The CRA Compliance Tax: How Much Will It Cost Your Irish Software Company?
Regulation doesn't cost what the press release says it costs. It costs what your engineer charges per day, multiplied by how long it takes to actually fix the product.
The Cyber Resilience Act is now EU law. From 2027, any software product with a digital element sold into the EU market must meet mandatory cybersecurity requirements before it ships. For Irish SaaS companies, that is not an abstract Brussels concern. Ireland's software sector employs over 35,000 people directly and exports north of €20 billion annually, according to IDA Ireland's own figures. Every one of those exporters is now on the clock, and the compliance conversation most of them are having is still at the stage of "we should probably look into this."
That needs to stop. Here is what CRA compliance will actually cost your Irish software company, broken down in terms your accountant can read.
What the CRA Actually Requires
The regulation splits software products into three classes. Default products face self-assessment. Class I products, things like browsers, password managers, and network management tools, require a third-party audit. Class II products, operating systems, firewalls, and industrial control interfaces, face the most rigorous scrutiny of all.
Most Irish SaaS founders assume they are in the default category. Many are wrong. If your product touches network management, identity and access, or remote data processing in any meaningful way, you are likely in Class I at minimum.
The obligations are not optional extras. You must document every software component you ship, including open-source dependencies. You must publish a software bill of materials. You must maintain a vulnerability disclosure process. You must issue security updates for the supported life of the product, and that life cannot be shorter than five years. You must report actively exploited vulnerabilities to ENISA within 24 hours of discovery.
That last one alone will change how you staff your security function.
The Four-Stage Cost Model
Stage 1: Gap Assessment (Months 1 to 3)
Before you can fix anything, you need to know what is broken. A credible gap assessment for a mid-sized Irish SaaS company, say 30 to 80 engineers, will run you between €25,000 and €60,000 if you bring in a specialist firm. If you try to do it internally with engineers who are already shipping product, double your timeline and accept the hidden cost of slower delivery.
Stage 2: Remediation Engineering (Months 3 to 12)
This is where the real money goes. Remediation typically means rearchitecting authentication flows, hardening APIs, adding logging and monitoring infrastructure, and pruning the dependency tree. For a product with accumulated technical debt, that is a six-to-nine-month engineering project. At Irish mid-market engineering rates of roughly €600 to €900 per person per day, a team of four engineers working for six months costs between €288,000 and €432,000. That is before you count lost feature velocity.
Stage 3: Conformity Assessment (Months 10 to 14)
Class I products need a notified body audit. Notified bodies for CRA are still being formally designated across the EU, but early-market pricing suggests audit costs of €15,000 to €40,000 for a standard SaaS product. Add the cost of technical documentation preparation, typically another three to five weeks of engineering and legal time, and you are adding €30,000 to €70,000 more.
Stage 4: Ongoing Operations (Annually)
This is the cost nobody budgets for. CRA compliance is not a project with an end date. You need continuous vulnerability monitoring, a maintained SBOM that updates with every release, and a formal incident response capability with the 24-hour ENISA reporting window baked in. A realistic annual operational cost for a company of 50 to 100 staff is €80,000 to €150,000. That is roughly one additional hire, or a managed service retainer, every year, forever.
The Real Number
Add it up for a Series A Irish SaaS company selling into EU enterprise markets. Gap assessment: €40,000. Remediation: €350,000. Conformity audit: €50,000. Year one ongoing operations: €100,000. Total first-year CRA compliance cost: €540,000.
That is roughly the annual salary bill for four senior engineers in Dublin. It is also an amount that many founders are not modelling in their next funding round. If you raised €2 million to grow your product team and did not factor this in, your runway just got shorter.
The opportunity here is real, though. Irish compliance startups are already winning contracts by offering managed CRA readiness services to exactly the companies that cannot afford to build the capability internally. The market for that service will be worth tens of millions before 2027 is out.
What You Can Do Right Now
The companies that will come out of this in a strong position are not the ones that panicked earliest. They are the ones that treated CRA compliance as a product discipline rather than a legal checkbox.
Start with your software bill of materials. If you cannot list every dependency your product ships with today, you cannot pass a CRA audit tomorrow. Tools like Syft and Grype will generate an SBOM from your codebase in hours. That is day one work, not month ten work.
Assign ownership. Compliance without a named internal owner gets done by nobody. It does not need to be a full-time role at this stage, but it needs to be someone's explicit responsibility, not a shared assumption that the engineering manager will sort it.
Talk to your investors. If your board does not know that CRA adds roughly half a million euros to your next eighteen months of costs, that is a conversation you are overdue. The broader regulatory burden on Irish scale-ups is already a known pressure point for VCs doing Irish deals. Walking in with a clear-eyed cost model is a better position than walking in with a surprise.
The Competitive Divide
CRA will separate two types of Irish software company. The first type will treat it as a cost to be deferred, cut corners on documentation, and face enforcement action or market access problems when the regulation bites. The second type will build compliance into the product, use it as a sales argument with EU enterprise buyers, and price accordingly.
Enterprise buyers in Germany and France are already asking vendors for CRA readiness statements. The company that can hand over a clean SBOM and a documented vulnerability management process in the first sales conversation is closing deals that the scrambling competitor is losing.
Security-by-design is not a regulatory burden. It is a positioning decision. Build it in now, or pay twice to retrofit it under pressure.
