CN CRA NotebookCRA 閱讀筆記
Last reviewed 25 Apr 2026最後校閱 2026-04-25 · 18 min read閱讀 18 分鐘 · Close reading細讀 · Standing校正

Article 3 is a budget sluice. Read it like one. 第 3 條決定錢從哪裡花。它不是辭典。

Fifty-one definitions. Most readers skim them like a glossary. They’re not. They’re the place where conformity assessment cost, support period budget, and supply-chain liability quietly get decided — often by a single word, sometimes by a definition that hasn’t been finalised yet. 51 個定義。多數人把它們當辭典翻過。它們不是。Conformity assessment 成本、support period 預算、供應鏈責任怎麼分——這些事在這裡安靜決定。有時候是一個字決定,有時候是一個還沒定稿的定義決定。

It’s a Friday afternoon in an office park somewhere in the APAC manufacturing belt, and an ODM engineering lead is reading the Cyber Resilience Act because his legal team has stopped accepting “I’ll get to it next sprint.” He moves through Article 1 and Article 2 quickly — subject matter, scope, the standard regulatory throat-clearing — and lands on Article 3 ready to skim. Definitions are the part you skim.

He stops at point (39). Substantial modification. Next month his team is pushing a firmware update to an industrial PC that’s been on European shelves for eighteen months. The update adds an AI inference module for anomaly detection. Until now this was a sprint-planning item. Reading the definition, he’s no longer sure it’s the same product after the update.

That’s the moment Article 3 stops being a glossary. It’s fifty-one small sluice gates, each one wired to a budget line, a timeline, an allocation of liability. And several of them are still being slowly turned by the European Commission.

§ 01Why fifty-one definitions are not a dictionary

Most regulations carry their definitions article like ballast. The job of a definitions article in a typical EU regulation is restatement — echoing terms from upstream legislation, smoothing ambiguities, foreclosing the most obvious litigation arguments. You read it once, you check that nothing surprising is in there, you move on.

Article 3 of the CRA does not work that way.

The clearest test is to see what each definition does in the rest of the text. Manufacturer in Art 3(13) doesn’t sit on its shelf — it activates the twenty-five-paragraph backbone of Article 13. Substantial modification in Art 3(39) doesn’t describe anything — it triggers the manufacturer-by-modification regime in Articles 21 and 22, which can transfer manufacturer status from one legal entity to another. Important product in Art 3(17) and critical product in Art 3(18) don’t classify, they route — they decide whether your product walks through Article 32 as a Module A self-assessment or arrives at the door of a Notified Body or, in the worst case for budget purposes, ends up needing EUCC certification. Support period in Art 3(40) doesn’t define a period — it sets the time horizon along which Article 13(8) obligations have to be funded.

This is what makes Article 3 a sluice rather than a glossary. A wrong reading inside Article 3 doesn’t cause a problem inside Article 3. It causes a problem inside Article 13, Articles 21 and 22, Article 32, Annex III — usually halfway through implementation, when someone discovers that the conformity route they assumed doesn’t apply, or that the entity they assumed bore the obligations didn’t actually bear them.

The second thing that makes Article 3 unusual is harder to see on a first read: several of these definitions are still moving. The Commission Guidance on the application of the CRA, first circulated in draft in February 2026, is the first official authority on how concepts like substantial modification, software steward, free and open-source software placed on the market, and remote data processing solutions should actually be applied. Implementing acts, FAQ updates, and the Commission’s Q&A workstream will continue to refine the boundary of these definitions through 2026 and 2027. Reading Article 3 is not a one-time exercise. It’s a subscription.

For an APAC operator trying to plan a CRA programme, the implication is structural. Compliance is not something you assess once against the definitions article and then implement. Compliance is something you re-assess every time a definition shifts, because every shift propagates downstream. There has to be someone whose job is to track that propagation. In most APAC manufacturers, that role does not yet exist.

Read Article 3 the way you read a price list — line by line, with a calculator open.

§ 02Product with digital elements: the scope gate

The first definition in the article, Art 3(1), is the gate everything else passes through. A product with digital elements is “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately.” The phrasing is dense, and most of its cost-bearing weight sits in three small words: “or,” “separately,” and the recursive embedding of remote data processing solutions.

