On 1 October 2026, the SECURE Project Opened a Second €11.5 Million Call for SMEs Facing CRA Compliance Costs

On 1 October 2026, the SECURE Project Opened a Second €11.5 Million Call for SMEs Facing CRA Compliance Costs

On 1 October 2026, the EU-funded SECURE project opened its second cascade-funding call, offering €11.5 million to micro, small and medium-sized enterprises working to meet their obligations under the Cyber Resilience Act. The call runs until 11 December 2026. It is real money and a genuine gap-filler for cash-strapped SMEs, but the programme's own timeline leaves funded companies very little room either side of the CRA's own deadlines.

What the money is for

SECURE is financed under the Digital Europe Programme, with support from the European Cybersecurity Competence Centre (ECCC), under topic DIGITAL-ECCC-2024-DEPLOY-CYBER-06. An individual SME can receive up to €30,000 per project at a 50 percent co-financing rate, meaning the applicant still funds half the work itself. Eligible costs span a wide range of CRA-relevant activity:

• Regulatory compliance work, including audits, certification support and policy drafting.
• Product testing, including vulnerability assessment and penetration testing.
• Security upgrades to production infrastructure across cybersecurity, IT and OT.
• Governance and risk management, including incident handling and supply chain security.
• Cybersecurity training, and the purchase of tangible goods or professional services needed to meet required safety standards.

To qualify, an applicant must be a single legal entity, must meet the EU's SME definition, must be incorporated in an EU or EEA country, may submit only one proposal, and cannot combine the grant with other EU funding for the same work.

This is the second of at least two calls, not the first

SECURE's first open call ran from 28 January 2026 to 29 March 2026, with a budget of €5 million on the same terms: up to €30,000 per project, 50 percent co-financed. Together with this second call's €11.5 million, that accounts for the programme's full €16.5 million cascade-funding pot. SECURE has said at least two calls would be launched; nothing published so far points to a third.

Why the runway is tighter than it looks

The deadline math is worth doing before applying. SECURE's own grant agreement with the Commission was signed in November 2024, for an indicative duration of 36 months, which puts the project's own wind-down around November 2027, roughly a month before the CRA's 11. december 2027 deadline for full applicability of the regulation's main obligations. An SME funded through this second call, closing 11 December 2026, is applying almost exactly one year before SECURE itself is due to end. Whatever compliance work the grant pays for has to happen inside that window, and the window closes at nearly the same moment the CRA stops being forgiving about it.

What the grant does not change

None of this money alters what the CRA already requires. The Article 14 duty to report actively exploited vulnerabilities and severe incidents has applied since 11. september 2026 regardless of funding status, as our indberetningsvejledning covers, and the essential requirements in Bilag I become binding for most products on 11. december 2027 whether or not a grant application succeeded. A SECURE grant can subsidise the audit, the testing or the training; it cannot subsidise more time. SMEs weighing whether to apply, or trying to work out what the money would actually need to cover, can get a head start with our own compliance cost calculator og support planner.