No quote needed
Cyber Resilience Act work, priced in public
Every price published, nothing monthly, and whatever you pay first comes off the total in full — with no time limit on it.
Updated 27 September 2026
What you can buy today
Most of the firms we work with have two dates to worry about and nobody whose job it is to worry about them. The first of those dates is the reporting duty, and the package for it is on sale. Alongside it there is a one-off set-up that leaves your own people watching your own product on a tool you own.
There is a third piece of work — the one for the later date — and we have taken it off this list rather than price something we are not prepared to sell you yet. The section under these cards says what it is and exactly why. It changes nothing about the two below.
Everything you pay us comes off that later package in full, and the credit never expires. Not a percentage of it and not a voucher: the whole of it, whenever you take that step, however long you take. It is written into the agreement you sign.
Start here
Get ready to report now
Reporting Ready
€3,500per unit
The duty to tell an authority when a weakness in your product is being exploited — or when a serious incident hits its security, which does not have to be an attack — applies from 11 September 2026. This is the work that leaves you able to do it.
- a published way for outsiders to report a problem to you, and a person who answers
- a written plan keyed to the legal clocks, practised once with your team
- the message to the customers the product affects, drafted alongside the ones for the authorities, because telling them is part of the same duty
- a list of everything inside your product, produced by your own build
- the paperwork folder started, holding the evidence you have just made
Set up the watching and own it
Monitoring set-up, in your own account
€1,500per unit
New weaknesses turn up in other people's code every week, and some of them will be in yours. Somebody has to be looking, and under this law that somebody is you. We help you set that up, and we tell you what to do when the tool tells you something.
- a tool chosen with you, and why, written down as your decision
- set up in an account you own, against your own component list
- the alerts routed to your own people, not to us
- one page telling them what to do when an alert arrives, and the keys
Prices exclude VAT. French customers pay French VAT. EU business customers outside France account for VAT under the reverse charge. No EU VAT applies outside the EU.
The package we are not selling yet
It is called Market Ready, and it is the bigger job: every essential requirement met, the technical file written, the risk assessment done and the declaration drafted for you to sign as the manufacturer. It is the work for the date when the rest of the law lands. The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] We are not taking money for it at the moment, so it has come off the price list rather than sitting on it with a price you cannot pay.
The deadline is not the problem. The duties are settled law and the date is fixed, so if you are told the law might still be rewritten before then, that is not what it says. What is still being written is the means of showing that you have met it, and that is a different thing.
To show that a product meets those duties you point at a European standard, and no such standard has been published for this law yet. As at 10 September 2026, no harmonised standard for the Cyber Resilience Act had had its reference published in the Official Journal, so the presumption of conformity that comes with a harmonised standard was not available and our controls are versioned against the drafts. This is a point-in-time check: it must be re-read and re-dated before it is quoted anywhere, because the day a reference is published the sentence stops being true.[Regulation (EU) 2024/2847 Art. 27(1) — the presumption attaches on publication of the reference in the Official Journal by the Commission, not on adoption by CEN-CENELEC, so the page in source_url cannot evidence an absence from the Official Journal and is the wrong source for this row. The value is the date we last checked, not a figure from the provision.] Until one is, a technical file and a declaration are written against drafts that can still move underneath them.
For some products that is not only awkward, it changes the route entirely. Conformity assessment uses the modules in Annex VIII. A default product may use internal control (module A), or, if the manufacturer prefers, EU-type examination with production control (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme where one is available and applicable. An important class I product must go to a notified body under modules B and C or under module H whenever the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial — and also where no such standard, specification or scheme exists at all. An important class II product must use modules B and C, module H, or such a certification scheme; there is no internal-control route for it.[Art. 32(1), 32(2), 32(3); Annex VIII]
As at 10 September 2026 no harmonised standard had been published for the Cyber Resilience Act, so a class I manufacturer could not reach the internal-control route by that road. That is a point-in-time check and not a permanent state: the day a reference is published, the sentence stops being true. Whether a common specification or a European cybersecurity certification scheme at assurance level at least substantial covers a given category is a separate question we have not established, so check those two before concluding that a notified body is unavoidable.[Art. 32(2)]So we will not charge you for a conformity file measured against a draft, and then charge you again to redo it. That is a decision about our own conduct and not a reading of your obligations: the work is ready, we will still talk it through with you, plan it with you and tell you what it will involve. It goes back on sale when the references are published.
