Do you sell software, publish a mobile app or have a digital product developed by a service provider? Your company may be a “manufacturer” under the EU cybersecurity regulation for digital products, Regulation (EU) 2024/2847, known as the Cyber Resilience Act (CRA). Since September 11, 2026, manufacturers must report exploited vulnerabilities in their products and severe incidents within a few hours; most of the rest, including the security requirements, will apply from December 11, 2027.

Cyber Resilience Act: what has applied since September 11, 2026

Two events must be reported (Article 14): an “actively exploited” vulnerability, for which there is reliable evidence that a malicious actor has used it without authorization, and a severe incident affecting the security of the product. The European Commission’s page on reporting describes three steps:

• an early warning, no later than 24 hours after becoming aware of the event;
• a notification within 72 hours, describing the exploitation or the incident, the measures taken and those that users can apply;
• a final report, no later than 14 days after a fix has been made available for a vulnerability, or one month after the notification for a severe incident.

These reports are submitted on the ENISA single reporting platform, run by the EU cybersecurity agency. They reach ENISA and, at the same time, the coordinating incident response center of the country where the manufacturer has its main establishment (in France, the CERT-FR of ANSSI, the French national cybersecurity agency). The manufacturer must also inform the affected users and, if necessary, tell them what measures to take.

The obligation also applies to products already on the market, but, according to ENISA’s FAQ, an exploitation the manufacturer knew about before September 11, 2026 does not have to be reported retroactively.

Is your software or app affected?

The regulation covers any software or hardware, together with its remote data processing, intended to connect to a device or a network and supplied in the course of a commercial activity, whether paid or free. The Commission’s guidance of July 27, 2026, which is not binding, provides some reference points:

• a mobile app downloaded from an app store, or software installed on the user’s computer, is a product;
• the server without which the app cannot perform one of its functions is part of the product, if it was designed by or for the manufacturer;
• a web application used only in a browser, or a website that presents information, is not a product, unless it is used to operate a covered product; other texts, such as the GDPR, may apply to it.

A product made for one’s own use is not “placed on the market”, the Commission’s FAQ specifies, and certain products, such as medical devices and motor vehicles, are excluded.

Who is the manufacturer when you have a product developed?

The manufacturer is whoever develops a product, or has it designed and developed, and markets it under its own name or trademark. Using a service provider therefore does not transfer responsibility: for an app developed by a studio and published under your brand, it is in principle your company that bears the manufacturer’s obligations, including reporting.

Conversely, a service provider that sells its own solution under its own name, or grants a license to its source code, is the manufacturer of that solution. Anyone who substantially modifies an existing product and then makes it available becomes the manufacturer of the modified part, or even of the whole product if the modification affects the cybersecurity of the product as a whole (Article 22).

A custom tool for internal use is assessed case by case. For a custom product intended for a specific business customer, two exemptions are possible if both parties explicitly provide for them in the contract: on secure-by-default configuration and on free security updates.

What will be required from December 11, 2027

Products placed on the market from December 11, 2027 will have to meet the essential security requirements (Annex I). In particular, the manufacturer will have to:

• draw up the list of software components, in a commonly used machine-readable format, covering at least those the product uses directly, with no obligation to publish it;
• fix vulnerabilities without delay, where possible through security updates separate from feature updates, free of charge unless otherwise agreed for a custom product;
• regularly test the product’s security, apply a coordinated vulnerability disclosure policy (handling the vulnerabilities that third parties report) and provide an address for reporting them;
• carefully check components supplied by others, including open source software.

The manufacturer will set a support period (during which it handles vulnerabilities) of at least five years, or equal to the expected period of use if that is shorter, and will state its end date at the time of purchase. Each security update will remain available for at least ten years, or until the end of the support period if that is longer. Products placed on the market before December 11, 2027 are only subject to these requirements if they are substantially modified after that date.

What to include in the contract with your service provider

The 24-hour deadline starts as soon as the manufacturer becomes aware of the exploitation: if your service provider hosts and monitors the app, the contract must specify how the provider alerts you. Points to put in writing:

• who the manufacturer is and who will draw up the technical documentation and the declaration of conformity required from December 2027;
• a short deadline for alerting you in the event of a suspected exploitation or incident, and the people registered on the ENISA platform;
• the list of components for each version, monitoring of external components and fix deadlines based on severity;
• the support period, security updates and any exemptions (custom product);
• access to the source code, to the tools used to build the software and to the documentation: the manufacturer remains responsible throughout the support period, even if it changes service providers.

To pass on to your service provider: this list is the software bill of materials (SBOM), with top-level dependencies at a minimum.

A concrete example

Take, as an illustration, a 30-person SME that distributes professional equipment. It has had a mobile app for ordering and delivery tracking developed under its brand, with a server designed for it and hosted by the service provider. The SME is in principle the manufacturer, and this server is part of the product.