Consider an industrial fanless computer manufacturer in APAC. The product line has been in market for years, sold to factory operators across Europe through a mix of direct distribution and integration partners. The company’s self-image is that it sells hardware. The BIOS comes from a third-party vendor. The web-based management console is “just a tool we ship with the box.” The cloud telemetry service the customers optionally subscribe to is “a separate product.” When the team first reads about the CRA, the working assumption is that maybe one product line is partially affected.

The working assumption is wrong on three different axes, each one inside Art 3(1).

First, the “or”: a product with digital elements is software or hardware. It is not a hardware product with software inside — the inclusive disjunction means each thing, on its own, can be a PwDE. The BIOS is a software product placed on the market. The management console is a software product placed on the market. They don’t need to be sold separately; the regulation explicitly captures “hardware or software components being placed on the market separately” as their own products with digital elements. So the manufacturer is not facing one product in scope. It’s facing one box plus several embedded software products.

Second, the recursive embedding through Art 3(2). A remote data processing solution is the data processing service that is “intended and developed by the manufacturer, or under the responsibility of the manufacturer, the absence of which would prevent the product with digital elements from performing one of its functions.” If the cloud telemetry service is necessary for the product to function as advertised, that cloud-side software is in scope as part of the PwDE — even though it lives on someone else’s servers. The CRA reaches up the wire.

Third, the consequence of being in scope. Once Art 3(1) catches you, every Annex I essential requirement applies, every Article 13 obligation applies, every Article 32 conformity assessment routing decision applies. There is no “partial scope.” You are either inside the regulation or outside, and which side you stand on is decided by Art 3(1) before any of those other articles even get read.

The cost of getting this wrong is rarely a single missed obligation. It’s discovering, in late 2027, that an entire product line was misclassified out of scope and that none of the design-time work, supply-chain documentation, or post-market vulnerability handling was done. The remediation runway at that point is whatever is left of the calendar.

Anchor — downstream activation Article 2(1): “This Regulation applies to products with digital elements made available on the market.” Whether your product is “made available” turns entirely on Art 3(1). Annex III lists important product categories — many of which are software components most companies didn’t historically think of as “products.” If Art 3(1) doesn’t catch the thing, nothing else applies. If it catches the thing, everything applies.

§ 03Manufacturer: the responsibility gate (and Articles 21 & 22's expansion of it)

Art 3(13) defines a manufacturer as “any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge.” The clause that does the work, and the one most often misread, is markets them under its name or trademark.

The default APAC reading is intuitive and wrong: an ODM that designs and builds a connected device for a European brand-customer assumes it is the manufacturer, because it’s the one doing the manufacturing. This reading collapses on contact with Art 3(13). The European brand is the entity placing the product on the market under its own name and trademark. The European brand is the manufacturer for CRA purposes. The ODM is, in regulatory terms, invisible.

The ODM’s relief, when this lands, is short-lived — because invisibility is the worst commercial position to be in. Most Article 13 obligations are operationally impossible without the ODM’s cooperation. The SBOM has to come from whoever wrote the code. Vulnerability handling has to be done by whoever can patch the firmware. The support period commitment has to be honoured by whoever can keep the supply chain alive long enough to ship updates. The European brand carries the legal liability, but the work has to flow back to the ODM through contracts. So the ODM ends up doing most of the operational compliance work for which the European brand keeps its legal name on the line. It’s the asymmetric corner of the negotiating table: full operational burden, zero regulatory standing.

Then Articles 21 and 22 widen the membership of the manufacturer category. Article 21 catches an EU importer or distributor who places a product under their own name or trademark, or who carries out a substantial modification of a product already on the market — a distributor who reflashes firmware before resale, an importer who repackages and re-documents the product, both become manufacturers for that variant. Article 22 catches anyone else — integrators, system integrators, re-importers, consultancies bundling products with services — who carries out a substantial modification and makes the product available on the market. An ODM that takes a product they originally built for a European brand, modifies it, and sells the modified version under their own brand into Europe, becomes a manufacturer for that branded version under whichever article fits the ODM’s role at the moment of placing on market — carrying the full Article 13 stack either way.