We are not giving you a date for that, and you should be suspicious of anyone who does. Publishing those standards is not our work and not our timetable, and a date we invented would be a promise about somebody else's diary. What we can put a date on is our own side of it, and we have: everything below is what happens to your money in the meantime.
Start without committing to anything
Nothing at the front of this costs much, and nothing at the front of this is wasted.
Check whether the law covers you
Automated scope check
Free
Two minutes on this site. Whether the law reaches your product, which group it falls into, and which dates apply to you. No account, no call, nothing to sign, and the answer is yours to keep.
Every line of that answer names the article and paragraph it applies, so you or your own adviser can go straight to the text and check us. Nobody calls you afterwards unless you ask, and you can act on the result without ever speaking to us.
Know where you stand
Scoping and classification memo
€900credited in full, and it never expires
The same job done properly, in writing, with an engineer's name on it: what we found, why, the dates that apply to you and the three things to do first. Half of what people buy this for is having something to show a customer who has started asking.
Everything you pay comes off, and it never expires
This is the part that makes buying now a safe decision, so we would rather over-explain it than leave you working it out.
Whatever you have already paid us comes off Market Ready in full: not a percentage of it, not a voucher for it, the whole of it. Everything means everything, and it is worth being literal about it, because this is the sort of sentence firms write and then qualify in the contract: the scoping memo, Reporting Ready, the gap review, the monitoring set-up and the half-day with your team all count, at what you paid for them. Those last two have their prices and their descriptions on the services page rather than a card here, because most buyers are choosing between the two dates rather than between six things. And there is no window on it. Pay us now and take that step two years later, and your money is still there in full — the credit does not run out, cannot be forfeited, and does not depend on Market Ready coming back by any particular date.
Because we are not selling Market Ready today, three more things go with that promise. All of them are in Article 9.7 of the agreement you sign, not only on this page:
- We will not use this to reprice you. We write to you when Market Ready goes back on sale. For the period Article 9.7 sets — it is written into your agreement, so you read the number before you sign — it costs you no more than the price we are holding, the figure in the card below, less everything you have already paid. Leave it longer than that and your credit is still there in full, because it never expires; it then comes off our price at the time.
- If it never comes back, the credit does not die with it. We would write and tell you, and from that letter the credit goes against anything else we sell instead, in full and with no time limit. What you bought today you keep: it was specified, delivered and accepted at its published price, and the credit was never a discount you paid for in advance.
- The limit, which we would rather you heard from us. The credit is a promise from us, not money set aside in your name. It is not refunded in cash, it earns no interest, and if we ever stopped trading it would rank with any other unpaid claim. A promise with no expiry date is worth knowing the edges of before you rely on it.
So the card below is not a list of prices. It is one price and one subtraction — and it is the reason the small step at the front is a sensible thing to buy first.
Everything you have already paid us comes off Market Ready in full — every line on this list, the monitoring set-up and the training included, not only the packages. The scoping and classification memorandum goes one further: it also comes off Reporting Ready and off the engineer-led gap review. There is no time limit and no expiry date: the credit is yours whenever you take that step. Buying the small step first costs you nothing.
No window, no expiry date, and nothing you have to do to keep it.
The price we are holding for you €14,900
We hold today's Market Ready price for you. If you pay us anything while it is off the list, we write to you when it goes back on sale, and for a stated period after that letter it costs you the figure we hold less everything you have already paid. The credit itself never runs out: after that period it still comes off in full, against the price at the time. It is Article 9.7 of our services agreement, not a promise on a web page.
Market Ready is not on the price list at the moment, so these are not figures you can pay us today. They are the price we hold for you. We write to you within thirty days of it going back on sale, and for twelve months after that letter it costs you the held figure less everything you have already paid — less again if it comes back cheaper. Leave it longer and your credit is still there in full; it then comes off our price at the time. Article 9.7 of the agreement you sign is the full promise, and its limits.
- Scoping and classification memo€900 paid on the way in€14,000held for Market Ready
- Reporting Ready€3,500 paid on the way in€11,400held for Market Ready
- Scoping and classification memo and Reporting Ready€4,400 paid on the way in€10,500held for Market Ready
- Engineer-led gap review€4,900 paid on the way in€10,000held for Market Ready
- Monitoring set-up, in your own account€1,500 paid on the way in€13,400held for Market Ready
- Half-day training, in-house, up to 8 people€1,500 paid on the way in€13,400held for Market Ready
After Reporting Ready — and only after that row, because it is the one the price list splits — you can also take the last step as two invoices in two budget periods: €5,900 then €5,500. Same total, two signatures, and nothing extra for splitting it.