One Friday evening, the service provider’s monitoring detects abnormal access to the server, exploiting a vulnerability in an external component. If the contract provides for an alert within a few hours and an SME representative is already registered on the platform, the early warning can go out within 24 hours; otherwise, the deadline becomes hard to meet.

Frequently asked questions

Is a small business exempt from reporting vulnerabilities?

No. Microenterprises and small enterprises are only exempt from the fine for missing the 24-hour early warning deadline. For other breaches of Articles 13 and 14 (manufacturer obligations, reporting) or of Annex I, the fine is capped at €15 million or 2.5% of worldwide annual turnover, whichever is higher; each Member State sets its own penalties.

Does a vulnerability found during an audit have to be reported?

No, as long as no malicious exploitation has been established: according to the Commission’s FAQ, a vulnerability found during tests carried out for the manufacturer does not have to be reported. Fix it quickly; you can also report it voluntarily (Article 15).

Where should I start now?

List the products published under your brand and their manufacturer. Register a main representative and at least one secondary representative on the ENISA platform, each with a European Commission EU Login account protected by multi-factor authentication (in addition to the password). Finally, review your contracts.

411bit can help: security audit of your applications and their components (Secure), custom development with no proprietary lock-in, with the option of handing over the code, the documentation and the list of software components (Build), monitoring with alerts and ongoing maintenance under a contractual service level (Run). To review your situation, contact us: every request receives a reply within 24 business hours. If another provider developed your application, the project for the audit and then takeover of an industrial B2B platform illustrates the approach.

Since August 2, 2026, the EU AI Act (Regulation (EU) 2024/1689) has applied for the most part. It is often described as “postponed”. That is only partly true: the delay adopted in July 2026 covers so-called “high-risk” uses, not the bans or the transparency rules, which require disclosing the use of AI. Here is where things stand on October 21, 2026.

What the EU AI Act requires, date by date

• Since February 2, 2025: certain practices are banned, such as social scoring, manipulating people without their knowledge (subliminal techniques) or inferring emotions in the workplace, except for medical or safety reasons. Providers and professional users of AI tools also take measures so that their staff use these tools with proper understanding (“AI literacy”, Article 4).
• Since August 2, 2025: rules on “general-purpose” AI models (capable of a wide variety of tasks), which apply to their providers and not to companies that simply use them; penalties apply.
• Since August 2, 2026: transparency obligations (Article 50).
• December 2, 2026: new ban on tools that generate realistic intimate or sexually explicit content of an identifiable person without their consent, as well as child sexual abuse material.
• December 2, 2027, instead of August 2, 2026: obligations for the high-risk uses listed in Annex III (recruitment, staff management, creditworthiness of individuals, education, etc.).
• August 2, 2028: obligations for AI tools built into regulated products as safety components (Annex I: toys, elevators, medical devices, for example).

These dates, taken from the European Commission’s official timeline, include a revision the Commission proposed on November 19, 2025 in a simplification package called the “digital omnibus”. This revision became Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, which entered into force on July 27, 2026. It also relaxed the AI literacy requirement and extended to “small mid-cap enterprises”, slightly larger than SMEs, some of the relief reserved for SMEs that develop high-risk tools: simplified technical documentation and a proportionate quality management system.

Transparency has not been postponed. Only the technical marking of generated content (a mark that software can read) has a grace period until December 2, 2026, for providers of generative tools placed on the market before August 2, 2026.

First step: list your AI tools

The text distinguishes the “provider”, which develops an AI tool or has it developed and places it on the market or puts it into service under its own name, from the “deployer”, which uses it under its own authority in a professional context. An SME that subscribes to a service available on the market is a deployer. If it has a custom assistant developed and puts it into service under its own brand, even for its own use, it may be considered a provider.

For each tool, note:

• its actual use and the people affected;
• who provides it, how you access it (subscription, existing software, custom development) and your role;
• the data sent to it, especially personal or confidential data;
• its risk level: prohibited, high-risk, subject to transparency or minimal.

Most everyday uses (drafting, summarizing, translation) generally fall under minimal risk, with no specific rules beyond AI literacy. Recruitment, employee evaluation or the creditworthiness of individuals, on the other hand, call for immediate attention.

Disclosing the use of AI: mandatory since August 2, 2026

Article 50 requires informing people:

• a chatbot, or any tool designed to interact with people, must be designed so that people know they are dealing with an AI, unless this is clear from the context;
• deepfakes, meaning images, audio or video produced or altered by AI that deceptively imitate real people, places or events, must be labeled as such;
• text produced by AI and published to inform the public on matters of public interest must be labeled, unless it has undergone human review or editorial control, under a person’s editorial responsibility;
• the use of a tool that recognizes emotions or classifies people based on their biometric data (facial features, for example) must be disclosed.

The information must be clear and given at the latest at the first interaction or first exposure. On July 20, 2026, the Commission published guidelines on these obligations; a code of practice on AI-generated content, which companies may sign up to voluntarily, was finalized in June 2026.