This expansion is what makes Art 3(13) genuinely difficult to read in isolation. The membership of the “manufacturer” category is not static. It can be acquired by modification, by rebranding, by re-import. Every contract in the supply chain has to be checked against the possibility that one of the downstream parties is, by their own actions, becoming a manufacturer for the same product — and pulling the obligations away from where the original parties expected them to sit.

The two cost outcomes are mirror images of each other. An ODM that wrongly believes itself to be the manufacturer over-invests in conformity assessment infrastructure it doesn’t legally need. A European brand that wrongly believes its ODM is the manufacturer under-invests in Article 13 capability and discovers the gap when Article 14’s reporting obligations first trigger and there’s no incident response apparatus on the brand side. Both errors are caused by stopping at the obvious reading of Art 3(13) instead of pairing it with Articles 21 and 22.

Anchor — downstream activation Article 13(1): “Manufacturers shall, when placing a product with digital elements on the market, ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.” Twenty-three more paragraphs follow. Arts. 21 and 22 then expand the population of “manufacturer” to importers/distributors (Article 21) and other third parties (Article 22) performing substantial modification, rebranding, or re-import — transferring the entire Article 13 stack along with the title.

§ 04Substantial modification: the live-update gate

Back to the engineering lead and the firmware update. Art 3(39) defines substantial modification as “a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended use for which the product with digital elements has been assessed.”

The structural feature of this definition is that the two triggers are joined by or. Either the modification affects Annex I compliance, or it changes the intended use for which the product was originally assessed. Hitting either one is sufficient.

The AI inference module case is illustrative. Adding anomaly detection to an industrial PC almost certainly changes the intended use: the original assessment was for a monitoring gateway in an industrial environment; the post-update product is a device with autonomous analytical behaviour. Even if every Annex I requirement that applied to the original product still applies to the updated one (the “Annex I compliance” trigger doesn’t fire), the “intended use” trigger does. That alone is enough for the update to qualify as a substantial modification, with everything that flows from Articles 21 and 22.

The harder pattern to spot is the inverse: a small engineering change that lands inside the Annex I compliance trigger. A change to the cryptographic algorithm used for a secure boot routine. A change to the authentication library. A patch that alters the trust boundary between two components. None of these would be flagged by an engineering team as “substantial” in the colloquial sense — they’re routine engineering work. But “substantial” in Art 3(39) is not an engineering judgement. It’s a legal one. A small change that touches Annex I crosses the threshold; a large change that doesn’t touch Annex I or the intended use does not.

Then there is the moving-target dimension. The Commission Guidance circulated in February 2026 is the first official document that gives concrete examples of which kinds of software updates count as substantial modifications and which don’t. Before that document, the boundary was a matter of interpretation by individual operators, lawyers, and notified bodies. After that document, the boundary becomes more concrete, but it will continue to be refined as cases work through market surveillance and as the Commission issues further clarifications. Of all fifty-one definitions in Article 3, this is one of the most actively in motion.

The cost of misreading this definition is recursive. Underestimate substantial modification on a single firmware update, and the product loses presumption of conformity for the post-update version. The first Article 14 incident report on the post-update product triggers a market surveillance question about what conformity assessment was performed for the modification. With no answer, Article 64’s penalty bracket activates — and because Article 13 obligations are all retroactively in question for the modified product, the breach is not localised to the update. It propagates back into the entire post-update lifecycle of the product line.

Anchor — downstream activation Article 22: “A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of a product with digital elements and makes that product available on the market, shall be considered to be a manufacturer for the purposes of this Regulation.” Article 21 does the parallel job for importers and distributors specifically. A substantial modification doesn’t just trigger re-assessment — it can transfer manufacturer status itself. Recital 31 elaborates: the Regulation’s obligations follow the modification, not the original placement.

