CRA compliance cost.
Without the guessing.
Start with a free product review. Choose the work you need. Engineers included, from €290/month.
Free CRA Snapshot
one product · excl. VAT
- Component inventory from the agreed inputs
- Known vulnerabilities grouped by severity
- Matches against actively exploited lists
- Likely product class and classification caveats
- Top ten gaps, next steps and an 8–12-page PDF
CRA Readiness Assessment
From, per product · excl. VAT
- Classification and conformity route review
- Validated, release-specific SBOM
- Triaged vulnerabilities and draft VEX
- Gap analysis against 21 Annex I requirements
- Reporting readiness review
- Roadmap to December 2027 and results call
Ready for December 2027
From, per product family · excl. VAT
- Everything in the readiness assessment
- Cybersecurity risk assessment and Annex II user information
- CVD policy, security.txt and support-period statement
- Annex VII technical file and Annex V declaration draft
- 40–120 engineering hours for remediation
- Article 14 reporting drill
- Coordination with your test lab or notified body
Readiness: Class I candidates from €3,500. Ready for 2027: €9,000–€24,000 per product family. Additional engineering: €55/hour in 20-hour blocks.
Keep watch with Monitor.
Starter
€3,480 / year when paid monthly
- Daily SBOM vulnerability monitoring
- Exploited-vulnerability alerts within 1 hour
- 10 engineer-triaged findings / month
- Reporting clock and copy-ready drafts
- Portal and documented VEX decisions
Growth
€8,280 / year when paid monthly
- Daily SBOM vulnerability monitoring
- Exploited-vulnerability alerts within 1 hour
- 40 engineer-triaged findings / month
- Reporting clock and copy-ready drafts
- Portal and documented VEX decisions
Scale
€17,880 / year when paid monthly
- Daily SBOM vulnerability monitoring
- Exploited-vulnerability alerts within 1 hour
- 120 engineer-triaged findings / month
- Reporting clock and copy-ready drafts
- Portal and documented VEX decisions
Excluding VAT. Alerts within one hour of detection; routine monitoring runs daily. Supported releases, onboarding and escalation coverage are agreed in your service scope.
Compare the way the work gets done.
| What you need | DIY compliance software | Enterprise / consultancy | Roja |
|---|---|---|---|
| Who does the work? | Your team | Your team or quoted consultants | Our engineers, with you |
| Published price | Selected tools: €79–€1,000 / mo* | Often a custom quote | Monitor from €290 / mo |
| SBOM from your build | Tool and integration dependent | Product / engagement dependent | Validated in assessment / projects |
| 24h reporting drafts | Workflow varies; your team prepares | Confirm scope in quote | Included with Monitor |
| Technical documentation | Templates / automation vary | Confirm scope in quote | Ready for 2027 project |
| Engineering remediation | Your team | Quoted separately or in scope | 40–120 hours in project package |
Different service models, not equivalent packages. Assessment and implementation are separate from Monitor. *Selected published / brief-supplied prices as of October 2026; unverified figures are labelled in the full sourced comparison.
Different needs.
Different service models.
| Service model | Examples | Published price / status | What to consider |
|---|---|---|---|
| DIY compliance software | CVD Portal | €0 / €99 / €299 per month; paid tiers billed annually | Disclosure, reporting and conformity software. Your team operates the workflow. |
| Code-based analysis | ConformOps | €99 once per product; €79/month continuous | Automated repository evidence and monitoring; your team makes decisions. |
| Governance platform | Venvera | €359/month annual billing on the retrieved page; brief listed €399 monthly | Framework-based pricing; billing cadence and selected frameworks affect the quote. |
| Assessment workspace | CETome CRAted | Brief-supplied €600–€1,000/month; not independently confirmed | Request current pricing and assessment scope. |
| Enterprise product security | Finite State, ONEKEY | Custom quote; no verified public price in this review | Large portfolios, complex integrations and established product-security teams may prefer enterprise platforms. |
| Labs / conformity bodies | TÜV SÜD, DEKRA, SGS, Bureau Veritas | Request a quote | Testing and conformity assessment complement our engineering. Verify accreditation and the applicable route. |
Context: CVD Portal's vendor-authored comparison · Cyber Vendor Guide · Finite State CRA overview. This is a comparison of service models; package deliverables are not interchangeable. No blanket lowest-price claim is made.
Cheaper than hiring.
A full-time security engineer
Recruitment, onboarding, salary and employer costs. A dedicated person can be the right choice when you need full-time ownership, deep internal context and broader responsibilities.
We do not publish a salary number without a comparable, reliable employer-cost source.
Roja Monitor Starter
Or €2,900 with annual prepay. Defined monitoring, triage and reporting work. Implementation and extra engineering are separate.
A scoped service is not a replacement for every responsibility of an employee.
What happens if you don't comply.
A team that keeps watch.
Monitoring, engineer-led triage, and reporting drafts. A practical first step toward keeping supported releases under control.
See exactly what's included ↗*Article 64: the higher of €15 million / 2.5% of worldwide annual turnover for essential requirements and manufacturer obligations; €10 million / 2% for other obligations; €5 million / 1% for incorrect or misleading information. These are maximums, decided by national authorities. Read the regulation. Article 14 reporting has applied since 11 September 2026. See the penalties guide for exceptions.
The practical details.
Are the prices inclusive of VAT?
All prices are in EUR and exclude VAT. Applicable tax treatment depends on your establishment, status and the final contract. Invoices state the relevant VAT handling.
How do project payments work?
Projects are 50% upfront, with the remainder linked to agreed milestones. Final deliverables, product family, engineering hours and acceptance steps are defined in the statement of work.
What does annual prepay save?
Annual Monitor prepay costs ten monthly payments for twelve months of service: two months free. The billing basis is shown explicitly below each plan. Cancellation and renewal terms are agreed in the subscription contract.
Does Monitor include all CRA documents?
No. Monitor covers ongoing vulnerability monitoring, triage allowances and reporting drafts. The readiness assessment and Ready for 2027 implementation project are separate engagements.
Can I buy extra engineering help?
Engineering is €55/hour in blocks of 20 hours. We agree a scope before using additional time. Lab and notified-body costs are separate.