Personal data and contracts with your vendors

The AI Act does not affect the GDPR, which protects personal data and remains fully applicable. As soon as an AI tool processes such data, résumés for example, the usual rules apply: legal basis (a ground provided for by the GDPR), informing the people concerned, retention period, security. A data protection impact assessment (a prior study of the risks) is required if the processing is likely to result in a high risk to people (Article 35). Subject to exceptions, no one should be subject to a fully automated decision that significantly affects them (Article 22).

A vendor that processes data on your behalf is a “processor” (Article 28 of the GDPR): a contract must specify, among other things, the subject matter, duration and purpose of the processing. For an AI tool, also include clauses on:

• whether or not your data is reused to train (improve) the provider’s models;
• where data is hosted and any transfers outside the European Union;
• who takes on which AI Act obligation, for example disclosing that a chatbot is an AI;
• the documentation supplied, log retention (the history of operations) and reversibility (getting your data back to switch vendors).

A concrete example

Take, as an illustration, a 25-person trading SME.

• Its writing assistant for quotes falls under minimal risk: a short usage rule (no sensitive customer data in a consumer tool, review before sending) and hands-on training help meet the AI literacy obligation.
• Its order-tracking chatbot, developed for the company and put into service under its name, states from the first message that it is automated. The contract with the developer covers this notice, where the conversations are hosted, how long they are kept and a ban on reusing them.
• Its planned tool for screening job applications is high-risk (Annex III). Its specific obligations will apply on December 2, 2027, but the GDPR already applies: check whether an impact assessment is needed, inform applicants, leave the final decision to a person. The company chooses a provider able to supply the required documentation.

Frequently asked questions

Has the AI Act been postponed?

Partly. The obligations for high-risk uses are pushed back to December 2, 2027 (Annex III) or August 2, 2028 (regulated products), not removed: risk management, technical documentation, human oversight, log retention. A tool placed on the market or put into service before these dates is only subject to them if its design later undergoes significant changes: a point to watch for a tool that is expected to evolve.

What fines could an SME face?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for the transparency obligations or those of deployers of high-risk tools. For an SME, the cap is the lower of the two amounts. Penalties must also take into account the economic viability of SMEs.

Do I have to train all my employees in AI?

The revised text asks companies to “encourage the development” of AI literacy through measures suited to people’s knowledge and the context of use, with no obligation to guarantee a specific level for each person. A written usage rule, hands-on training on the tools in use and a record of these actions form a reasonable basis. The Commission is due to publish practical examples, notably for SMEs.

411bit can inventory your uses of AI and the data that flows through them, review your contracts and processors from a technical standpoint as part of GDPR compliance work and, when it develops an assistant or an automation, build in transparency, logging and documentation from the design stage. Legal interpretation is handled with your legal counsel. You can describe your current uses to us: every request receives a reply within 24 business hours. See also securing your IT without holding back growth.

On October 14, 2025, Microsoft ended support for Windows 10. The Windows 10 end of life does not switch computers off, but the system no longer receives security patches on them, unless you subscribe to extended updates. A year later, your company may still have a few computers on Windows 10: an accounting computer, a PC that controls a machine, a laptop that was never replaced. For businesses, however, the first year of this program ended on October 13, 2026. The second began the next day, and it costs twice as much.

Here is where things stand as of October 21, 2026, based solely on Microsoft’s own publications, along with a method for deciding what to do with each computer.

Windows 10 end of life: where things stand on October 21, 2026

Microsoft offers an annual subscription called ESU (Extended Security Updates), which allows a Windows 10 computer to keep receiving “critical” and “important” security patches. It provides neither new features nor general technical support. Microsoft presents it as a paid, last-resort and temporary option.

There are two programs:

• The program for organizations covers the Pro, Enterprise and Education editions in business use. According to Microsoft’s FAQ, its first year ended on October 13, 2026, the second runs until October 12, 2027 and the third, the last, until October 10, 2028.
• The consumer program, reserved for devices in personal use, was due to end on October 13, 2026. On June 25, 2026, Microsoft announced a one-year extension: according to its page for consumers, it ends on October 12, 2027, and devices already enrolled remain covered automatically until then.

This extension does not apply to businesses: according to Microsoft, the consumer program “cannot be used in commercial scenarios”. It also excludes computers joined to a company directory (Active Directory or Microsoft Entra domain) and those managed by a device management tool. An SME therefore falls under the program for organizations.

Windows 10 ESU year 2: what it costs a business

For organizations, Microsoft lists a price of US$61 per computer for the first year and states that the price doubles every consecutive year, for a maximum of three years. That means $122 for the second year, then $244 for the third. These are reference prices: the amount in euros depends on the purchasing channel (volume licensing or a Microsoft partner reseller).

Three rules matter:

• The years add up. If you did not subscribe in the first year, covering a computer today means paying for year 1 as well: $183 for the two years, under the same rule. Covering it until the end of the program comes to $427 in total.
• Coverage is bought by the full year: Microsoft rules out shorter periods, such as six months.
• Each year is a separate license, valid for its own period only and activated on the computer with its own activation ID: activating the first year therefore does not cover the second.

