SECURE Call 2
Apply for 50% funding of your CRA project under SECURE Call 2
EU funding for small and medium-sized companies that need to comply with the Cyber Resilience Act.
SECURE Call 2 is open for applications until 11 December 2026. The grant covers 50% of eligible project costs, up to €30,000 per company, for projects lasting up to 180 days. Comply.Land helps you prepare your application and, if you choose us, delivers the project.
Thank you
We have your question and will be in touch within two working days.
SECURE Call 2 closed on 11 December 2026. This page is kept for reference. You can still contact us about funding for your CRA project.
SECURE is an EU funding programme that co-finances Cyber Resilience Act (CRA) compliance work at micro, small and medium-sized companies. Your company applies, and the programme decides.
We prepare your application with you and, once your grant is signed, can deliver the project. Our team includes ETSI rapporteurs, so your project is designed around the requirements your product will be measured against.
Who is eligible for SECURE funding?
SECURE funding is for European micro, small and medium-sized enterprises that develop, make, import or distribute products with digital elements that must comply with the CRA. You are likely to qualify if:
- Your company is a micro, small or medium-sized enterprise: fewer than 250 staff, and annual turnover up to €50 million and/or a balance sheet total up to €43 million. Rules on linked and partner companies apply.
- Your company is a separate legal entity with its main business operations or headquarters in an EU Member State, or in Norway, Iceland, Liechtenstein or Switzerland, and you can show proof of legal establishment.
- Your ultimate beneficial owner is a citizen of one of those countries, and your company is controlled from there.
- You make, import or distribute a product with digital elements within the scope of the CRA, such as a desktop or mobile app, firmware or a connected device. Some sectors, such as medical devices, aviation and automotive, fall under their own rules and are excluded.
- The project work will be carried out in one of those countries, and the costs are not already funded by another EU grant.
Not sure whether your company or product qualifies? Eligibility is verified through your country's National Cybersecurity Coordination Centre (NCC). We can go through the rest with you in a 30-minute call.
How we help you prepare your SECURE application
Eligibility screen
SME status, ownership chain, your National Cybersecurity Coordination Centre (NCC) and the CRA relevance of your product.
Gap framing
Your compliance gap per product, described in the terms the evaluators score.
Project design
One to three work packages, with milestones, deliverables and KPIs you can evidence.
Budget
The official budget template, with every cost justified.
Proposal
Written in English within the official page limits.
Submission
A checklist and a walkthrough of each platform step, while your legal representative signs and submits.
Choose your project bundle
Our project offer is a fixed-scope quote you can compare like for like. Each bundle maps to the eligible activities of SECURE Call 2 and drops into your proposal's work packages and timeline.
| Starter | Core | |
|---|---|---|
| For | Teams that need to know where they stand and fix critical issues | Teams that want CRA-ready engineering, from assessment to independent testing |
| Services | CRA gap analysis, threat and risk analysis, remediation plan, CRA training, vulnerability assessment with retest | Everything in Starter, plus a secure build and signed-update pipeline, incident response and vulnerability reporting, and a penetration test |
| Work packages | Assess and plan; Vulnerability assessment | Assess and plan; Implement; Test and verify |
| Consultant days | 26 | 48 |
| Price (ex VAT) | €26,000 | €48,000 |
Prices assume one product, such as a desktop or mobile app with its backend API, at €1,000 per consultant day. Larger scopes are quoted separately.
How much SECURE funding can you receive?
The grant covers 50% of your total eligible costs, up to €30,000. Eligible costs include our invoice, the time your own staff spend on the project, and a flat 7% for indirect costs, calculated on your total direct eligible costs.
| Starter | Core | |
|---|---|---|
| Comply.Land services | €26,000 | €48,000 |
| Your staff time (illustrative) | €5,000 | €8,000 |
| Total direct costs | €31,000 | €56,000 |
| Indirect costs (7% of total direct costs) | €2,170 | €3,920 |
| Total project cost | €33,170 | €59,920 |
| SECURE grant (50%) | €16,585 | €29,960 |
| Your net cash cost for our services | €9,415 | €18,040 |
Net cost is our invoice minus the grant. Your staff time is shown only to complete the example, because you pay it as salary, and your real figures come from your project plan. These examples assume the full calculated grant is awarded and paid. Your actual funding depends on your approved project budget and delivery, and cannot exceed €30,000.