§ 05Important and critical: the conformity-route gate

Art 3(17) defines an important product with digital elements as one listed in Annex III. Art 3(18) defines a critical product with digital elements as one listed in Annex IV. These two definitions look like cross-references — pointers to other parts of the regulation — but in practice they are the article that decides how much you spend on conformity assessment. The factor between the cheapest and most expensive routes is not 20% or 50%. In the IoT consumer category it’s typically 5–10x. In industrial and network-infrastructure categories, including everything that would route through a Notified Body, it can run 10–20x or more, with timeline overhead measured in quarters rather than weeks.

Annex III lists nineteen Class I categories and four Class II categories. Annex IV lists three Critical product categories. Implementing Regulation 2025/2392, published on 1 December 2025, refines the Annex III categories further — including, for example, the inclusion of payment terminals in the Class I scope. The list itself is not the difficulty. The difficulty is reading the list correctly.

An APAC manufacturer building a smart-home gateway provides the cleanest illustration. The product, on its surface, does several things: local network management, user authentication, cloud connectivity. The team has to decide which Annex III rows the product hits.

The instinctive approach is to look for “smart-home gateway” in the Annex III text. That word is not there. Annex III lists functions — network management systems, boot managers, firewalls, smart-home virtual assistants, routers and modems and switches, VPN, password managers, antivirus, browsers, operating systems — not commercial categories. The same gateway, depending on what its firmware actually implements, can land in Class I (smart-home virtual assistant; router; operating system) and simultaneously in Class II (VPN; network management system; SIEM functionality, if it forwards security events). The product can be in two rows at once, and the conformity route is determined by the strictest row it hits.

The economic consequence is that small differences in firmware functionality, driven by what feels like ordinary product-management decisions, change the conformity assessment route by an order of magnitude. Adding a VPN endpoint to a smart-home gateway is a feature decision. From an Art 3(17)/(18) perspective, it is a budget decision — one that can pull the product from a Module A self-assessment route into a Module B+C, Module H, or in the Critical case, EUCC route. The Notified Body capacity in the European TIC market is finite, scheduling slots are scarce, and the cost differential reflects both the test effort and the queue.

The two-sided error pattern is identical to the manufacturer case. Misread downward (assume default when the product is actually Class I, or assume Class I when the product is actually Class II) and conformity assessment work has to be repeated, sometimes after engineering work has frozen. Misread upward (assume Class II when the product is in fact Class I and a harmonised standard could have supported Module A) and the budget is over-spent on Notified Body fees that the regulation didn’t require. The first error breaks timelines; the second error wastes capital. Both are caused by reading Art 3(17) as a category lookup rather than a functional analysis of what the product actually does.

Anchor — downstream activation Article 32: Conformity assessment routing. Default products → Module A self-assessment. Class I important (Annex III, Part I) → Module A if a harmonised standard has been applied; Module B+C, Module H, or EUCC otherwise. Class II important (Annex III, Part II) → Module B+C, Module H, or EUCC. Critical (Annex IV) → EUCC mandatory. Art 3(17)/(18) decides which row of this table the product sits on, and Annex III/IV define the rows.

§ 06Support period: the time-axis gate

Art 3(40) defines the support period as “the period during which the manufacturer is required to ensure that vulnerabilities of the product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part I of Annex I.” Article 13(8) is where the period actually gets determined: the manufacturer sets it, the period must reflect the time during which users can reasonably expect to use the product, and the period must be at least five years unless the expected use is shorter.

The five-year floor gets read by most APAC manufacturers as the answer. It isn’t. It’s the floor.

Consider an APAC industrial-equipment manufacturer whose product is a programmable logic controller deployed on factory floors. The internal product-planning view of support is five years — aligned with the warranty term, aligned with the depreciation schedule the company uses for its own development costs. From a Friday-afternoon planning perspective, five years is a clean number. The customer base, however, is European automotive Tier-1 plants whose own depreciation schedules and process-validation timelines run ten to twelve years. Production lines that took eighteen months to validate are not going to be re-validated against new equipment because the original vendor decided five years was enough.

The Art 3(40) plus Art 13(8) reading is that the support period must reflect the reasonable expectations of users. If the user base reasonably expects ten years of operational life — and in industrial B2B contexts that expectation is usually documented in customer specifications, RFQ templates, and procurement contracts — then five years is not a defensible support period commitment. The floor remains five, but the actual obligation is “at least the reasonable expected use,” which can be eight, ten, or more.