Finally, these updates are provided at no extra cost for Windows 10 running remotely in Windows 365 or Azure Virtual Desktop, two Microsoft services, and for a Windows 10 computer connected to a Windows 365 Cloud PC, as long as the subscription is active.

Take inventory of your computers

Before spending anything, list the computers concerned. For each one, note at least:

• who uses it and for what: office work, accounting, controlling a machine, shared workstation;
• the exact version of Windows 10, because only version 22H2 can receive these updates;
• the edition and how it is managed (company directory, device management tool); the “long-term” LTSB and LTSC editions, which follow their own schedule, are excluded;
• the business software installed and what its vendor says about its compatibility with Windows 11;
• the computer’s age and general condition.

Upgrade to Windows 11 or replace the computer

When the hardware allows it, upgrading to Windows 11 remains the simplest route, and it is the one Microsoft recommends. Its hardware requirements include a compatible 64-bit processor with at least two cores at 1 GHz, 4 GB of memory, 64 GB of storage, boot firmware (UEFI) that supports Secure Boot and a TPM 2.0 security module. On an older computer, first check that its processor is on the list of supported models.

For each computer, there are three possible cases:

• the computer and its software are compatible: plan the upgrade to Windows 11, after a backup and a trial on a first computer;
• the computer is not compatible but is used for everyday tasks: compare the cumulative cost of the paid updates with the price of a replacement, bearing in mind that no coverage is planned after October 10, 2028;
• the computer is not compatible and cannot be replaced in the short term, for example because it controls equipment whose software only exists for Windows 10: you then need to pay for the extended updates and isolate it.

Protect the computers that stay on Windows 10

A computer kept on Windows 10 remains an at-risk device. Regarding third-party tools that control which applications are allowed to run, Microsoft points out that they “do not replace the product’s security patches”. Isolation follows the same logic: it reduces exposure, it does not replace updates. The usual measures:

• place the machine on a separate part of the network, limited to strictly necessary traffic;
• remove email, web browsing and general internet access when its use allows;
• remove users’ administrator rights, delete unnecessary accounts, disable USB ports and network shares that are not essential;
• back it up, so it can be rebuilt quickly;
• monitor it, so that an alert is raised in case of unusual behavior.

A computer cut off from the internet must still receive patches: give it limited access to Microsoft’s update services only, or distribute them from an internal update server. To activate the license without internet access, Microsoft provides a phone procedure.

Finally, keep a record of these exceptions (computers, reason for keeping them, measures, planned retirement date): this register helps you make decisions and will be useful in the event of an audit or incident. Our article on how to secure your IT without holding back growth explains this approach of proportionate measures in detail.

A concrete example

Take, as an illustration, a 20-person SME whose inventory reveals six computers still on Windows 10. Three are compatible with Windows 11: they are upgraded after the payroll software has been tested on a first computer. Two old laptops are not: rather than paying up to $427 each with no solution at the end, the company replaces them within the quarter’s budget. The last computer controls a cutting machine whose software only exists for Windows 10. It receives the year 1 and year 2 licenses, moves to an isolated network with no web browsing or email, and its patches reach it through an internal server. Replacing the equipment is included in the budget before the end of the third and final year of coverage.

Frequently asked questions

Will my Windows 10 computers stop working?

No, they keep working. But without the extended updates, they have not received any security patches since October 14, 2025, and flaws discovered since then remain open.

Microsoft 365 is still updated on Windows 10: is that enough?

No. Microsoft will keep providing security updates for Microsoft 365 apps on Windows 10 until October 10, 2028, but they only cover those apps. Windows 10 itself is only patched if the computer is covered by the extended updates.

Can we pay for the second year only?

No. The years add up: covering a computer in the second year means buying the first year as well, then activating the second-year license on the computer.

411bit supports small businesses and SMEs with this type of project: inventory of computers, compatibility checks, a plan to upgrade to Windows 11 or to replace computers, then isolation and monitoring of the computers kept on Windows 10, as part of an audit or a managed IT services contract (management of your IT by an outside provider). We provide a fixed-price quote per deliverable, with a single technical contact and a response to every request within 24 business hours. To review your computers, contact us. See also our article on choosing between managed IT services and in-house IT.

“How much does this tool cost?” is almost always the wrong question. The right one is: “how much does it cost me to carry on like this?” Until the second figure is on the table, the first one will always look too expensive. Here is how to calculate software ROI, with three worked examples.

A €4,900 quote is easy to see. It is one line, one signature, one decision. The nine hours you spend every week writing quotes in Word, on the other hand, never show up in any account. They are not written down anywhere, and no invoice reminds you of them. That is exactly why you pay for them without ever counting them.

Calculating software ROI in four steps

1. Your real hourly cost

For an employee, take the annual gross salary, multiply it by 1.45 (employer social contributions) and divide by 1,600 hours worked. An employee on €32,000 gross therefore costs about €29 an hour.
For a business owner, the reasoning changes. Your hour is not worth your salary, it is worth what it brings in when you spend it elsewhere: with clients, on a job site, recruiting. Depending on the trade, that is between €60 and €100 an hour.

