Direct answer: CRA complexity does not depend on the number of products. It depends on the combination of two things: which class each product family falls into, and in what supply-chain role each product line is placed on the market. One company can have default and important products at the same time, and be a manufacturer and an importer at the same time; every combination has its own assessment route and obligations. Draw that combination table first, then budget.
Five factors determine the cost
| Factor | Why it affects the budget | What to confirm first |
|---|---|---|
| Class of each product family | Default products can self-assess; important products class I need a third party unless a harmonised standard is applied; class II and critical products always need a third party. Classes are determined family by family, and one company often has several | Whether each family's core function falls under Annex III or IV |
| Supply-chain role of each product line | Manufacturers, importers and distributors have different obligations; selling under your own brand makes you the manufacturer. Where ODM, OEM and own-brand lines coexist, the role can differ per line | Under whose name or trademark each line is sold, and who imports it into the EU |
| Class × role combinations | The number of combinations is what really drives complexity: ten products of the same class and role can be simpler than three products in different combinations | List every combination; each needs its own assessment route |
| Vulnerability handling capability | Vulnerabilities must be handled effectively during the support period and reported within the deadlines | Whether a vulnerability reporting and patching process already exists |
| Third-party components | Manufacturers must exercise due diligence on integrated third-party components | Whether a software bill of materials (SBOM) already exists |
Six product categories mapped to CRA classes
The class follows the product's core function; products in the same category can fall into different classes:
| Category | Default | Important class I | Important class II | Critical |
|---|---|---|---|---|
| Industrial | PLCs, HMIs, industrial controllers; unmanaged switches without a management plane | Industrial switches and routers with a management plane; network interfaces such as fieldbus; VPN industrial gateways | Industrial firewalls, intrusion detection or prevention systems | — |
| IC chips | MCUs and MPUs without security functions protecting other products or networks | MCUs, MPUs, ASICs and FPGAs whose security functions protect products or networks beyond the chip; network interface chips and modules | Tamper-resistant MCUs and MPUs (AVA_VAN 2 or 3) | Secure elements (including TPM and eUICC), smart cards |
| Networking | Unmanaged switches without a management plane | Routers, modems, switches with a management plane; network interfaces; network management systems; VPN products | Firewalls, intrusion detection or prevention systems | — |
| Security products | Rare | Identity and access management, access-control and biometric readers, password managers, antivirus, SIEM, PKI | Firewalls, intrusion detection or prevention systems; virtualisation platforms, container runtimes | Hardware devices with security boxes (such as HSMs, physical payment terminals) |
| Machine tools | Machine tools, CNC controllers | Routing, VPN and network interface modules sold separately are classified on their own | Firewall modules sold separately are classified on their own | — |
| IoT and AIoT devices | General devices such as sensors and home appliances | Remotely controllable smart-home security products, voice assistants, connected toys, health or child wearables; communication modules sold separately | — | Smart meter gateways |
Rule of thumb: look at the core function of the product as a whole. A built-in Wi-Fi module, operating system or firewall function does not change the class of the whole product (a router with a built-in firewall is still a router), but the whole product must still meet the essential requirements; a module sold separately is classified by its own category. A switch is class I only if it has a management plane; the security function of an MCU or MPU must protect products, networks or services beyond the chip. The above follows Implementing Regulation (EU) 2025/2392; borderline cases must be checked item by item against its technical descriptions.
Machine tools need one more regulation: the Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and requires control systems to prevent malicious or accidental tampering. This is a machinery CE-marking requirement that runs in parallel with the CRA.
Own brand, ODM, OEM: who is the legal manufacturer
| Business model | CRA role | What you must prepare |
|---|---|---|
| Own brand | Manufacturer | Full manufacturer obligations: risk assessment, technical documentation, conformity assessment, CE, vulnerability handling and reporting during the support period |
| ODM (you design and manufacture, the customer brands it) | The brand customer is the manufacturer | The customer will ask you for risk assessment, technical-documentation inputs, SBOM and vulnerability-handling support; the contract must define scope, support period and reporting response times |
| OEM (the customer designs, you manufacture) | The brand customer is the manufacturer | Customers usually ask for component SBOMs, production-side security and component-verification evidence; the contract must define reporting response times |
If you also sell the same product in the EU under your own brand, you are the manufacturer for that part. ODM and OEM suppliers are not the legal manufacturer, but the customer's assessment route depends on the product class, and the higher the class, the more evidence the customer will ask you to deliver.
Budget in four blocks
- Internal effort: time from product security, R&D and legal.
- Consulting: product classification and role determination, risk-assessment method, technical-documentation system, building the vulnerability handling and reporting process, preparation before conformity assessment. This is what decides how much internal effort you save and whether you get it right the first time.
- External assessment: notified-body assessment (only where a third party is required) and testing.
- Ongoing cost: vulnerability handling and reporting during the support period. This is a recurring annual expense, not a one-off project.
Winners' view
What most Taiwanese manufacturers underestimate is the ongoing cost. The CRA does not end when you obtain CE: vulnerability handling and reporting during the support period is a continuing obligation, and it has applied to products already on the market since 11 September 2026. Reserve the people for ongoing operation first, then talk about the one-off conformity assessment.
How the three disciplines divide the work: legal compliance determines the product class and economic role and decides the conformity-assessment route and reporting obligations; process builds the procedures and records for secure development, vulnerability handling and reporting; technology delivers SBOM, secure design, vulnerability testing and update mechanisms. Without any one of the three, the technical documentation cannot fully support the CE marking.
When the product has AI functions: do CRA and the AI Act together
When a product is within the CRA and is also a high-risk AI system under the AI Act, Article 12 of the CRA builds a bridge: if the product meets the essential requirements of CRA Annex I (both the product and the vulnerability-handling process) and the EU declaration of conformity under the CRA states that the level of cybersecurity protection required by Article 15 of the AI Act has been achieved, the product is presumed to comply with the cybersecurity requirements of Article 15 of the AI Act. Accuracy and robustness are not part of this bridge and must still be handled under the AI Act; conformity assessment follows Article 43 of the AI Act in principle, with exceptions for important and critical products.
What this means for the budget: one risk assessment, one set of technical documentation and one declaration of conformity can cover the cybersecurity part of both regulations; AI risk classification, data governance, human oversight and accuracy validation must be budgeted separately. ISO 42001 provides the structure of an AI management system that can be integrated with the secure-development and vulnerability-handling processes the CRA requires into one management system, so you do not run two in parallel. ISO 42001 and AI Act budget and timeline
How to budget the consulting fee
Quotes follow the assessment scope: mainly the class distribution of your product families, the supply-chain role of each product line, the number of combinations these create, the maturity of your existing secure-development process, and the deliverables required. We recommend a mechanism diagnosis first to fix the scope, then obtaining a quote, and budgeting the consulting fee together with internal effort for next year.
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.