You watch your own product
There is no monitoring plan on this page, and that is on purpose.
Under this law the manufacturer watches the product, and the manufacturer is you. Nobody can hold that duty for you, so the useful thing we can do is make it easy: pick the tool with you, set it up in an account with your name on the bill, point it at your own component list, send the alerts to the people who would act on them, and write the page they follow when one arrives. Then we hand over the keys and step back.
That is cheaper for you than any watch a consultancy could sell you. Somebody else's engineers reading your alerts is people's time on a retainer, month after month, and it costs what people's time costs. A tool you own costs a fraction of it, does the same looking, and carries on doing it whether or not you ever hear from us again. It is one fee, once, and then it is yours.
We do not watch your product, we are not sent your alerts, and nobody here is on call. We take no referral fee, commission or partner status from any tool we recommend, so what we suggest is what suits you and nothing else. We say so in writing each time, and the choice goes in your decision log as yours.
Monitoring set-up, in your own account
€1,500per unit
We help you choose a monitoring tool, set it up in an account you own against your own component list, route the alerts to your own people, show you how to use it and hand over the keys. You own the tool and the account and you watch your own product, because you are the manufacturer. We do not watch it for you and we are not sent your alerts.
Where this one stops
One technical-documentation unit, one component list, one tool, one set of alert routes, in an account you own and pay for. The tool's own subscription is yours and is not included. We hold your credentials only while we are setting it up and give them back at hand-over. Anything else is quoted separately.
The second and later units of a set-up cost 40% of the price, because by then it is the same tool and the same alert routes with a different component list.
There is no monthly plan behind it and nothing renews by itself: one fee, once, and then the tool and the account are yours.
What one price is for
We price per technical-documentation unit: one product family, one codebase, one release train. Products built from the same codebase and released together are one unit. A product with its own codebase or its own release train is a separate unit.
Three variants of the same controller, built from one repository and released together, are one unit and are quoted once.
That matters more than it sounds. If you sell the same controller in three housings, built from one repository and released together, that is one unit and one price. If you sell three genuinely different products, built by different people from different code, that is three. We ask two questions to tell them apart — is it one codebase, and does it ship on one release train — and if the answer is yes twice, you do not pay three times.
The law asks you to draw up technical documentation for the product. The manufacturer draws up the technical documentation with the content set out in Annex VII before placing the product on the market and keeps it up to date during the support period.[Art. 31; Annex VII] Our unit is the file we build with you. Whether one file can properly cover several of your products is a question about your products, and it is one of the things the scoping memorandum answers.
What the price does not include
Saying this plainly is easier for both of us, and it is the reason the price can be a fixed number instead of a range.
We are engineers doing a defined piece of engineering. So we do not break into your systems to test them, we do not certify anything and we never sign your declaration. We do not rewrite your product or fix what the scanners find: we open the change, your engineers review it and merge it.
We do not watch your product for you, we are not sent your alerts, and nobody here is on call at any hour. We do not give legal advice or decide what your obligations are, and we send nothing to an authority for you in any circumstances. A monitoring tool's own subscription is yours and is not in our price. And nobody can promise that every weakness in a product will be found, so we do not promise it either.
You remain the manufacturer throughout. That is the law rather than our contract, and it is the right way round: the responsibility sits with the people who can act on it.
The whole list is on the services page.
Why it costs what it costs
Fixed prices, because the scope is fixed. Your component list, your reporting policy, your handling procedure and your build changes are drawn from your own repository, and an engineer reads every line and puts their name on it before it reaches you. You are paying for that judgement — and it is what lets a company of fifteen people buy the whole advisory rather than the part of it it could otherwise afford.
Someone else may pay part of this
Readiness work for smaller companies can be co-funded in several places. There are national and regional schemes for the cost of outside expertise, and there is the European Digital Innovation Hubs network. We do not run any of them, we cannot promise what any of them will do for you, and we will never quote you a grant figure we have not read in the scheme's own call document.
We check what is open where you are in every quote, and we tell you what we found and what we could not confirm. Tell us the country and the headcount.
If your company is outside the EU
The law follows the product into the EU market, so it reaches you in the same way as a maker in Munich. One price list, in euros, for every country: the same number in Athens, Manchester and California.