2. The time actually lost

Do not estimate it from memory: everyone gets it wrong. Time one week, task by task, and also note the time spent fixing the errors that your current method creates. That is often where half the figure is hiding.

3. The annual cost of the status quo

Hours lost per week × 45 weeks × your hourly cost = what you are already paying, without seeing it.

4. The break-even point

Divide the project price by the monthly saving. The result is the number of months before the tool has paid for itself. Under six months, there is nothing left to debate. And since the project is paid for once, everything that comes after is a gain.

Paid once, or paid every month?

This is the question people forget to ask, and it is the one that costs the most over time.
A subscription ERP is often billed at around €45 per user per month. For a 15-person company, that comes to €8,100 a year. Every year. And the day you grow to 25 employees, the bill rises to €13,500 without the tool having changed.
Let’s compare over five years, for the same 15 people:

• Subscription ERP: €8,100 × 5 = €40,500. After five years, you own nothing, and if you stop paying, you lose the tool.
• Custom-built tool: €10,000 when you order, hosting included for the first year, then from €180 a month. That is €18,640 over five years. And it belongs to you.

The gap exceeds €20,000 over five years, and it widens with every new hire. To be honest, a custom tool needs hosting and maintenance: it is not free after delivery. But that cost depends on your infrastructure, not on the number of people who use it.

A subscription makes you pay for your growth. A tool you own does not.

Case 1: Friday-night quotes

A construction company with 8 employees. The owner prepares quotes and invoices in Word, starting from old files. Usually in the evening and on Saturday mornings.

• Time measured over one week: 9 hours
• Owner’s hourly cost: €70 (an hour of their time spent with clients brings in more)
• Annual cost of the status quo: 9 × 45 × 70 = €28,350

The solution: an ERP configured and ready to run, from €4,900 excl. VAT, including first-year hosting. Importing the catalog and training the team are quoted as options, depending on the volume to import.
After the switchover, 2.5 hours a week remain (approvals, special cases). The saving is 6.5 hours a week, or 6.5 × 45 × 70 = €20,475 a year, which is €1,706 a month.
Let’s be generous and budget €7,000, options included.

€7,000 paid once, €1,706 saved every month: paid back in 4 months.

And the following year? The project is already paid for. Only hosting remains, from €180 a month. The owner gets their Saturday mornings back, every year, without ever paying for the software again.

Case 2: double entry between the online store and sales management

A wholesale SME with 15 employees. Orders from the online store are re-entered by hand into the sales management software by two people.

• Combined time: 15 hours a week
• Fully loaded hourly cost: €28
• Annual cost of the status quo: 15 × 45 × 28 = €18,900

On top of that comes a cost nobody counts: about 2% of orders contain a data entry error. That means credit notes, re-shipments and customers who do not come back.
The solution: a tool built around their working methods, synchronized with the store, from €10,000 excl. VAT. Not a generic software package you have to shoehorn your habits into, but a tool that follows the way they sell.
After the switchover, 1.5 hours a week remain to check special cases. The saving is 13.5 hours a week, or €17,010 a year, which is €1,417 a month.

Paid back in 7 months. From the second year on, €17,000 stays in the company, every year.

The same need met by a subscription would have cost €8,100 a year for 15 people, indefinitely, with a tool that only half fits.

Case 3: payment reminders that never go out

A services SME with 30 employees and €1.2M in revenue. Nobody chases unpaid invoices systematically, because nobody has the time.

• Actual payment time: 68 days, versus the 45 set in the contract
• Those 23 extra days tie up 1,200,000 × 23 / 365 = €75,600 in cash on the clients’ side

The solution: an ERP with an automatic payment reminder module. Budget for the core system from €4,900 excl. VAT, plus the optional module. Payment time falls back to 48 days.
The calculation differs from the first two cases, and honesty matters here: the €65,700 that comes in is not additional profit. It is your own money, which was sitting with your clients, coming back to you. Once. But it does not leave again, and you no longer have to finance that gap.

Even budgeting €8,000 all-inclusive, you get back eight times your outlay in the first year, plus 2 hours of chasing a week.

What the calculation does not show

The figures above are deliberately conservative, because they only count time. They miss everything else:

• Errors avoided, and everything they cost downstream
• Deals won because the quote goes out the same day rather than three days later
• Teams that stay, because nobody resigns from a job where the work makes sense
• Growth absorbed without hiring: this is often the biggest gain, and the least visible

The three pitfalls of the calculation

1. Time saved is only a gain if it is reallocated. Freeing up 6 hours a week for someone who will spend them on something else useless brings in nothing. Decide in advance where those hours go: sales, production, or deliberate rest.
2. Count measured time, not perceived time. One week of honest tracking is worth more than three estimation meetings.
3. Do not forget the cost of switching. Training, an adjustment period, sometimes a few weeks of double entry. Include it, or your calculation is wrong and your disappointment guaranteed.

