Are NIS2, CRA or ISO 27001 gap analyses really eligible?
Yes — as an as-is analysis within a digitalisation project. What matters is the framing: the project targets the digitalisation of your security and compliance processes and prepares the introduction of a software solution (e.g. VamiGRC). Measures that merely implement legal obligations are not eligible — we word the quote and project description accordingly.
Is the consulting really free for us?
The fixed-amount grant of up to €500 per consulting day can fully cover the consulting costs — reducing your own contribution for the consulting to as little as €0. What remains are statutory VAT (neutral for companies entitled to input tax deduction) and, if applicable, licence costs of software such as VamiGRC — software and licences are never eligible.
Who decides on the grant — and how fast?
The granting authority is NRW.BANK. It decides at its due discretion (no legal entitlement) in the order applications are received — first come, first served — and aims to approve within six weeks. The 2026 call runs from 7 September to 1 December 2026 with a budget of €1.415m; it may end early once the funds are committed.
Do we have to choose a certified consultant?
No. You choose the consulting firm freely; certification is not required, the registered office must be in the EU. Subcontracting is not permitted, and there must be no personal or corporate ties between you and the consultant. Exactly one contractor’s quote is eligible.
What happens after approval?
You have three months from the grant notice for delivery (payments up to five weeks after). The grant is paid as a fixed amount in one sum once the notice is final — immediately if you waive legal remedies. At the end you submit the final invoice, report and monitoring form.
What obligations come with the funding?
The report must evidence the impact (e.g. time savings, error reduction, process simplification); the authority may request underlying documents such as the as-is analysis, target concept or specification sheet on a sample basis — we produce all artefacts audit-proof. For your own PR about the project, the unmodified MID logo and the prescribed funding acknowledgement must be used.
We already use other funding — can we still use MID?
No other public grant may be used for the same project (no double funding); other projects are unaffected, and public loans and guarantees are exempt. In addition, the de minimis ceiling of €300,000 per three years applies across all de minimis aid — we check this in the funding check.
