The Romanian Digitalization Authority (ADR), through the National Cybersecurity Coordination Center (NCC-RO), approved a de minimis aid scheme via Decision No. 516/2026. The scheme helps SMEs prepare for Regulation (EU) 2024/2,847 (Cyber Resilience Act – CRA), which establishes cybersecurity requirements for hardware and software products. Starting in September 2026, the obligations regarding coordinated vulnerability disclosure (CVD) and the software bill of materials (SBOM) will apply.
Thank you for reading this post, don't forget to subscribe!Budget and Timeline
The total budget is 2,000,000 euros: 1,000,000 euros from the Digital Europe Program and 1,000,000 euros from the state budget. Of this amount, 600,000 euros are allocated for 2026 and 1,400,000 euros for 2027. The program has been in effect since September 28, 2026 (Official Gazette No. 821) and will remain in effect until funds are exhausted, but no later than March 31, 2028. Payments may be made until June 30, 2029. It is estimated that approximately 266 businesses from all regions of the country will receive support.
Who Is Eligible for Funding
SMEs in Romania that develop, produce, integrate, distribute, or use digital products subject to the CRA may apply. Eligibility is determined based on the authorized CAEN code across three sectors: The following are excluded: agriculture, fisheries, steel, coal, transportation, energy, fossil fuels, gambling, and adult products. A single enterprise may receive a total of no more than 300,000 euros in de minimis aid over 3 years (Regulation (EU) 2023/2,831).
- Hardware, IoT, and electronics: the manufacture of electronic components, computers, communications equipment, and electrical equipment.
- Software and IT services: are eligible only if the product being evaluated is a product with digital elements placed on the market or a component of such a product.
- Telecommunications and digital platforms: telecommunications networks, data processing, website management, and web portals.
How to apply: through consortia
The application is submitted by a consortium leader, i.e., a cybersecurity service provider. This provider must hold ISO/IEC 27001 certification or have a senior expert certified as CISSP, CISA, CISM, or OSCP. Experience with ISO 27001, IEC 62443, NIST CSF, or NIS2 is considered equivalent. Each consortium consists of between 3 and 5 SMEs. A tripartite contract is signed between ADR/NCC-RO, the consortium leader, and the SMEs.
The leader does not receive de minimis aid. The leader only receives payment for services at market rates, and ADR verifies the rates based on man-hour estimates.
Service Packages
The grant covers a maximum of 75% of the eligible amount. The SME pays the remaining minimum of 25%, plus ineligible VAT and advertising costs. The program funds only the diagnosis and preparation phases. Software development, research, equipment, licenses, remediation, or final certification are not eligible. Each SME receives a single package:
| Package | What is covered | Eligible amount / maximum grant |
| P1 – Initial diagnosis of CRA | applicability, gap analysis against Annex I, SBOM maturity, management training | 10.000 € / 7.500 € |
| P2 – Technical Assessment | P1 + + vulnerability scanning (CVSS), development process assessment, IT/DevOps training | 25.000 € / 18.750 € |
| P3 – Audit & testing | P2 + audit Secure SDLC, CI/CD, policy CVD, penetration testing | 45.000 € / 33.750 € |
| P4 – Complex Portfolios | P3 + complex SDLC optimization, training for architects and management | 60.000 € / 45.000 € |
Mandatory Deliverables: Payments and Oversight
- For all packages (P1–P4): the CRA assessment report (L1), the gap register (L2), and the anonymized data sheet in JSON format (L5).
- For P2–P4: the training plan (L3) and the Vulnerability Assessment report (L6).
- For P3–P4: the Secure SDLC Maturity Report (L4) and the Penetration Testing Report (L7).
The grant is paid as a lump sum, in accordance with Regulation (EU, Euratom) 2024/2,509; therefore, supporting documents are not required for each expense. The funds are transferred to the consortium leader’s account, without pre-financing, in two installments:
- 30%: after NCC-RO accepts the preliminary L1 and L2 reports for all SMEs in the consortium.
- 70%: within 60 days of approval of the final report and all deliverables.
If the project is partially completed, the grant is reduced proportionally. If it is not completed, the funds may be recovered in full. Data is reported in RegAS, and documents are retained for 10 years. In the event of irregularities, the Regional Development Agency (ADR) issues enforceable recovery decisions. The amounts to be recovered accrue compound interest: the market rate plus 100 basis points.