Frequently asked questions

Several thousand euros is still a lot of money. How do you justify it?

By comparing it with the right figure. If your current way of working costs you €28,000 a year in lost time, the real expense is not the €4,900 quote, it is the year you have just spent without changing anything. A project paid back in three months is not a cost, it is an investment whose return you know in advance.

Why custom software rather than an off-the-shelf product?

Because a software package makes you pay 100% of the price for 20% of useful features, and asks you to adapt your methods to its own. When your methods are your added value, you need to do exactly the opposite. And over five years, the subscription often costs twice as much.

What if the tool costs more than the time saved?

Then do not buy it. That is precisely what the calculation is for. Some needs do not justify a development project, and a good provider will tell you so before selling you anything.

How long before you really see the gain?

Rarely in the first month. Allow two to three months: time for the tool to be configured, for the team to master it and for old habits to disappear. The ROI calculation must factor in this ramp-up period.

Do the math before you sign

At 411bit, we always start with this costing. What your current situation costs, what the solution would cost, and how many months it takes to pay for itself. Our quotes are firm, and when the numbers do not add up, we say so. That is easier to stand behind than a tool that was sold and never gets used.
Let’s talk about what your current way of working costs you, or read our article on where to start with digitalizing an SME.

Three quotes are sitting on your desk. Give or take, they describe the same assignment: getting your IT back under control, securing your data, improving your website. The first one shows €300 per day, the second €500, the third €900. For the same service, why pay three times as much? The answer fits in one sentence: it is almost never the same service. And when deciding how to choose an IT service provider, comparing these quotes on the daily rate alone is the costliest mistake a buyer can make.

The daily rate (TJM, as it is called in French industry jargon) measures the price of one day of work. It says nothing about what that day actually contains: the level of expertise of the person doing the work, the guarantees that protect you if something goes wrong, the provider’s knowledge of your context, or what happens to your project if the relationship ends. Two days billed at the same price can cover radically different realities. Here, in practical terms, is how to choose an IT service provider by looking at what really matters rather than just the bottom line.

Freelancer, studio or IT services firm: three formats, three approaches

Before comparing prices, you need to understand what you are comparing. The IT services market falls into three main families, and each has its real strengths as well as its real limits. None is better in absolute terms. They meet different needs.

The freelancer: flexibility and cost, at the expense of continuity

A freelancer is an independent professional who works alone. It is often the most economical and most flexible option. The relationship is direct, with no sales intermediary, and a good freelancer can be remarkably effective on a one-off, well-defined need: developing a specific feature, fixing a server, building a simple brochure website.

The limits come from the very nature of the format. One person means availability that is never guaranteed: vacations, illness, or simply another client taking priority at the wrong moment. The scope is often limited to carrying out the task ordered, without the strategic perspective that comes with a broader engagement. Many freelancers work without a formal service contract or professional insurance, which leaves you exposed if something goes wrong. Finally, reliability varies widely from one freelancer to another: the best developer you ever meet may well be a freelancer, and so may the sloppiest. The main risk remains dependence on one individual, with no documentation or organized reversibility: if that person disappears, your project can end up stuck.

The independent studio: senior expertise within a professional framework

A studio, or independent firm, brings together a handful of people, usually between one and five. It is a company in its own right, with everything that implies: a service contract, professional liability insurance, a service commitment. You get direct access to senior expertise, with no sales layer between you and the person actually working on your project. The rate generally falls between that of a freelancer and that of a large firm, and you gain a contact who knows your environment in depth because they come back to it regularly.

This format has its limits too, and it would be dishonest to keep quiet about them. Its production capacity is limited: a studio is not built for a project that needs ten developers working in parallel for six months. Dependence on the owner is real, even if it is better managed than with a solo freelancer. And hours of coverage, especially outside business hours, must be negotiated explicitly rather than taken for granted.

The IT services firm: capacity and continuity, at the cost of overhead

An IT services firm, or established agency, employs dozens or even hundreds of people. Its strength is its capacity to absorb workload: it can bring in multidisciplinary teams, maintain continuity of service even when an employee leaves (internal turnover stays invisible to you), and run well-honed processes. It is the right format for large projects, multi-site rollouts and the most demanding compliance requirements.

Its cost is logically higher, because the structure has to be paid for: salespeople, project managers, offices, management. Your direct contacts are often sales or management profiles, further removed from the technical side. If your company is an SME, your account may carry little weight next to the agency’s major clients, with the risk of being treated as a lower priority. It is also not unusual to be billed for a junior profile at the firm’s standard rate. Finally, responsiveness sometimes comes with heavy procedures: more steps, more sign-offs, less agility.

How to choose an IT service provider: six questions to ask before price

This is the heart of the decision. Before you even open the pricing column, ask each provider the following questions. Their answers tell you far more than a number.

