0-wie-digital-ist-deutschlands-industrie-2026.pdf
  3. [55] Bundesamt für Statistik (BFS). (2025). Institutionelle Einheiten und Beschäftigte nach Jahr, Kanton, Wirtschaftsart und Beobachtungseinheit (px-x-0602010000_105). https://www.pxweb.bfs.admin.ch/pxweb/de/px-x-0602010000_105/px-x-0602010000_105.px/
  4. [56] Bundesamt für Statistik (BFS). (2026). Marktwirtschaftliche Unternehmen nach Wirtschaftsabteilungen und Grössenklasse (T 6.2.1.1), STATENT 2011-2024. https://dam-api.bfs.admin.ch/hub/api/dam/assets/36734571/master
  5. [81] Bundesverband der Deutschen Heizungsindustrie (BDH). (2026). Absatz Heizungen 2025 in Deutschland: Marktentwicklung Wärmemarkt 2025. https://www.bdh-industrie.de/fileadmin/user_upload/Downloads/PresseMeldungen/Absatzzahlen_Heizungen_Deutschland_2025.pdf
  6. [140] European Commission. (2021). Impact assessment accompanying Commission Delegated Regulation (EU) 2022/30 (Radio Equipment Directive, Article 3(3)(d), (e) and (f)), SWD(2021) 302 final. https://publications.europa.eu/resource/cellar/bc0a31a7-38a0-11ec-8daf-01aa75ed71a1.0001.02/DOC_1
  7. [141] European Commission. (2022). Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (RED) with regard to cybersecurity. https://eur-lex.europa.eu/eli/reg_del/2022/30/oj
  8. [143] European Commission. (2022). Impact assessment report accompanying the proposal for a Data Act, SWD(2022) 34 final. https://publications.europa.eu/resource/cellar/490c2d61-961f-11ec-b4e4-01aa75ed71a1.0001.02/DOC_1
  9. [144] European Commission. (2022). Impact assessment report accompanying the proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements, SWD(2022) 282 final. https://ec.europa.eu/newsroom/dae/redirection/document/89545
  10. [167] European Parliament and Council. (2023). Corrigendum to Regulation (EU) 2023/1230 on machinery (OJ L 169, 4.7.2023, p. 35): application dates corrected to 20 January 2027 and 20 January 2024. https://eur-lex.europa.eu/eli/reg/2023/1230/corrigendum/2023-07-04/oj
  11. [168] European Parliament and Council. (2023). Regulation (EU) 2023/1230 on machinery (Machinery Regulation). https://eur-lex.europa.eu/eli/reg/2023/1230/oj
  12. [169] European Parliament and Council. (2023). Regulation (EU) 2023/1542 concerning batteries and waste batteries (battery passport). https://eur-lex.europa.eu/eli/reg/2023/1542/oj
  13. [170] European Parliament and Council. (2023). Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). https://eur-lex.europa.eu/eli/reg/2023/2854/oj
  14. [171] European Parliament and Council. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  15. [175] Eurostat. (2026). Enterprise statistics by size class and NACE Rev. 2 activity (from 2021 onwards), dataset sbs_sc_ovw. https://ec.europa.eu/eurostat/databrowser/view/sbs_sc_ovw/default/table
  16. [181] Fachverband der Elektro- und Elektronikindustrie (FEEI). (2026). Zahlen, Daten, Fakten 2026: Die Elektro- und Elektronikindustrie in Österreich. https://www.feei.at/wp-content/uploads/2026/07/feei-zahlen-daten-fakten-folder-2026.pdf
  17. [182] Fachverband Metalltechnische Industrie (FMTI). (2026). Jahreszahlen MTI 2025 (vorläufig). https://www.metalltechnischeindustrie.at/fileadmin/content/Dokumente/Zahlen_Daten_Fakten/Metalltechnische_Industrie_Jahr_2025vorl.pdf
