Content of the technical documentation 技術文件之內容

The technical documentation referred to in Article 31 shall contain at least the following information, as applicable to the relevant product with digital elements:

第 31 條所指之技術文件至少應包含下列資訊，依相關具數位元素產品之適用程度：

"As applicable" is doing work — it does not mean items are optional; it means each item scales to the product's nature. A software-only product provides software-relevant content under item 1; a hardware product provides photos and layouts under item 1(c). The whole list must be addressed — absence is itself a compliance statement.

「依適用程度」有其作用，非指項次可選；而指每項次按產品性質調整。純軟體產品於項次 1 下提供軟體相關內容；硬體產品於項次 1(c) 下提供照片與布局。整份清單須被處理，缺失本身即為合規聲明。

1. a general description of the product with digital elements, including:

1. 具數位元素產品之一般描述，包括：

(a) its intended purpose;

(a) 其預期用途；

(b) versions of software affecting compliance with essential cybersecurity requirements;

(b) 影響基本網路安全要求符合性之軟體版本；

(c) where the product with digital elements is a hardware product, photographs or illustrations showing external features, marking and internal layout;

(c) 具數位元素產品為硬體產品時，顯示外部特徵、標記與內部布局之照片或插圖；

(d) user information and instructions as set out in Annex II;

(d) 附件二所定之使用者資訊與說明；

2. a description of the design, development and production of the product with digital elements and vulnerability handling processes, including:

2. 具數位元素產品之設計、開發、生產與弱點處理流程之描述，包括：

(a) necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing;

(a) 具數位元素產品設計與開發之必要資訊，包含於適用時之繪圖與方案，以及系統架構之描述、解釋軟體元件如何互建或互饋並整合進整體處理；

(b) necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates;

(b) 製造商所建立弱點處理流程之必要資訊與規格，包含軟體物料清單、協調弱點揭露政策、提供弱點通報聯絡位址之證據，以及為安全散布更新所選之技術解決方案之描述；

(c) necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes;

(c) 具數位元素產品之生產與監控流程及該等流程驗證之必要資訊與規格；

3. an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable;

3. 依第 13 條所設計、開發、生產、交付、維護之具數位元素產品所針對之網路安全風險評估，包括附件一第一部分所定基本網路安全要求如何適用；

4. relevant information that was taken into account to determine the support period pursuant to Article 13(8) of the product with digital elements;

4. 依第 13(8) 條為具數位元素產品決定支援期間所考量之相關資訊；

5. a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation, and, where those harmonised standards, common specifications or European cybersecurity certification schemes have not been applied, descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied. In the event of partly applied harmonised standards, common specifications or European cybersecurity certification schemes, the technical documentation shall specify the parts which have been applied;

5. 全部或部分適用且引用已於《歐盟官方公報》公告之調和標準清單、本法規第 27 條所定共通規範、或依《規章 (EU) 2019/881》採納依本法規第 27(8) 條之歐洲網路安全認證機制，並於該等調和標準、共通規範或歐洲網路安全認證機制未被適用時，描述為符合附件一第一與第二部分所定基本網路安全要求所採方案，含其他所採相關技術規範清單。部分適用調和標準、共通規範或歐洲網路安全認證機制之情形，技術文件應明定已適用之部分；

6. reports of the tests carried out to verify the conformity of the product with digital elements and of the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of Annex I;

6. 為驗證具數位元素產品與弱點處理流程符合附件一第一與第二部分所定適用基本網路安全要求所執行之測試報告；

7. a copy of the EU declaration of conformity;

7. 歐盟符合性聲明之副本；

8. where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I.

8. 適用時，依市場監督機關合理請求提供之軟體物料清單，以該機關為能檢查符合附件一所定基本網路安全要求必要為前提。

Note the asymmetry between item 2(b) and item 8. Item 2(b) requires SBOM availability in the file as part of vulnerability handling. Item 8 provides the SBOM to market surveillance on reasoned request. The SBOM must exist and be retrievable; it does not need to be pushed to the authority unsolicited.

留意項次 2(b) 與項次 8 之不對稱。項次 2(b) 要求 SBOM 於檔案中作為弱點處理之一部分可用。項次 8 依合理請求提供 SBOM 給市場監督機關。SBOM 必須存在並可取得；不需主動推送至機關。

Art 31(1): Technical documentation shall be drawn up before the product is placed on the market and be kept up to date. Art 31(2): Updates are required as appropriate, including during the support period. Art 31(3): Where the product is subject to other Union legal acts requiring technical documentation, a single set of technical documentation covering all applicable acts shall be drawn up. Art 31(4): The manufacturer may choose any official EU language(s) for the technical documentation provided to the notified body. Art 31(5): The Commission is empowered to adopt delegated acts to add elements to Annex VII. Retention floor: Art 13(12) and Annex VIII per-module rules require at least 10 years after placing on the market or the support period, whichever is longer.

第 31(1) 條：技術文件應於產品投放市場前製備並保持更新。第 31(2) 條：視情形更新，含支援期間內。第 31(3) 條：產品受其他要求技術文件之聯盟法律行為拘束時，應製備涵蓋所有適用法律行為之單一套技術文件。第 31(4) 條：製造商得選擇任一官方歐盟語言提供予指定機構之技術文件。第 31(5) 條：執委會有權採納授權法案增加附件七要素。保存底線：第 13(12) 條與附件八各 module 規則要求投放市場後至少 10 年或支援期間（取較長者）。