• Who will actually work on my project, and at what level? Is the person you met in the meeting the one who will do the work, or a salesperson who will hand over to someone you do not know?
• Is there a contract and professional liability insurance? What exactly does the insurance cover: a technical incident, a security breach, financial harm caused to your business?
• What is the actual service commitment? Guaranteed response time in case of failure, backups, restore capability, coverage window during business hours or beyond.
• Does the provider already know my environment? If not, how many days of discovery and onboarding will I pay for before useful work begins?
• What reversibility is planned? Documentation, handover of access, ownership of the code produced. In practical terms, what happens on the day the relationship ends?
• Does the quote describe a precise scope or a vague promise? A good quote lists what is included and what is not. Vague wording is a surprise invoice in the making.

The real cost of a service is not shown in the daily rate

Let’s take a deliberately simple example with figures. You are hesitating between two contractors for an assignment of about one month on your infrastructure.

The first charges €350 per day. Attractive on paper. But they do not know your environment: count on five days of onboarding before they are really operational, or €1,750 spent on getting to know your setup, not on solving your problem. During the assignment, they modify an existing integration without assessing the consequences and break the link with your invoicing tool: three days of fixes, €1,050. Finally, a failure occurs on a Friday evening, they cannot be reached before Monday, and your website stays down all weekend. If that site generates €2,000 in revenue per day, that is €4,000 gone. Add the fifteen days of actual work, and the real bill climbs well beyond the advertised rate.

The second charges €500 per day. They already know environments comparable to yours and become operational almost immediately. They are insured, committed to a response time of a few hours, and the Friday evening failure is handled right away. Over fifteen days, they cost €7,500, with no wasted discovery days, no damage to repair, no lost revenue.

The lowest advertised rate was €350. The lowest real cost came with the €500 rate. That is the whole difference between the price of a day and the cost of a result.

Warning signs, whatever the format

Some signs should put you on alert, whether you are dealing with a freelancer, a studio or an agency. They do not depend on the provider’s size but on how serious they are.

• No service contract offered, or reluctance to sign one.
• No professional liability insurance, or an inability to say what it covers.
• A quote without a detailed scope, promising a result without saying what it includes.
• Promises of business results along the lines of “your revenue is about to take off.” An honest technical provider commits to its work, not to your sales.
• An abnormally low rate, with no clear explanation of what justifies the gap.
• An inability to explain technical choices simply. People who truly master a subject can explain it in plain terms.
• Deliberate dependence: no documentation, no handover of access, a way of keeping you captive rather than independent.

The right format for each need

There is no universally right choice, only a choice suited to your situation. For a one-off, simple, well-defined need on a tight budget, a good freelancer will often be the most relevant answer. For a system that is critical to your business, whether it is your e-commerce platform, your infrastructure or your sensitive data, where you need expertise, guarantees and long-term follow-up, a studio or a structured firm will offer the best balance between skill, commitment and proximity. And for a large project involving several teams, or subject to heavy compliance obligations, the IT services firm remains built for scale.

So knowing how to choose an IT service provider always comes down to the same discipline, whatever format you choose: compare like for like, never on the daily rate alone. Put the questions from this checklist to each quote, and you will often see that price gaps reflect gaps in content. The provider with the lowest daily rate is rarely the cheapest in terms of results. This way of reading quotes, demanding but simple, is what protects your budget and your peace of mind.

At 411bit, we put this transparency at the heart of every quote: a written scope, accountability we stand behind, guaranteed reversibility. If you have several proposals on your desk and want to compare them like for like, let’s talk about your project. To go further, see also how to run an ERP migration without interrupting your business or how to choose between managed IT services and in-house IT.

Ezzedine Rezgani, founder of 411bit.

Small business digital transformation is not about piling up software: it is about eliminating work that adds nothing. Re-keying data, back-and-forth emails, copied spreadsheets, scanned paperwork. Every hour lost on these is an hour taken away from your business.

Where to start your small business digital transformation

Never start from the tool; start from the pain point. Ask your teams: “What makes you waste time every week?” The answers almost always point to the same culprits:

• Double data entry between two tools that do not talk to each other
• Documents that circulate by email and get lost
• Quotes and invoices put together by hand
• Inventory or schedules kept in a shared spreadsheet

Write down these pain points, estimate how much time they cost each week, and rank them. The first one on the list is your first project. The rest can wait.

A concrete example

Take a building contractor with eight employees. Quotes are prepared in the evening, in Word, starting from old files that get copied and pasted. The result comes down to three figures: two hours of paperwork every evening, missing lines one time in five, and quotes that go out two days late while the customer is already calling a competitor.
A single project is enough to change everything: a quoting and invoicing tool linked to the company’s price catalog. Quotes go out the same day, accurately priced, with automatic follow-ups if they go unanswered. The gain has nothing to do with technology. It is measured in evenings won back and in deals that no longer slip away to competitors for lack of responsiveness.

