CN CRA NotebookCRA 閱讀筆記
Working note — actively evolving, may be revised. See /errata for change log. 推進中的筆記,可能持續修改。修訂紀錄見 /errata
Last reviewed 27 Apr 2026最後校閱 2026-04-27 · 5 min read閱讀 5 分鐘 · Pair essay配對文章 · Working書寫

Article 21 — when an importer or distributor becomes the manufacturer. 第 21 條 —— 當進口商經銷商變成製造商。

Article 22's pair. Same logic, different addressee. If you are an EU importer or distributor and you place a product under your own brand or substantially modify it, Article 21 makes you the manufacturer for that version. One paragraph long. The full Article 13 stack as consequence. Art 22 的配對。同樣邏輯,對象不同。若你是歐盟進口商或經銷商、以自有品牌投放產品或對產品作實質變更,Art 21 將你變為該版本之製造商。條文只有一段。後果是整個 Art 13 義務堆疊。

The CRA gives the same legal effect — manufacturer status by behaviour — two separate articles, addressed to two separate audiences. Article 22 catches integrators, system integrators, re-importers, and other third parties. Article 21 catches importers and distributors. The split is structural rather than substantive: the legislator decided that the rules for someone already inside the EU economic operator system (importer, distributor) should sit in their own article, and the rules for everyone else should sit in another. Reading either article without the other gives an incomplete map of who can become a manufacturer by what they do.

The Article 21 text is one paragraph. An importer or distributor who places a product on the market under their own name or trademark, or who carries out a substantial modification of a product already on the market, becomes a manufacturer for the purposes of the Regulation, with the full Articles 13 and 14 obligations attached. The Regulation does not ask whether the importer or distributor wanted this status. It does not ask whether they signed any paperwork. It looks at what they did to the product and assigns the consequence.

§ 01The two triggers, in importer/distributor flavour

Trigger 1 — rebranding. An EU distributor takes a connected product placed on the market by an APAC manufacturer, and resells it under their own brand — their name on the housing, their logo on the packaging, their listing on the EU retailer site. The product itself may be physically identical to what shipped from the APAC factory. Article 21 says the rebranding alone is sufficient to make the distributor the manufacturer for the rebranded variant. No firmware change required. No hardware change required. The behavioural fact of marketing the product under a different name is what triggers the reclassification.

Trigger 2 — substantial modification. An EU importer purchases stock of a connected industrial product from an APAC OEM, reflashes the firmware to add region-specific connectivity features before resale (without changing the brand), and ships the modified product to EU customers. The firmware reflash, if it changes Annex I compliance or modifies intended use, is a substantial modification under Art 3(39). Article 21 makes the importer the manufacturer for that modified version — the original APAC manufacturer's conformity assessment does not transfer with the modified product.

The two triggers can occur together (rebrand + modify, common in private-label retail) or separately. Either is sufficient on its own. The same product can have multiple "manufacturers" under the CRA — the original APAC entity for the unmodified, originally-branded version still on the market, and the EU importer or distributor for each modified or rebranded variant. Each manufacturer carries the Article 13 stack for their version.

Anchor — the article in full Article 21: "An importer or distributor shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to Articles 13 and 14, where that importer or distributor places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market." One paragraph. The Article 13 obligation stack travels along with the trigger, including SBOM, support period, vulnerability handling, conformity assessment, technical documentation, declaration of conformity, and CE marking for the modified or rebranded product.

§ 02Why the split into two articles matters in practice

Reading Article 21 and Article 22 separately, an APAC supplier may not realise that both apply to its supply chain at different points. The APAC manufacturer ships unmodified product to an EU importer (still APAC manufacturer's product); the importer reflashes the firmware (now Article 21 makes the importer the manufacturer for the reflashed version); the importer's distributor in another Member State applies its own brand sticker on the casing for retail (now Article 21 makes the distributor the manufacturer for the rebranded version); a system integrator in a third Member State buys ten of the rebranded units, replaces the embedded OS with a hardened build, and resells the result to a critical-infrastructure customer (now Article 22 makes the integrator the manufacturer for that integrated product). Same physical product, four different manufacturers in CRA terms, depending on what each entity did.

For the original APAC manufacturer, the practical implication is that contracts with EU partners need to anticipate which articles apply to which counterparty. An importer contract reaches Art 21 if rebranding or modification is contemplated. An integrator contract reaches Art 22. The contract's job is not to override the article — the public-law transfer happens regardless — but to allocate the operational work of compliance to whoever can actually do it, and to require notification before the qualifying behaviour completes.

§ 03Article 21 and Article 22 together: one map

The cleanest mental model is: Article 13 defines the obligation stack; Article 3(13) defines the front-door manufacturer; Articles 21 and 22 define the two side doors that can put a different entity into the manufacturer position by behaviour. Article 21 is the side door for importers and distributors. Article 22 is the side door for everyone else — integrators, SIs, re-importers, and consultancies that bundle products with services. The doors are in the same wall and they lead into the same room. The CRA simply gives them different numbers because the addressees are categorically different.

This map is what makes the manufacturer category in the CRA structurally porous. The membership is not closed at Art 3(13). It is continuously open, by behaviour, through Articles 21 and 22, throughout the support period of every product on the EU market. Any entity that touches the product in a way that triggers either article acquires the membership for that variant, regardless of contract, regardless of self-description, regardless of intent. The companion essay on Article 22 covers the consequences in detail. Article 21 is the same consequence with a different addressee; this short essay exists to make sure neither pathway hides behind the other.