Working out which role you are in — manufacturer or importer, and who carries which duty — is an extra hour of work for a seller based outside the EU, and we do not charge for it. Under this law an EU representative is optional, unlike some other regimes. A manufacturer may appoint an authorised representative in the Union by written mandate; the Regulation does not oblige non-EU manufacturers to appoint one.[Art. 18] We are not your representative and never act as one. If you decide you want one, we can tell you what a representative does and what that market charges; we have no arrangement with any provider, and choosing one is yours.
The time difference costs you nothing, and that is not a courtesy: it is how the work is built. Almost all of it is written, so your team answers when it suits them and we work when it suits us. Nothing in the work waits for a call. Write to us from any time zone and we answer within one working day.
Common questions
Can I still buy the reporting pack?
Yes. It is on sale today and it is the package the reporting duty asks for. Nothing about the package we are not selling changes what that one is, what it costs or when you get it.
What happens to my money if Market Ready never comes back?
You keep the work you bought, finished and delivered, at the price it is published at — the credit was never a discount you paid for in advance. And the credit does not die with the package: we write to you, and from that letter it goes against anything else we sell instead, in full and with no time limit. What it is not is cash: it is a credit against our own future work, it is not refunded, and if we ever stopped trading it would rank with any other unpaid claim. All of that is Article 9.7 of the agreement, not just this page.
Does the credit run out?
No. There is no window, no expiry date and nothing you have to do to keep it. This is a change we made on 10 September 2026: the credit used to run for a fixed period, and holding a customer to a deadline for something they were not allowed to buy would have been indefensible.
Who is responsible for compliance?
You are. You remain the manufacturer, and we can help you get there. We commit our effort and skill, not a result: we do not guarantee that an authority will find your product compliant, we do not sign declarations, we do not put the CE mark on anything, and we never send a report to an authority on your behalf in any circumstances. What you do with our advice is your call as well — we say what we would do, you decide, and the decision is recorded as yours.
Do you sell a monitoring plan?
No, and we would rather explain why than let you find out later. A watch run by a consultancy is people's time on a retainer, and it is expensive for as long as you keep paying for it. You can buy a monitoring tool for a small fraction of that and own it outright. So we do the set-up once — the tool chosen with you, configured in your account, pointed at your component list, alerting your people — and then it is yours. We are not sent your alerts, we owe you no response time, and nobody here is on call. The duty was always yours; this is the cheapest honest way to meet it.
Do we have to be on calls?
No, and that is by design. The way we keep a fixed price fixed is that the work runs in writing: one form you fill in when it suits you, a shared tracker, and written approvals you can give at nine in the evening. Written questions get an answer within one working day, and nothing in the work waits for a call.
Do you discount?
Two rules, both published, and nothing else. Everything you pay us comes off the total, in full and with no time limit, on the terms set out above. The second and later units of a monitoring set-up cost part of the price, because the work on them is mostly repetition — the exact rule is on the card above. If you already hold ISO 27001 the governance work goes faster and we will say so in the quote, but it is not a separate discount and a certificate for your organisation is not evidence for your product — see does ISO 27001 cover this?.
What happens if a deliverable is wrong?
Tell us inside the ten-business-day acceptance period and we correct it and deliver it again at no charge. For twelve months after delivery the same free correction covers a deliverable that falls short of the skill and care we owe — including one your own customer or a distributor turns down for a reason inside the agreed scope. That is Article 7.4 of the services agreement. What it never covers is the view any authority takes of your file, or of a report you filed: nobody can warrant that, and Article 13.4 says we do not. The full wording is on the services page.
How far does your liability go?
Our total liability is capped at what you paid under the statement of work the claim arises from, in the twelve months before the event. We do not accept liability for regulatory fines, recall costs, third-party claims or losses from a security incident affecting your products. The wording is in our general terms and in the agreement you sign.
Do you use AI on our code?
Yes, for parts of the work, on tools hosted in the EU. The facts — what is in your software, which weaknesses affect it, which group your product is in, which dates apply — come from published rules, never from a model. Every document is released by a named engineer, and your code is never used to train or test a model. How we use AI has the detail.
How does billing work?
Prices exclude VAT: French customers are invoiced with French VAT, other EU business customers under the reverse-charge mechanism, customers outside the EU without VAT. Every package is a one-off fee, so there is nothing recurring to invoice and nothing that renews by itself: a statement of work ends when you accept the last deliverable. Larger packages are half on signature and half on delivery, smaller ones once in full, and the threshold is written into your statement of work. Invoices are payable within 30 days by bank transfer.
Start with the free check
It takes about two minutes, it costs nothing, and it tells you whether any of this applies to you.