What the SECURE open call is
SECURE is a three-year project funded by the European Union under the Digital Europe Programme, through the European Cybersecurity Competence Centre, and coordinated by Italy's National Cybersecurity Agency (ACN). Its job is to help smaller manufacturers get ready for the Cyber Resilience Act, and it does that by handing out money in open calls (what the EU calls cascade funding).
The second open call was published on 1 October 2026 and closes on 11 December 2026. The budget is at least EUR 11.5 million, and it can grow with funds left over from the first call.
How much it pays
- 50% of the eligible cost of the project, with a ceiling of EUR 30,000. A project costing EUR 80,000 still receives EUR 30,000.
- Paid as a lump sum: the amount is fixed against deliverables, not against receipts. An optional 40% pre-financing is paid on signature if you request it in the proposal; the rest follows approval of the final technical report.
- Projects last at most six months and are organised in one to three work packages, each deliverable with its own KPIs and evidence.
Who can apply
- Micro, small and medium-sized enterprises under the EU SME definition (Recommendation 2003/361/EC): fewer than 250 staff and an annual turnover up to EUR 50 million or a balance sheet up to EUR 43 million.
- Legally established in an EU Member State, Norway, Iceland, Liechtenstein or Switzerland, controlled from those countries, and carrying out the project there.
- The company eligibility check is done by the National Cybersecurity Coordination Centre of your country. The call recommends confirming beforehand that your NCC takes part, because an application from a country whose NCC does not run the check has no guarantee of passing it.
What it pays for, and what it does not
The call lists sixteen categories of activity. The ones that matter for most manufacturers of products with digital elements are:
- Gap analysis against the CRA: where the product and the processes behind it stand against the essential requirements, with a gap register and a checklist.
- Cybersecurity risk analysis: threat scenarios, likelihood and impact, third-party components.
- Remediation plan, with owners and deadlines for every gap.
- Expert support during the project: technical guidance, review of artefacts, follow-up.
- Threat modelling and SBOM, supply chain risk built on the SBOM, and an incident response plan that meets the CRA reporting obligations.
- Vulnerability tests, penetration tests, laboratory tests and CRA training.
Not eligible in this call: regulatory documentation support (technical documentation, EU declaration of conformity, disclosure policies), accredited third-party audits and third-party conformity assessment. The call says these will only open once certification mechanisms are in place in the Member States. If someone tells you SECURE will pay for your CRA documentation this year, check the call text.
The timeline is the catch
Costs only count from the signature of the sub-grant agreement. Evaluation results are expected about three months after the call closes, which puts signatures in spring 2027, followed by up to 180 days to deliver. Anything you buy before that is not funded.
That still works for the CRA. The essential requirements apply from 11 December 2027, so a six-month project running from spring to autumn 2027 lands with a few months to spare. What it does not cover is the reporting obligations, which have applied since 11 September 2026 and cannot wait for the grant.
How to apply
- Create an account on the SECURE platform (opencall.secure4sme.eu) and submit there, using the call's own templates: Annex 1.1 for the technical proposal and Annex 1.3 for the budget.
- Write it in English. Budget your own staff at the call's fixed monthly rate for your country, and justify every cost against a task or deliverable: anything not linked is cut before signature.
- Proposals are ranked, not funded first come first served, on excellence and relevance, impact and clarity, and implementation. Ties are broken by submission time, so do not leave it to the last day.
- Using tools from other Digital Europe CRA projects, and explaining how, is rewarded in the evaluation.
- You may subcontract part or all of the work to a provider established in the EU or EFTA. If you have already chosen one, name it in the proposal.
The official call, its annexes and the platform are on secure4sme.eu.
Where Regulus fits
Regulus is free for manufacturers: it classifies the product, walks through the Annex I requirements and builds the risk assessment and the SBOM. That is a reasonable starting point for the gap analysis a SECURE proposal has to describe. The eligible work itself (gap analysis, risk analysis, remediation plan and expert support) is what our expert review covers, and we can be named as the provider in your proposal.
We can also help you write the application in English. Write to shuy.zur@goregulus.com with the product you would put in the project.
Frequently asked questions
Does the SECURE call pay for CRA technical documentation?
Not in the second call. Category 15 of the eligible activities, regulatory obligations and documentation support, is listed as not eligible for now, together with accredited third-party audits and third-party conformity assessment. Gap analysis, risk analysis, remediation planning, expert support, threat modelling and SBOM work are eligible.
Can I use the SECURE grant for work I do before the grant agreement is signed?
No. Costs only count from the signature of the sub-grant agreement. Results are expected about three months after the call closes, so funded work realistically starts in spring 2027 and has to be completed within 180 days.
Can an external consultancy carry out the SECURE project?
Yes. Subcontracting all or part of the project to an external provider established in the EU or EFTA is an eligible cost, as long as there is no conflict of interest and the provider is chosen on best value for money. If the provider is already chosen, it is named in the proposal.
Is a company outside the EU eligible for SECURE funding?
Only micro, small and medium-sized enterprises legally established in an EU Member State, Norway, Iceland, Liechtenstein or Switzerland, controlled from those countries, and carrying out the project there.
In what language must the SECURE proposal be written?
English. All documentation submitted in the call has to be in English, except official documents issued by public authorities of the applicant's own Member State.
