Market surveillance and control of products 具數位元素產品的市場監督與管控

A worked example: the Tuesday morning letter 一個情境：週二早上那封掛號信

Picture a Tuesday morning at a European importer of an APAC-built industrial PC. A registered letter arrives from the Bundesamt für Sicherheit in der Informationstechnik. It is an information request: provide the EU declaration of conformity, the Annex VII technical documentation, the SBOM current as of the most recent placing on the market, the coordinated vulnerability disclosure policy, and the vulnerability handling records for the past twelve months. Seven calendar days. The importer reads it once, picks up the phone, and dials Asia. From the APAC manufacturer’s end, this is the first concrete contact with Article 52. The text of the article describes an authority architecture; the phone call is what the architecture actually does.

想像歐洲某進口商週二早晨的場景，他們進口一家 APAC 廠商的工業 PC。一封掛號信從德國 BSI（Bundesamt für Sicherheit in der Informationstechnik）寄來。是一份 information request：要求提供 EU declaration of conformity、Annex VII 技術文件、對應最近一次 placing on the market 版本的 SBOM、coordinated vulnerability disclosure policy、以及過去 12 個月的 vulnerability handling 紀錄。7 個日曆天。進口商讀過一次、拿起電話、撥到亞洲。對 APAC 廠商來說、這是第一次具體碰到 Art 52。條文描述的是機關架構；那通電話是這個架構實際做的事。

What actually triggers the call 實際觸發那通電話的事

Article 52 grants market surveillance authorities the powers laid out in Regulation (EU) 2019/1020 — document requests, on-site inspections, sample testing, the lot. From the APAC manufacturer’s perspective the relevant question isn’t which power was used; it’s what made the authority pick up the file in the first place. The triggers cluster into five categories: spot-check sampling under a Member State’s annual market surveillance plan; a customer complaint, often from a procurement officer at a regulated buyer (hospital, utility, government department); an Article 14 incident report that the authority is following up on; a RAPEX-style cross-border alert from another Member State; and media coverage of a disclosed vulnerability. The first two and the last one are the volume drivers. The Article 14 trigger is the one that escalates fastest, because the authority is not starting from scratch — the manufacturer has already self-identified an incident.

第 52 條賦予市場監督機關 Regulation (EU) 2019/1020 所列的權力，文件調閱、現場稽查、樣品測試、整套。對 APAC 廠商來說，相關的問題不是哪個權力被動用、而是當初是什麼讓機關把這個 file 拿出來。觸發來源分為五類：會員國年度市場監督計畫下的抽查；客戶投訴、常來自規範性採購方（醫院、公用事業、政府部門）的採購人員；機關在追蹤的某份 Art 14 事件通報；另一會員國發出的 RAPEX 式跨境警示；媒體對已揭露弱點的報導。第一、第二、第五項是量的驅動者。Art 14 觸發升級最快，因為機關不是從零開始，製造商已經自我識別了一個事件。

What you have to find within 24 hours 24 小時內必須找到的東西

The information request will list specific documents. The list is not surprising; everything on it is something Article 13 already required the manufacturer to maintain. The surprise is operational: the documents must be retrievable, current, and tied to a specific version of the product as placed on the market. The minimum set: the EU declaration of conformity for the version in scope; the Annex VII technical documentation including risk assessment, design and development records, and conformity assessment results; the SBOM corresponding to the placed-on-market version, with dependency information current at the time of that placement; the CVD policy as published; vulnerability handling records for the past twelve months including triage decisions and remediation timelines; the declared support period and the reasoning behind it; and proof of authorised representative or EU contact point under Article 13(15)–(18).

Information request 會列出具體文件。清單不令人意外；上面每一項都是 Art 13 已經要求製造商維護的。意外的是操作面：這些文件必須可調閱、是最新的、且綁定於 placed-on-market 的具體產品版本。最低限度的集合：對應範圍內版本的 EU declaration of conformity；Annex VII 技術文件，包括風險評估、設計開發紀錄、conformity assessment 結果；對應 placed-on-market 版本的 SBOM，依賴資訊截至該次 placement 為最新；已公布的 CVD policy；過去 12 個月的 vulnerability handling 紀錄，包括分流決定跟修補時程；宣告的 support period 跟其理由；以及 Art 13(15) 到 (18) 下的 authorised representative 或 EU contact point 證明。

Failure mode 1 — documents exist but are out of date 失敗模式 1：文件存在但過期

The manufacturer can produce a 2025 SBOM for a product placed on the market in early 2026, after which two firmware updates were issued. The CRA requirement is that the SBOM track the version that is actually on the market. An out-of-date SBOM is, in practice, treated as no SBOM — the document does not match the artefact the authority is examining. This is the single most common failure mode, and it is structurally a continuous-monitoring failure: somebody had to update the SBOM at every release and didn’t.