Same room, two doors. Article 21 is for the importer and the distributor. Article 22 is for everyone else.

CRA 把同一個法律效果——以行為觸發的 manufacturer 身分——寫成兩個獨立條文、給兩個不同對象。Article 22 涵蓋系統整合商、SI、水貨進口商、其他第三方。Article 21 涵蓋進口商與經銷商。這個拆分是結構上的、不是實質上的:立法者決定「對已在歐盟經濟經營者體系內的人(進口商、經銷商)」的規則放一條、「對其他人」的規則放另一條。只讀其中一條而沒讀另一條,會得到一張不完整的「誰可以因行為變成製造商」地圖。

Article 21 的條文只有一段。進口商或經銷商以自有名稱或商標投放產品、或對已在市場上的產品作實質變更、依本法規成為製造商、承擔 Article 13 與 Article 14 的全部義務。法規不問進口商或經銷商是否想要這個身分,也不問是否簽了任何文件。它看你對產品做了什麼,然後施加後果。

§ 01兩個觸發、進口商/經銷商版本

觸發 1:重貼標。歐盟經銷商從 APAC 製造商處取得已投放市場的連網產品、以自有品牌轉售——外殼掛自己的名稱、包裝印自己的商標、歐盟零售網站上以自己名義上架。產品本身可能在物理上跟 APAC 工廠出貨的版本完全相同。Article 21 說:光是重貼標就足以讓經銷商成為該重貼標變體的製造商。不必動韌體、不必動硬體。「以不同名稱行銷產品」這個行為事實,就是觸發重新分類的條件。

觸發 2:實質變更。歐盟進口商從 APAC OEM 採購連網工業產品庫存、在轉售前重刷韌體加入區域連線功能(沒換品牌),然後把改過的產品出貨給歐盟客戶。這次重刷韌體、若改變了附件一合規或修改了 intended use,就構成 Article 3(39) 下的實質變更。Article 21 把進口商視為該變更版本的製造商——原 APAC 製造商的 conformity assessment 不會跟著修改後的產品轉移。

兩個觸發可以同時發生(重貼標 + 修改、自有品牌零售常見),也可以分開發生。每一個都足以單獨觸發。同一個產品在 CRA 下可以有多個「製造商」——就還在市場上的未變更、原品牌版本來說、是原 APAC 製造商;就每一個修改或重貼標的變體來說,是歐盟進口商或經銷商。每一個製造商各自就其版本承擔 Article 13 義務堆疊。

錨點:條文全文 Article 21:「進口商或經銷商、於以自有名稱或商標將具數位元素產品投放市場時、或對已投放市場之具數位元素產品執行實質變更時、依本法規視為製造商、並適用第 13 條與第 14 條。」一段而已。Article 13 義務堆疊隨觸發行為一同移動、包括 SBOM、support period、弱點處理、符合性評鑑、技術文件、符合性宣告、變更或重貼標產品的 CE 標示。

§ 02為什麼兩條分開的設計實務上重要

分別讀 Article 21 跟 Article 22、APAC 供應商可能不會發現它們在供應鏈不同節點都適用。APAC 製造商出貨未變更產品給歐盟進口商(仍是 APAC 製造商的產品);進口商重刷韌體(Article 21 把進口商變成重刷版本的製造商);進口商在另一會員國的經銷商在外殼貼自己品牌貼紙做零售(Article 21 把該經銷商變成重貼標版本的製造商);第三會員國的系統整合商買了十台重貼標產品、把嵌入式 OS 換成強化版、再把結果轉售給關鍵基礎設施客戶(Article 22 把該整合商變成整合產品的製造商)。同一台實體產品、依各方做了什麼、CRA 下有四個不同的製造商。

對原 APAC 製造商來說,實務含意是:跟歐盟夥伴的合約必須事前預期哪個條文適用於哪個對手。進口商合約觸及 Article 21(若涉及重貼標或修改)。整合商合約觸及 Article 22。合約的工作不是凌駕條文——公法移轉照樣發生——而是把合規的實際工作分配給能做的人、並要求在觸發行為完成之前事先通知。

§ 03Article 21 與 Article 22 一起:一張地圖

最乾淨的心智模型是:Article 13 定義義務堆疊;Article 3(13) 定義「正門」製造商;Article 21 跟 Article 22 定義兩道「側門」——可以把不同法人因行為放進製造商的位置。Article 21 是進口商與經銷商的側門。Article 22 是其他人的側門——整合商、SI、水貨進口商、把產品搭配自家服務銷售的顧問。兩道門開在同一面牆上,通往同一個房間。CRA 給它們不同編號,只是因為對象的類別不同。

這張地圖讓 CRA 下「製造商」這個類別在結構上不封閉。會員身分不是在 Article 3(13) 那邊就結束。它在每一個歐盟市場上產品的整個 support period 內、透過 Article 21 跟 Article 22、持續以行為開放。任何法人若以觸發任一條的方式碰到產品,就為該變體取得會員身分——不論合約怎麼寫、不論自我描述、不論意圖。配對文章 Article 22 那篇詳細處理了後果。Article 21 的後果跟 Article 22 一樣,只是對象不同;這篇短文的存在、是為了讓兩條路徑都不會躲在另一條後面。

同一個房間、兩道門。Article 21 給進口商跟經銷商。Article 22 給其他人。