What CRA compliance deliverables will you receive?
Each service ends with an evidence pack that you attach to your SECURE technical report.
Gap analysis
A CRA gap analysis and a prioritised gap register.
Risk assessment
A CRA risk assessment, including your third-party components.
Remediation plan
A remediation plan, with gaps re-scored at the end of the project.
Training records
Training records for management and your product team.
Vulnerability reports
Vulnerability assessment and retest reports.
Core only
A secure pipeline and software bill of materials report, an incident response plan with a tabletop exercise, and a penetration test report.
Application fee and invoicing
The application fee is agreed in writing before we start, and payable only once your Sub-Grant Agreement is countersigned. You pay it from your own funds. It is set out in a separate engagement letter and does not depend on who delivers your project.
We invoice at the end of each work package. Our payment terms do not depend on the outcome of your grant, and all prices are quoted excluding VAT.
Who will deliver your project?
Comply.Land is the CRA compliance practice of CrabNebula Ltd, Malta. Our team includes ETSI rapporteurs, and CrabNebula engineers carry out the technical work.
What SECURE Call 2 does not fund
Accredited third-party audits and CRA certification, which the call does not fund in this round.
Regulatory documentation support as a standalone service, such as drafting the EU declaration of conformity or the technical documentation on its own.
Travel and dissemination costs, so our on-site work is included in the day rate or delivered remotely.
Key dates for SECURE Call 2
- 1 Oct 2026The call opens
- 13 Nov 2026We recommend starting your application by this date
- 11 Dec 2026The call closes
From application to payment
- Step 01
Eligibility call
30 minutes. We check whether your company and product qualify, and which bundle fits.
- Step 02
Application
We prepare your proposal and budget with you. We recommend starting by 13 November 2026, so there is time to do it well before the call closes on 11 December 2026.
- Step 03
Grant signature
You can ask for an optional 40% pre-financing when you submit your proposal. It is paid on signing the Sub-Grant Agreement and must be repaid if the agreed milestones are not met.
- Step 04
Project, up to 180 days
We deliver the work packages from the signing of the Sub-Grant Agreement, and plan the work so that testing leaves time to close gaps and write your technical report.
- Step 05
Final payment
SECURE pays the balance of your grant after evaluators approve your technical report and the project has been implemented as agreed.
Frequently asked questions about SECURE Call 2
Do I pay anything before I know whether I have the grant?
The application fee is payable only once your Sub-Grant Agreement is countersigned. You pay it from your own funds.
Do I have to choose Comply.Land to deliver my project if you help with my application?
No. The application fee does not depend on who delivers your project. You choose your suppliers on best value for money or lowest price, following your usual procurement practice.
How much grant can I receive?
50% of your total eligible costs, up to €30,000. A project above €60,000 still receives €30,000.
What happens if my project only partly meets its milestones?
The grant is a lump sum, and it can be reduced in proportion to what is achieved. We set milestones and KPIs at levels you can evidence.
When should we start?
As early as possible. The call closes on 11 December 2026, and we recommend starting by 13 November so there is time to prepare a strong proposal.
Who decides whether my company qualifies and receives funding?
SECURE decides, and eligibility is verified through your country's National Cybersecurity Coordination Centre. Your company is the applicant. Comply.Land cannot guarantee that you receive funding.
Is this legal advice or a conformity determination?
No. Our work prepares your product and evidence for the CRA. It is not legal advice, certification or a formal conformity determination.
Ready to see whether SECURE can fund your CRA project?
Book a 30-minute eligibility call. We check whether your company and product qualify and which bundle fits.