The Cyber Resilience Act for small companies

The Cyber Resilience Act (CRA) has no general exemption for small companies. If you make a connected product and sell it in the EU, you meet the same security requirements, handle vulnerabilities and report exploited flaws like everyone else. What the law gives micro and small enterprises is narrower: no fines for missing the 24-hour early warning, a simpler format for the technical file, lower assessment fees and support from national authorities.

Are you micro, small or medium

The CRA uses the EU definition from Recommendation 2003/361/EC (Article 3(19)). You count staff, then check either turnover or balance sheet total.

Category	Staff	Turnover	or balance sheet total
Micro	fewer than 10	up to €2 million	up to €2 million
Small	fewer than 50	up to €10 million	up to €10 million
Medium	fewer than 250	up to €50 million	up to €43 million

These limits apply to the company on its own; if you belong to a larger group, you may need to include the group's figures. The Commission's SME page has the full rules and a self-check.

The cut-off at 50 matters. A company with 50 staff is medium-sized, and some reliefs below are only for micro and small.

What stays the same

None of this changes for a small company:

• the 22 points of Annex I, for the product and for vulnerability handling;
• the risk assessment and the due diligence on third-party parts (Article 13(2) to (5));
• a support period of at least five years, unless the product is expected to be in use for less (Article 13(8));
• the reporting duty under Article 14, which has applied since 11 September 2026;
• the conformity assessment, the declaration of conformity and the CE mark.

Your product class decides the assessment route, not your size. A two-person company making a class II product still needs a notified body.

The reliefs in the law

Relief	Who gets it	Source
No fine for missing the 24-hour early warning deadline	Micro and small	Article 64(10)(a)
A simplified format for the technical documentation, which notified bodies must accept	Micro and small	Article 33(5)
Conformity assessment fees reduced in proportion to your needs	Micro, small and medium, start-ups included	Article 32(6)
Size taken into account when a fine is set	Micro, small and medium	Article 64(5)(c)

The first relief is narrow. You still send the early warning, and the 72-hour notification, the final report and the user notice all stay fully enforceable.

The simplified technical file is a different layout, not less content. The Commission must publish the form by implementing act; check the Commission's CRA page to see whether it's out.

Help you can ask for

Member states should, where appropriate, offer micro and small enterprises (Article 33(1)):

• awareness and training activities on the CRA;
• a dedicated channel for advice and questions;
• support for testing and conformity assessment.

They may also set up regulatory sandboxes, controlled test settings for innovative products before they go on sale (Article 33(2)). The Commission must publish guidance with a focus on small firms (Article 26(1)) and advertise EU funding that can ease the cost (Article 33(4)). Ask your national market surveillance authority what exists in your country.

A plan for a team of ten

Imagine a team of ten with one firmware engineer who also handles security. Suppose they sell two products. A realistic order of work:

1. This month. Make sure someone can submit a 24-hour early warning on ENISA's Single Reporting Platform, and name a stand-in. Reporting already applies.
2. Next. Run the product-class check on both products. If either is class II or critical, contact a notified body early.
3. Then. Get a parts list for every firmware version still in the field. Fix anything on CISA's known exploited list first.
4. Through 2027. Write the risk assessment, the vulnerability handling policy and the technical file, release by release.
5. Before 11 December 2027. Run the assessment, sign the declaration, add the CE mark.

Most of the effort goes into steps 3 and 4. Templates help with the writing; nothing replaces the engineer's knowledge of how the product is built.

Where the money goes

Expect three kinds of cost: your own staff time; a notified body if your class needs one; and tooling for parts lists and monitoring. Funding programmes may cover some of it, so ask before you pay.

What Proofsheet does here

Proofsheet is a web app for teams without a security department. Upload one file and it generates the free peek, a one-page report with your top 3 risks. The Label (€99, one version, paid once) generates the full parts list, known CVEs for exact versions and the map to the 22 Annex I points. The Paperwork (€249) adds the generated document pack: technical file index, support-period record, Article 14 reporting guide, declaration checklist and policy templates. Watchdog (€79 a month) and Agency (€299 a month) are software subscriptions, opening soon.

Everything runs in the app, with no call or meeting. It's technical evidence, not a legal certificate, and you still sign and submit everything yourself.

See prices, or read about fines and technical documentation.