製造商可以拿出 2025 年的 SBOM，但對應的產品是 2026 年初投入市場、之後又發了兩次韌體更新。CRA 的要求是 SBOM 必須對應實際在市場上的版本。實務上，過期的 SBOM 等同沒有 SBOM：文件對不上機關正在檢視的成品。這是最常見的失敗模式，而且結構上是「持續監控」的失敗：應該有人每次出版都更新 SBOM，但沒有。

Failure mode 2 — SBOM is fragmented or incomplete 失敗模式 2：SBOM 片段或不完整

An SBOM that lists only top-level dependencies, an SBOM that doesn’t cover firmware components only the OS layer, an SBOM in a non-standard format that doesn’t round-trip into common tooling. The Annex I Part II requirement is for an SBOM “covering at the very least the top-level dependencies of the product” in a commonly used and machine-readable format — but in a market-surveillance context, the authority will probe whether the listed dependencies are sufficient to enable a meaningful vulnerability analysis. The SBOM is not a checkbox; it is the artefact the authority uses to verify that the manufacturer can actually reason about its supply chain. A thin SBOM signals a thin process.

只列上層依賴的 SBOM、不涵蓋韌體元件只涵蓋 OS 層的 SBOM、非標準格式而無法跟一般工具來回轉換的 SBOM。Annex I 第二部分的要求是 SBOM「至少涵蓋產品上層依賴」、採通用機器可讀格式，但在市場監督情境下，機關會探究列出的依賴是否足以支援有意義的弱點分析。SBOM 不是打勾項目；它是機關用來驗證製造商是否真的能分析自己供應鏈的成品。薄的 SBOM 透露的是薄的流程。

Failure mode 3 — no authorised representative or EU contact point 失敗模式 3：沒有 authorised representative 或 EU contact point

Article 13(15)–(18) require manufacturers established outside the EU to designate an authorised representative or, where exempted, a clearly identified EU contact point. APAC manufacturers selling exclusively through European distributors sometimes assume the distributor handles this; the regulation does not. The market surveillance authority that cannot serve a request on a clear EU representative will escalate, and an escalation under Article 52 reaches Article 64 quickly — including the Tier-3 bracket for incomplete or missing information.

第 13(15) 到 (18) 條要求設立於歐盟外的製造商指定 authorised representative，或在豁免的情況下指定一個明確識別的 EU contact point。APAC 製造商如果只透過歐洲通路銷售，有時假設通路會處理這件事；法規不是這樣寫的。市場監督機關如果找不到可以送達 request 的明確歐盟代表，會升級；Art 52 下的升級很快就會到 Art 64：包括資訊不完整或缺失的 Tier-3 罰則層級。

The continuous-update reading 持續更新的讀法

All three failure modes share a structural cause: someone treated CRA compliance as a one-off project rather than a standing function. The most consequential of the three, by far, is the SBOM staying current with every release. Every firmware update, every component swap, every dependency upgrade has to flow into an updated SBOM that gets attached to the version actually on the market. The Article 13 obligations don’t freeze at placing on the market; they run in parallel with the product’s lifecycle. Article 52 is the article that makes that real. When the phone rings, the question the authority is asking is not “did you do compliance once?” It is “is your compliance current as of today?” The answer to that question is whatever the SBOM and the vulnerability handling records say it is. Both have to be live documents, updated as the product is updated, or the answer is no.

三種失敗模式有同一個結構原因：有人把 CRA 合規當一次性專案處理，而不是常態功能。其中最關鍵的是 SBOM 每次出版都保持最新。每一次韌體更新、每一次元件抽換、每一次依賴升級都必須流進一份更新過的 SBOM，並綁定到實際在市場上的版本。Art 13 的義務不在 placing on the market 那一刻凍結；它們跟產品生命週期並行運行。Art 52 是讓這件事變真的那一條。電話響的時候，機關問的不是「你做過合規嗎？」是「你的合規截至今天還是最新的嗎？」這個問題的答案，就是 SBOM 跟 vulnerability handling 紀錄寫的那個答案。兩者都必須是隨產品更新而更新的活文件，否則答案就是 no。

The actual penalty exposure under Article 52 is not the headline-grabbing part. It is upstream of penalties. Article 52 is the article that makes “the state of your compliance” a thing that can be inspected at any time, on a seven-day clock, by an authority that does not need to ask permission. Most APAC manufacturers have not yet reorganised their compliance function around that fact. The ones that do, treat the SBOM and the vulnerability handling records as continuously updated artefacts — not as deliverables that close out a project.

Art 52 的實際罰則暴露不是標題抓眼球的那一部分。它在罰則的上游。Art 52 是讓「你的合規狀態」變成一個可以在 7 天時鐘下、由不需要請示的機關隨時檢查的東西。多數 APAC 製造商還沒有圍繞這點重組他們的合規功能。已經重組的那些，把 SBOM 跟 vulnerability handling 紀錄當作持續更新的成品，不是結案某個專案的交付物。