An independent reading project on the EU CRA. 一個讀 EU CRA 的個人筆記。

What this is這是什麼

CRA Notebook is a personal study site about Regulation (EU) 2024/2847 — the EU Cyber Resilience Act. It is one engineer’s attempt to read the regulation closely, write down what is in there, and write down the thoughts and reactions along the way.

CRA 閱讀筆記是一個關於 Regulation (EU) 2024/2847 — 歐盟網路韌性法 — 的個人研讀網站。由一位工程師認真讀法規、把讀到的寫下來、把想到的也寫下來。

It is not a legal advice service, not a compliance consultancy, not a TIC offering. It does not represent any company. It does not recommend any service provider. It is just a reading project, written on personal time, with varying degrees of foolish mistakes along the way, hosted on the cheapest possible static stack, because closing it up did not seem to make any sense.

不是法律意見服務、不是合規顧問業務、不是 TIC 服務。不代表任何公司。不推薦任何服務商。就是一個單純的閱讀專案，在個人時間寫的、難免會有些蠢錯，放在最便宜的靜態網站上，因為關掉它也沒什麼意義。

Why this exists為什麼存在

The CRA becomes fully applicable on 11 December 2027. A very large number of APAC manufacturers will need to understand the regulation by then. The resources I have been able to find on the EU CRA cluster into roughly four categories: posts and talks from CRA specialists; marketing collateral from law firms; service catalogues from TIC bodies; second-hand summaries from trade press. None of these is bad. None of them is the same thing as a careful, first-hand reading of the regulation written in the everyday language of APAC manufacturing.

CRA 在 2027 年 12 月 11 日全面適用。屆時將有非常多 APAC 製造商需要理解這部法規。我能找到的 EU CRA 相關資源大致分為四類：CRA 專家的分享；法律事務所的文宣；TIC 機構的服務型錄；產業媒體的二手摘要。都不算差。但沒有一類做的是「就條文本身、第一手讀過、用 APAC 製造業日常語言寫」的東西。

So I am writing one. The site exists because the gap between the regulation as text and the regulation as it lands in an APAC manufacturer’s operating reality is wide enough that bridging it from primary sources, in plain language, in two languages, has its own value. Whether or not anyone reads it, the act of reading the regulation closely enough to write it down is itself useful for the writer.

所以我自己寫一份。法規條文是一回事、它落到 APAC 製造商營運現實裡又是一回事；兩者之間的落差夠大、從一手資料出發、用白話、用兩種語言去銜接這個落差、本身就有價值。不管最後有沒有人讀、把法規讀到能寫下來、對寫的人本身就值得。

How this site is staged這個網站的階段標示

Notes on a regulation written by a working person are never finished. Some pages here are first drafts I am still thinking through. Some are pages I have audited carefully and am willing to stand behind today, while reserving the right to revise tomorrow. None of them are claims to authority.

一個現職工程師寫的法規筆記永遠不會完工。這裡有些頁面是還在思考的初稿；有些是我認真校過、目前願意背書、但保留明天修改的權利。沒有任何一頁是在宣稱權威。

Each article-level page carries a status:

每篇文章層級的頁面都帶一個狀態標示：

• Working — actively evolving. May be revised. Not for direct citation. A banner appears at the top of the page to signal this.
• 書寫 — 還在推進中。可能修改。不適合直接引用。頁面頂端會顯示提示橫幅。
• Standing — I have audited the facts, I am willing to stand behind the argument as of Last reviewed. Citation is fine; revisions are still possible and will be logged in /errata.
• 校正 — 事實層面我已 audit、就 最後校閱 那天的版本願意背書。可以引用；後續修訂仍可能、且會記錄在 /errata。
• Archived — I no longer actively maintain this version. Kept for historical record. Newer thinking, if any, will be in a fresh page.
• 封存 — 我不再主動維護這個版本。保留為歷史紀錄。如果有新的思考、會另開新頁。

This staging is borrowed from how working notebooks actually work, not from how reference works pretend to. The point is not to claim more than I have done; it is to let the reader calibrate.

這套階段標示是從筆記本真實運作的方式來的、不是 reference 書假裝完工的方式。不是要宣稱比實際做的多、是要讓讀者能 calibrate。

What this is not這不是什麼

About the author關於作者

The site is written by Maxi Tsai, who has spent a number of years in the APAC product and cybersecurity compliance industry, working with manufacturers on regulatory and compliance questions. The CRA project here grew out of that work but is not part of it — this is personal time, written from a personal reading of the regulation, with no organisational position behind it.

本站作者為 Maxi Tsai，在 APAC 產品與網路安全合規產業工作多年、協助製造商處理法規與合規議題。CRA 這個專案是從那份工作衍生出來的、但不屬於那份工作的一部分 — 這是個人時間、從個人對法規的閱讀寫成、背後沒有組織立場。

If you would like to know a bit more about me, LinkedIn:

想多了解作者一點，LinkedIn：

Updating cadence更新節奏

The site updates as the reading progresses. There is no schedule, no newsletter, no commitment to a weekly post. A new article arrives when an article has been read closely enough to write about it.

網站隨閱讀進度更新。沒有時程表、沒有電子報、沒有「每週一篇」的承諾。新文章在某個條文被讀夠可以寫的時候才出現。

Articles already published get re-examined and, where appropriate, revised when official Commission Guidance, FAQs, or implementing acts shift the underlying definitions. The regulation is a moving target through 2026 and 2027, and the writing here moves with it.

當 EC 官方 Commission Guidance、FAQ、或 implementing acts 動到底層定義時、已發表的文章會重新檢視、必要時修訂。法規在 2026 與 2027 之間是個會動的目標、這裡的文章也會跟著更新。

If you are reading the site for compliance work, treat any specific article as a snapshot dated to its “last reviewed” line at the foot. Anything older than three months is worth checking against the most recent Commission output before you rely on it.

如果你是為了合規工作來讀本站、把任何一篇文章都當成它「最後校閱」日期當下的快照。超過三個月的內容、用它之前最好對照最新的 Commission 文件再檢查一遍。

Site version網站版本

Current site version: v1.1.4, released 29 April 2026.

目前網站版本：v1.1.4、2026 年 4 月 29 日發布。