The cost structure this creates is the part most companies have not modelled. Support period is not a marketing claim. It is a legal obligation under Article 13(8) to handle vulnerabilities, ship free security updates, and maintain SBOM verifiability for the entire declared period. Stretching the period from five to ten years stretches the SBOM maintenance budget, the coordinated vulnerability disclosure infrastructure budget, and the Article 14 reporting capability, all by the same factor. For an industrial product line with thin margins and long lifecycles, this is the line item that disrupts the P&L most.

The strategic reading — once the cost is on the table — is that support period is not a number to minimise. It’s a number to align with the commercial structure. For B2B industrial vendors, the right move is usually to negotiate explicit seven- or ten-year support terms with customers, price the support cost into the unit price or into a maintenance contract, and use the “stop selling, stop supporting” provisions at the back end of Article 13(8) only as a planned end-of-life event rather than a fire exit. The article allows manufacturers to end support after the declared period — with mandatory user notification — but using that exit cleanly requires the support period to have been declared in alignment with reality from the start.

The two-sided error pattern, again. Declare too short, and customers in active use are left without vendor support during a period they reasonably expected to be covered — with the consequences flowing through Article 13(8) compliance and through commercial relationships. Declare too long without commercial alignment, and the support period turns into a permanent loss-making line on the operating budget. Both errors come from reading Art 3(40) as a calendar item rather than a budget item.

Anchor — downstream activation Article 13(8): “Manufacturers shall determine the support period [...] taking into account, in particular, the reasonable expectations of users [...] The support period shall be at least five years.” Recital 60 elaborates: longer support periods are expected for products with longer expected use, particularly in B2B and industrial contexts. Five years is a floor, not a default.

§ 07The reading isn’t finished. It’s subscribed.

Back to the engineering lead at the end of his Friday afternoon. If he reads Article 3 once and closes the file, he has missed half of the article — not because the article is hard, but because the version he’s reading is the version published on 23 October 2024, and several of the definitions he just read have a second authoritative layer that started arriving in February 2026 and will keep arriving through 2027. Substantial modification, software steward, free and open-source software placed on the market, remote data processing solutions: none of these definitions stops moving when the reading session ends.

The correct posture toward Article 3 is therefore not “finish reading it.” It is “subscribe to it.” Each Commission Guidance update, each implementing regulation, each FAQ revision, each market-surveillance Q&A from a national authority potentially shifts one of these definitions. When a definition shifts, every downstream article that activates on it shifts with it. The shift is rarely announced as a definitional change — it’s usually announced as guidance on a specific question, and the definitional implication has to be reverse-engineered.

For an APAC manufacturer, the operational implication is that CRA compliance is not a project with a delivery date. It’s a standing function. Someone has to track Article 3 movements, translate each movement into a P&L impact, and propagate the change to the engineering, procurement, and customer-facing teams. In most APAC manufacturers, this role does not have a name, a budget line, or a person assigned to it. The structural blind spot in CRA implementation across the region is not a technical capability gap. It’s an organisational one.

Fifty-one sluice gates. Several of them being slowly turned by hands in Brussels. Who is turning, in which direction, and on what timeline — that is the thing worth watching, monthly, between now and the end of 2027.

一個週五下午、APAC 製造業某個工業園區裡的辦公室,一位 ODM 工程主管在讀《Cyber Resilience Act》(CRA),因為法務部門不再接受「我下個 sprint 處理」這種說法。他很快讀過第 1 條跟第 2 條(立法目的、適用範圍——標準的法規開場),然後翻到第 3 條、準備跳過。定義條文嘛、本來就是要跳過的。

他在 (39) 停了下來。Substantial modification(實質修改)。下個月他的團隊要對一台已經在歐洲市場上架 18 個月的工業 PC 推一次韌體更新、加一個 AI 推論模組做異常偵測。讀條文之前、這在他腦中是排程任務;讀完條文之後、他不確定更新後這還算不算同一個產品。