  18. [190] Fraunhofer-Institut für System- und Innovationsforschung ISI. (2020). Digitale Plattformen im Verarbeitenden Gewerbe (Mitteilungen aus der ISI-Erhebung Modernisierung der Produktion, Nr. 77). https://www.isi.fraunhofer.de/content/dam/isi/dokumente/modernisierung-produktion/erhebung2018/PI_77_B2B_Plattformoekonomie.pdf
  19. [307] ONEKEY GmbH. (2026). IoT & OT Cybersecurity Report 2026. https://www.onekey.com/resource/onekey-iot-ot-cybersecurity-report-2026
  20. [330] PwC Deutschland. (2026). Product Security Survey 2026: Digital vernetzt, aber auch sicher? https://www.pwc.de/de/cyber-security/product-cyber-security/pwc-product-security-survey-2026.html
  21. [366] Statistisches Bundesamt (Destatis). (2019). Kostenstruktur der Unternehmen des Verarbeitenden Gewerbes sowie des Bergbaus und der Gewinnung von Steinen und Erden 2017 (Fachserie 4 Reihe 4.3). https://www.destatis.de/DE/Themen/Branchen-Unternehmen/Industrie-Verarbeitendes-Gewerbe/Publikationen/Downloads-Struktur/kostenstruktur-2040430177004.pdf?__blob=publicationFile
  22. [367] Statistisches Bundesamt (Destatis). (2025). Statistischer Bericht - Kostenstrukturerhebung im Verarbeitenden Gewerbe sowie im Bergbau und der Gewinnung von Steinen und Erden - 2023 (Tabelle 42251-01: Rechtliche Einheiten nach Wirtschaftszweigen und Beschäftigtengrößenklassen). https://www.destatis.de/DE/Themen/Branchen-Unternehmen/Industrie-Verarbeitendes-Gewerbe/Publikationen/Downloads-Struktur/statistischer-bericht-kostenstruktur-2040430237005.html
  23. [371] Swiss Medtech. (2026). Medtech-Branchenstudie 2026: Zahlen und Fakten im Überblick. https://www.swiss-medtech.ch/sites/default/files/2026-09/2026_SMTI_Faktenblatt_DE.pdf
  24. [378] Swissmem. (2026). Die Tech-Industrie zwischen Stagnation und Lichtblicken. https://www.swissmem.ch/de/mediencorner/medienmitteilungen/die-tech-industrie-zwischen-stagnation-und-lichtblicken.html
  25. [404] VDMA. (2018). Maschinenbau in Zahl und Bild 2018. https://www.messe.de/apollo/hannover_messe_2020/obs/Binary/A1004789/1004789_02146924.pdf
  26. [405] VDMA. (2020). Maschinenbau in Zahl und Bild 2020. https://www.vdma.eu/documents/34570/0/MbauinZuB2020.pdf
  27. [406] VDMA. (2026). Maschinenbau in Zahl & Bild. https://www.vdma.eu/de/maschinenbau-zahl-bild
  28. [410] Wavestone and ICF and CEPS and CARSA. (2021). Study on the need of cybersecurity requirements for ICT products, No. 2020-0715, final study report. https://ec.europa.eu/newsroom/dae/redirection/document/82006
  29. [416] ZVEI e.V. (2026). Elektro- und Digitalindustrie stabil ins Jahr gestartet. https://www.zvei.org/presse-medien/pressebereich/elektro-und-digitalindustrie-stabil-ins-jahr-gestartet
  30. [417] ZVEI e.V. (2026). ZVEI: Elektro- und Digitalindustrie 2026 wieder mit Wachstum. https://www.zvei.org/presse-medien/pressebereich/zvei-elektro-und-digitalindustrie-2026-wieder-mit-wachstum
Next

Contents

Report overview
  1. 1Deadlines and scope
  2. 2Device requirements
  3. 3Cost per device
  4. 4Technology and architecture
  5. 5Spotlight: logistics tracking
  6. 6Spotlight: Austria and Switzerland
  7. 7Vendor landscape
  8. 8Recommendations
  9. AMethod
  10. BLegal basis
  11. CCost model
  12. DVendor directory
  13. EFunding programmes
  14. About RUBINLAKE
  15. Disclaimer
  16. References