Up to €30,000 for gap analysis, pentesting, or SBOM. Why machine builders should use the SECURE Open Call but not wait for the funding.
What the SECURE Open Call funds
The second round has a budget of €11.5 million. It funds 50 percent of project costs, up to €30,000 per company. Projects may last no longer than 180 days. Eligible activities include, among others:
- CRA gap analysis, risk analysis and action plan
- Vulnerability and penetration tests
- Security by design in software development
- Supply chain assessment
- Training on CRA requirements
- Tools such as SBOM tools or vulnerability scanners
Work may be carried out by in‑house staff or external service providers. This round does not fund certification, third‑party conformity assessment, or support for technical documentation.
Individual SMEs from the EU and the EEA are eligible to apply; consortia are excluded. Applications must be submitted in English; decisions are announced roughly three months after the submission deadline.
Money is paid for achieved goals
The grant is a lump sum. It is paid out when the project has achieved and demonstrated the goals promised in the application. On request, a 40 percent advance can be provided, with the remainder paid after the final report. If goals are only partially met, payment will be reduced proportionally. Plan goals you can confidently achieve and demonstrate within 180 days, for example a certain number of tested interfaces.
Two points the call leaves open
Support for documentation is excluded, while the risk analysis is funded. The risk analysis itself is part of the technical documentation. The call does not specify where the boundary lies. Emphasize analysis and implementation work in your application.
Whether a company is eligible is checked by the national coordination centre for cybersecurity. The documents do not make clear whether the German centre at the BSI participates in the call. Clarify this before applying.
The funded project ends shortly before the compliance deadline
| Step | Time |
| Submission deadline | 11 December 2026 |
| Funding decision | around March 2027 |
| Project start | around April 2027 |
| Project end | around October 2027 |
| Full application of the CRA | 11 December 2027 |
Costs incurred before the project start are not eligible. The reporting obligations for exploited vulnerabilities have already been in force since 11 September 2026 (more on this).
Start CRA implementation yourself
The Secuvise CRA template package contains editable process descriptions, RACI matrices, mapping tables and checklists. Modules are available individually or as a package.
Apply for CRA funding and still start now
We recommend applying for the funding but not waiting for it. If you receive approval, it relieves your budget. If you only start after the decision, you will have only eight months from April 2027 for gap analysis, risk assessment, vulnerability processes, technical documentation and the declaration of conformity. That is not enough for most products.
Because work before the project start is not eligible, include tasks in the application that would only be tackled later anyway. For example, the manufacturer of a networked machine controller with remote maintenance can clarify product class, gaps and risks now. In the application they list the penetration test of the remote maintenance, an SBOM tool and the assessment of their suppliers. If the application is rejected, only the funding is missing; the schedule remains intact.
A completed gap analysis also strengthens the application because reviewers can assess how concretely the gap to the CRA is described.
You can find the call and documents on the SECURE website: https://www.secure4sme.eu/cascade-funding/second-open-call. Applications are submitted via the application platform: https://opencall.secure4sme.eu/
Start CRA implementation with a workshop
In two days we clarify with your team the impact, product class and the most important gaps. The result is the basis for your implementation plan and a funding application.