Three rules to avoid mistakes

1. One project at a time. The digital transformation that fails is the one that tries to change everything at once. Start with the most painful process.
2. Tools that connect. Every new tool must be able to exchange its data with the others; otherwise you create new re-keying.
3. People first. A tool nobody uses is a cost, not progress. Train, support, listen.

The right indicator is not the number of software programs installed, it is the number of hours given back to your teams each week.

What about the return on investment?

A well-run digital transformation pays for itself quickly: fewer data entry errors, quotes that go out the same day, accurate inventory, invoicing without delays. It is measurable, and it is what we measure on every engagement.

Frequently asked questions

Which tool should you start with?

The one that fixes your biggest pain point, not the trendiest one. If your quotes are costing you your evenings, start with invoicing. If your inventory figures are wrong, start there. The order is set by the time you lose, not by sales brochures.

How much does small business digital transformation cost?

Less than you might think, when you move forward in stages. A first targeted project often comes to a few hundred euros a month in subscriptions, easily covered by the time saved. The real trap is the big “everything at once” project, billed at a high price and never finished.

Should you switch to an ERP right away?

Rarely. An ERP makes sense when several departments need to share the same data. Many SMEs already gain a great deal from two or three well-connected tools before considering a full ERP.

Will my teams get on board?

They will if the tool visibly makes their lives easier and if they are trained on their own cases. Rejection almost always comes from a tool imposed without explanation, never from a tool that saves time from the very first week.

The first step

You do not need a three-year plan to get started. You need to identify the first pain point and fix it properly. The rest follows, project after project, without ever bringing the company to a halt.
Want to find out where you could win back time? Let’s talk about your digital transformation, or find out how to run an ERP migration without interruption.

Managed IT services means entrusting the monitoring, maintenance and support of your IT to a provider, for a flat monthly fee. Compared with hiring an IT employee or the do-it-yourself approach, managed IT services often give an SME the best balance between cost and peace of mind. Let’s compare.

Once a company passes about ten workstations, the same question always comes up: who takes care of IT? There are three options.

Option 1: an in-house IT employee

An in-house technician costs between €45,000 and €60,000 a year, including payroll taxes. They know your company inside out, but they are on their own: vacations, sick leave, resignation. It is a good choice beyond 80 to 100 workstations.

Option 2: the do-it-yourself approach

This is the “colleague who knows about computers.” It works until the first real problem: unchecked backups, postponed updates, no security at all. Apparent cost: zero. Real risk: maximum. That colleague also has a real job, and IT always comes after their own urgent tasks.

Option 3: managed IT services, the flat fee that keeps watch over everything

• Continuous monitoring: failures detected before you notice them
• A range of skills without depending on a single person
• Predictable cost: a monthly fee instead of a salary
• Written commitments: response times guaranteed by contract

A concrete example: an SME with 25 workstations

Take a company with 25 employees, two servers and an online store. Let’s compare over one year.

• Hiring a technician: about €50,000 a year, on site 5 days a week during office hours. Five weeks of vacation during which nobody takes over. They will be excellent at what they know, and alone with what they do not.
• Managed IT services: around €6,000 to €9,000 a year for this setup. Round-the-clock monitoring, several areas of expertise behind the contract (network, security, backup), written response times.

The gap is not only financial. With 25 workstations, a full-time employee does not have enough work to be usefully busy all year, yet they are alone when a real failure hits. This is exactly the tipping point where managed IT services make the most sense.

The right questions to ask a provider

1. What exactly does the flat fee cover, and what does anything outside it cost?
2. Who holds the access credentials and the documentation? Insist on reversibility
3. Are backups tested, and how often?
4. What is the contractual response time for a failure that brings work to a halt?

The right provider is one that is willing to leave: up-to-date documentation, access handed over, no technical lock-in.

Warning signs to watch for

A provider who refuses to give you your own passwords, an “all-inclusive” package whose scope is written down nowhere, hourly billing for call-outs that come back every month for the same failure. In all three cases, you are not paying for peace of mind, you are paying for dependence.

Frequently asked questions

How many workstations before managed IT services become worthwhile?

In practice, from about ten workstations, as soon as a failure costs you a day of work. Below that, occasional support is often enough. Beyond 80 to 100 workstations, an in-house IT person backed by a provider becomes the right setup.

What happens if I want to change providers?

With a proper contract, nothing dramatic: you get back the access credentials, the documentation and your data. That is precisely why you need to ask about reversibility before signing, not on the day you want to leave.

Do managed IT services replace a CIO?

No, these are two different roles. Managed services keep the existing systems running. Strategic direction (which tools, which investments, which roadmap) remains a management decision, possibly with outside support.

What if I already have an in-house IT person?

The two complement each other very well. The provider handles monitoring, on-call duty and specialized topics, while your in-house person stays close to the teams and keeps the knowledge of your business. It is the most common setup once a company reaches a certain size.
411bit offers managed IT services contracts starting at €350/month excl. VAT, with continuous monitoring, a monthly report and guaranteed reversibility. Let’s review your IT setup together.
See also: cybersecurity for small business without holding back growth.