Industrial Cybersecurity grants 2026: up to €100,000 to protect operations and products

Summary

SPRI's Industrial Cybersecurity 2026 programme offers non-repayable grants covering 60% of eligible costs, up to €100,000 per company, for assessment, protection, detection, response and certification projects and, for the first time, product cybersecurity. Applications are approved in the order in which files are completed until funds run out, so a complete, well-prepared application submitted early matters as much as the project itself. The deadline is 23 November 2026.

SPRI, the Basque Business Development Agency, is accepting applications until 23 November 2026 for its Industrial Cybersecurity grants, aimed at industrial companies and related service providers with an operating site in the Basque Country. The programme funds projects that improve a company's protection and operational resilience and, for the first time, the cybersecurity of its products.

With just over five weeks to go, now is the time to check whether a project qualifies, how the grant is calculated and which documents are required on the official SPRI programme page (in Spanish).

What the Industrial Cybersecurity 2026 programme is

The regulatory bases published in the Basque Official Gazette (BOPV) on 18 May 2026 (in Spanish) set an initial budget of €11 million, which can be increased by a further €5 million. The Basque Government later announced that the programme would have €14 million as part of its SME support package, compared with €4.5 million in 2025.

The grants are non-repayable and fall under the EU de minimis regime. They are awarded on a rolling basis: SPRI decides on each application in the order in which it becomes complete, until the budget is exhausted. The maximum decision period is six months from submission of the complete file.

Which companies can apply

Industrial companies and providers of related services, whether individuals or legal entities of any size, can apply if they meet these conditions:

• They have an operating site in the Basque Country, where the project is carried out and has an impact.
• They are registered for Basque Business Activity Tax (IAE) and up to date with tax and social security obligations.
• They have not received more than €300,000 in de minimis aid over the last three years.

Excluded entities include members of the Basque Science, Technology and Innovation Network (RVCTI), public-sector bodies and companies engaged in primary agricultural, fishing or aquaculture production.

"En una convocatoria de concesión sucesiva, un expediente completo pesa tanto como un buen proyecto."

Eligible projects: from the plant to the product

Projects must fit into at least one stage of the pathway towards compliance with cybersecurity regulations or standards; covering every stage is not required. For company cybersecurity, the programme includes:

• Initial assessment: audits, review of controls and policies, and measuring staff awareness.
• Strategy: security master plans and action plans.
• Implementation: asset inventories, risk analysis, governance and compliance (GRC), network segmentation, secure remote access to OT (operational technology) systems, firewalls, EDR/XDR, SOC services, and incident response, continuity and recovery plans.
• Assessment, audit, certification and continuous improvement against recognised frameworks.

The new feature in 2026 is product cybersecurity: secure design, threat analysis, code review, encryption and key management, vulnerability management and product certification.

Compagnons - Unsplash - Technical team working on software code. Secure development and code review are part of product cybersecurity..

Funding rates, eligible costs and deadlines

The grant covers 60% of the eligible base, up to €100,000 per company for one or more projects. Eligible costs are consulting, engineering, hardware and software licences (including SaaS for up to 12 months), incurred or invoiced from 1 January 2026 and executed within a maximum of 12 months.

One requirement is decisive: consulting or engineering must account for at least 20% of the eligible base. Under the formula in Article 7, the base is reduced if this threshold is not met. For example, with €10,000 of consulting and €90,000 of hardware and software, the base would be €50,000 and the grant €30,000. Solutions from providers holding the Cybersecurity Made in Europe label are exempt.

The work must be carried out by external expert companies; being listed in the Basque Cybersecurity Ecosystem catalogue (in Spanish) is taken as evidence of this. VAT, in-house work, travel and general-purpose office workstations are not eligible.

Preparing your application before 23 November

Applications are submitted online through SPRI's website with an advanced electronic signature. It is advisable to have ready:

1. A technical and financial proposal of up to 25 pages: company situation, need, tasks, technologies, itemised budget, hours and schedule.
2. Three supplier quotes where costs exceed the public-sector minor contract threshold.
3. A list of de minimis aid received and, for applications above €30,000, the declaration on statutory payment periods.

Once the project is completed, there are 90 calendar days to justify it with invoices, proof of payment and a technical report from the provider. Structuring the project and its eligible budget from the outset therefore avoids later adjustments. Because funds are allocated on a rolling basis, the practical rule is clear: submit a complete application as early as possible rather than waiting for the final days.

#IndustrialCybersecurity #SPRIGrants #BasqueIndustry