那一刻,第 3 條不再是辭典。它是 51 個小水閘、每一個都連到一筆預算、一條時程、一份責任分配。而其中幾個水閘、現在還在被歐盟執委會的人慢慢轉動。

§ 01為什麼 51 個定義不是辭典

大部分法規的定義條像附錄。一份典型 EU 法規的定義條、工作是重述:呼應上位立法、弭平歧義、把最明顯的訴訟論點先封起來。讀一遍、確認沒有意外,就過去了。

CRA 的第 3 條不是這樣運作。

最清楚的測試是看每一個定義在條文其他地方做了什麼。Article 3(13) 的 manufacturer(製造商)不是擺著不動的——它啟動第 13 條那 25 個段落的義務骨幹。Article 3(39) 的 substantial modification(實質修改)不在描述什麼——它觸發第 21 條與第 22 條的 manufacturer-by-modification 機制,可以把製造商身分從一個法人移轉到另一個。Article 3(17) 的 important product(重要產品)跟 Article 3(18) 的 critical product(關鍵產品)不是分類——它們是路由開關、決定你的產品在第 32 條走 Module A 自我宣告、走到 Notified Body 門口、還是走到 EUCC 驗證(預算上最壞的情況)。Article 3(40) 的 support period(支援期間)不是定義一段時間——它設定了第 13 條第 8 項義務必須撐多久的時間軸。

這就是為什麼第 3 條是水閘、不是辭典。在第 3 條讀錯一個字、問題不會發生在第 3 條。問題發生在第 13 條、第 21 與 22 條、第 32 條、附件三——通常是實作做到一半才發現、原本以為的 conformity 路徑不適用、或原本以為扛義務的法人實際上沒在扛。

第二件讓第 3 條不一樣的事、第一遍讀比較看不出來:有幾個定義還在動。歐盟執委會於 2026 年 2 月首次以草案形式發布的 CRA 適用指引(Commission Guidance),是第一份就 substantial modificationsoftware steward(軟體保管者)、free and open-source software placed on the market(投入市場的自由與開源軟體)、remote data processing solutions(遠端資料處理解決方案)這些概念給出解讀的官方文件。Implementing acts、FAQ 更新、執委會的 Q&;A 工作流,會在 2026 到 2027 年之間繼續細化這些定義的邊界。讀第 3 條不是一次性的事、是訂閱。

對一家想規劃 CRA 專案的 APAC 製造商來說,這個含義是結構性的。合規不是「對著定義條評估一次然後實作」這種事。合規是每次定義移動就要重新評估的事,因為每次移動都會往下游傳遞。必須有一個人的工作是追蹤這個傳遞。在大部分 APAC 製造商裡、這個角色目前還不存在。

讀第 3 條的方式,要像讀價目表——一行一行讀、旁邊放台計算機。

§ 02Product with digital elements:範圍水閘

第 3 條的第一個定義 Article 3(1),是其他所有東西必須通過的那個閘門。Product with digital elements(具數位元素產品、PwDE)是「軟體或硬體產品、及其遠端資料處理解決方案、包括單獨投入市場的軟體或硬體元件」。措辭很濃縮、而它承載成本的重量集中在三個小地方:「或」、「單獨」、還有對 remote data processing solutions 的遞迴嵌套。

想像一家 APAC 工業無風扇電腦廠商。產品線在歐洲市場上架多年、透過直銷跟系統整合商賣給工廠營運商。公司對自己的認知是「賣硬體」。BIOS 是第三方廠商提供的。Web 管理介面「只是隨機附帶的工具」。客戶可選訂閱的雲端遙測服務「是另一個獨立產品」。團隊第一次接觸 CRA 時、工作假設是:可能某一條產品線部分受影響。

這個工作假設在三個面向上都是錯的、每一個面向都在 Article 3(1) 裡面。

第一、「或」這個字:a product with digital elements 是軟體硬體。它不是「裡面塞了軟體的硬體產品」——包含性的「或」代表每一個東西、獨立來看、都可以是 PwDE。BIOS 是投入市場的軟體產品。管理介面是投入市場的軟體產品。它們不需要單獨販售;條文明確抓住「單獨投入市場的硬體或軟體元件」當作獨立的 products with digital elements。所以這家廠商面對的不是「一條產品線在範圍內」、是「一個盒子加上幾個內嵌的軟體產品」。

