EU Cyber Resilience Act (CRA) Compliance Cost & Sizing Estimator
Build a user-input project budget and staffing estimate for EU Cyber Resilience Act (CRA) preparation work. This calculator does not decide whether the CRA applies, interpret legal duties or determine compliance status.
Result
Estimated first-year project and support cost
Repositories in scope
One-time engineering/governance hours
Estimated one-time labor and assessment cost
Ongoing monthly security work
Estimated ongoing monthly labor cost
Average implementation FTEs
How to use this tool
- Define the product variants and repositories your own team has chosen to include in the estimate.
- Enter one-time engineering and governance hours per repository/variant for work your team has scoped, such as SBOM coverage, vulnerability handling, documentation or security testing.
- Add ongoing monthly security hours, implementation duration, loaded GBP hourly rate and any external assessment budget per variant.
- Review the one-time estimate, average implementation FTEs and first-year cost; replace defaults with your own plan and quotations.
Assumptions
- All product counts, activities, hours, costs and durations are supplied by the user; the tool does not infer CRA scope, product class, manufacturer role or mandatory controls.
- The first-year estimate assumes ongoing work begins immediately and continues for 12 months; it does not model later years, inflation, taxes or discounting.
- The 160 productive hours per FTE-month is a planning convention used only for the staffing estimate, not a legal or industry requirement.
- This is a cost-sizing worksheet, not legal advice, a compliance assessment or a statement that any product is compliant with the EU Cyber Resilience Act.
Sources & reference data
Technical details: what the fields mean
- Product variants in scope
productVariants - Number of product variants your organization has decided to include; the tool does not determine legal product classification.
- Repositories per variant
repositoriesPerVariant - Repositories included per variant in your scoped engineering estimate.
- One-time engineering hours per repository
engineeringHoursPerRepository - One-time engineering effort you estimate for each repository, in hours.
- One-time governance/documentation hours per variant
governanceHoursPerVariant - One-time product-level documentation, coordination or governance effort you choose to budget.
- Ongoing security hours per variant
monthlySecurityHoursPerVariant - Ongoing monthly hours per product variant for the activities your team scopes, such as vulnerability intake, patch handling and release documentation.
- Implementation duration
implementationMonths - Months over which one-time engineering and governance work will be delivered; used to estimate average FTE load.
- Loaded engineering hourly rate
loadedHourlyRateGbp - Your loaded engineering cost per hour in GBP, including the labor-cost components you choose to include.
- External assessment cost per variant
externalAssessmentGbpPerVariant - User-supplied third-party assessment or testing budget per product variant. Set to 0 if none is planned.
Methodology
Repositories = product variants × repositories per variant. One-time hours = repositories × engineering hours per repository + variants × governance hours per variant. One-time cost = hours × loaded rate + external assessment cost. Monthly support cost = variants × monthly hours per variant × rate. First-year estimate = one-time cost + 12 × monthly support cost. Average implementation FTE = one-time hours ÷ (implementation months × 160 assumed productive hours/month).
Worked example
Three product variants with four repositories each
Inputs: Product variants in scope: 3 variants, Repositories per variant: 4 repos/variant, One-time engineering hours per repository: 80 hours/repo, One-time governance/documentation hours per variant: 60 hours/variant, Ongoing security hours per variant: 8 hours/variant/month, Implementation duration: 6 months, Loaded engineering hourly rate: 70 GBP/hour, External assessment cost per variant: 5000 GBP/variant
Result: 12 repositories and 1,140 one-time hours. One-time labor plus assessments is £94,800; ongoing work is 24 hours/month (£1,680/month). Estimated first-year total is £114,960 and average implementation load is 1.19 FTEs.
Practical guidance
- Treat the activity list and hour estimates as your own project scope. Validate CRA applicability, product classification, roles and deadlines with qualified legal/compliance advisers.
- Break repository work into your chosen work packages (for example SBOM inventory, vulnerability intake, patch/release process, security testing and documentation) to avoid double-counting shared infrastructure.
Common mistakes
- Treating this output as a CRA legal determination or as proof that every listed activity is mandatory for every product.
- Multiplying shared repository or platform work by every product variant without checking whether the cost is actually shared.
- Forgetting ongoing vulnerability/security work when comparing only one-time implementation cost.
FAQs
Does this determine whether the CRA applies to my product?
No. Product scope, roles and obligations require a separate legal analysis. This tool only multiplies the work and costs you enter.
Are the default hours required by the CRA?
No. Defaults are illustrative planning inputs, not regulatory estimates or mandated effort.
Last reviewed: 2026-10-18
A transparent cost and staffing worksheet only. It does not interpret Regulation (EU) 2024/2847, determine scope/classification, set deadlines, or certify compliance; use qualified legal/compliance advice for those questions.
This tool provides an indicative estimate, based on the assumptions stated above.
Theme and tool preferences, along with saved and recently used lists, are stored only in this browser.