第二、透過 Article 3(2) 的遞迴嵌套。Remote data processing solution 是「由製造商或在製造商責任下、所預期並開發的資料處理服務、若無此服務、產品將無法執行其功能之一」。如果雲端遙測服務是產品依其廣告功能正常運作所必需,那雲端那一側的軟體就在 PwDE 範圍內——即使它跑在別人的伺服器上。CRA 沿著資料流追到雲端那一側。

第三、落入範圍的後果。一旦 Article 3(1) 抓到你、附件一所有 essential requirements 都套用、第 13 條所有義務都套用、第 32 條所有 conformity assessment 路徑判斷都套用。沒有「部分範圍」這種東西。你要嘛在規定裡面,要嘛在外面、而站在哪一側由 Article 3(1) 在其他條文還沒讀到之前就決定了。

讀錯這個定義的代價、很少是一個單獨的義務沒做。是 2027 年底才發現一整條產品線被誤判在範圍外、所有設計階段的工作、供應鏈文件、上市後弱點處理都沒做。那時候的補救空間,就只剩日曆上還沒翻過去的那幾頁。

錨點:觸發對應條文 Article 2(1):「本法規適用於投入市場的 products with digital elements。」你的產品是不是「投入市場」、完全取決於 Article 3(1) 怎麼讀。附件三列出 important product 類別——其中很多是軟體元件、過去大部分公司不會把它當成「產品」。Article 3(1) 抓不到、其他都不適用。Article 3(1) 抓到了、其他全部適用。

§ 03Manufacturer:責任水閘(以及第 21 與 22 條對它的擴張)

Article 3(13) 把 manufacturer 定義為「任何自然人或法人、自行開發或製造 products with digital elements、或委託他人設計、開發或製造、並以其名稱或商標投入市場者、無論為支付對價、營利或無償」。真正在出力的字句,也是最常被讀錯的字句、是以其名稱或商標投入市場

APAC 的預設讀法很直觀,但是錯的:一家為歐洲品牌客戶設計與生產連網裝置的 ODM,假設自己是製造商,因為它就是那個在做製造的。這個讀法在碰到 Article 3(13) 的瞬間就站不住了。歐洲品牌商才是以其名稱或商標把產品投入市場的法人。歐洲品牌商在 CRA 意義下是製造商。ODM 在法規上是隱形的。

ODM 才剛覺得自己沒事、沒撐多久就會發現「隱形」是最差的商務位置。大部分第 13 條義務在沒有 ODM 配合的情況下實際上做不到。SBOM 必須由寫程式的人提供。弱點處理必須由能修補韌體的人做。Support period 承諾必須由能讓供應鏈持續到能出更新的那個人履行。歐洲品牌扛法律責任,但工作必須透過合約往回流給 ODM。所以 ODM 最後做了大部分操作層的合規工作、而歐洲品牌的法律名字繼續掛在線上。這是談判桌上最不對稱的那個角落:操作面全包、法規上沒身分。

然後第 21 條與第 22 條把製造商這個類別的成員資格擴張了。第 21 條抓住歐盟進口商或經銷商,他們以自有名稱或商標投放產品、或對已在市場上的產品作實質修改——一個在轉售前重刷韌體的經銷商、一個重新包裝並重做文件的進口商、都會就該變體變成製造商。第 22 條抓住其他人——系統整合商、SI、水貨進口商、把產品搭配服務銷售的顧問——他們對產品作實質修改並提供市場時。一家把原本為歐洲品牌做的產品、自己改一改、用自家品牌賣回歐洲的 ODM,會依「投放市場那一刻 ODM 的身分」適用其中一條——兩條路徑都會讓 ODM 對那個自家品牌版本變成製造商、扛完整第 13 條義務。

這個擴張就是 Article 3(13) 不能單獨讀的原因。「製造商」這個類別的成員資格不是靜態的。可以透過修改、改貼牌、再進口而取得。供應鏈裡每一份合約都必須對照「下游某一方可能因為自己的行為,正在變成同一產品的製造商」這個可能性、並把義務從原本各方預期它停留的地方拉走。

兩種成本結果互為鏡像。一家 ODM 誤以為自己是製造商、過度投資了它法律上不需要的 conformity assessment 基礎建設。一個歐洲品牌誤以為它的 ODM 是製造商、第 13 條能力投資不足、等到第 14 條通報義務第一次觸發、品牌端沒有事件回應機制時才發現缺口。兩個錯誤都來自於停在 Article 3(13) 的表面讀法、沒有把它跟第 21 與 22 條配著讀。

錨點:觸發對應條文 Article 13(1):「製造商於將 product with digital elements 投入市場時、應確保產品已依附件一第一部分的 essential cybersecurity requirements 進行設計、開發及生產。」後面還有 23 個段落。Arts. 21 與 22 接著把「製造商」的人口擴張到進口商/經銷商(Article 21)以及其他第三方(Article 22)裡面進行實質修改、改貼牌或再進口的人——把整個第 13 條義務堆疊跟著名銜一起移轉。

§ 04Substantial modification:上市後更新水閘

回到那位工程主管跟那次韌體更新。Article 3(39) 把 substantial modification 定義為「對 product with digital elements 投入市場後所為的變更、且該變更影響產品對附件一第一部分 essential cybersecurity requirements 的合規性、導致該產品原評估的預期用途發生變更」。

這個定義的結構特徵是兩個觸發條件用「或」連接。要嘛變更影響附件一合規性,要嘛變更改變產品原本被評估時的預期用途。任何一個命中都算。

AI 推論模組的案例可以說明。為一台工業 PC 加上異常偵測能力、幾乎一定改變預期用途:原本評估的是工業環境中的監控閘道;更新後是一台具備自主分析行為的設備。即使原產品適用的所有附件一要求對更新後產品都還適用(「附件一合規」這個觸發沒命中)、「預期用途」這個觸發已經命中。光這一條就足以讓這次更新視為實質修改、第 21 條與第 22 條後續所有東西跟著啟動。

更難看出的是相反的模式:一個小的工程變更、落在「附件一合規」這個觸發裡。改了 secure boot 用的密碼演算法。換了驗證函式庫。一次修補改變了兩個元件之間的信任邊界。這些東西在工程團隊眼裡都不是口語意義上的「實質」——它們是日常的工程工作。但 Article 3(39) 的「實質」不是工程判斷、是法律判斷。一個碰到附件一的小改動越過門檻;一個沒碰到附件一或預期用途的大改動沒越過門檻。

然後是「會動的目標」這個面向。2026 年 2 月發布的 Commission Guidance 是第一份具體列出哪些軟體更新算實質修改、哪些不算的官方文件。在那份文件之前,邊界靠各家業者、律師、Notified Body 的解讀。在那份文件之後,邊界比較具體了,但會隨著市場監督的個案累積、執委會發布更多澄清而繼續被細化。在第 3 條 51 個定義裡,這是最動態的之一。

讀錯這個定義的代價是遞迴的。低估某次韌體更新的實質修改性質、更新後版本的產品就失去合規推定。針對更新後產品的第一份第 14 條事件通報,會觸發市場監督機關問「對這次修改進行了什麼 conformity assessment?」沒答案的話、第 64 條罰則層級啟動——而因為更新後產品的第 13 條義務全部回溯地受到質疑、違規不會局限在那次更新。它會往回傳遞到那條產品線整個更新後的生命週期。

錨點:觸發對應條文 Article 22:「製造商、進口商或經銷商以外之自然人或法人、對 product with digital elements 進行實質修改並將該產品提供市場者、依本法規視為製造商。」Article 21 對進口商與經銷商有平行的規定。實質修改不只觸發重新評估——它本身可以移轉製造商身分。Recital 31 說明:本法規的義務隨著修改走、而非隨著最初的投入市場。

§ 05Important 與 critical:合規路徑水閘

Article 3(17) 把 important product with digital elements 定義為「列於附件三」者。Article 3(18) 把 critical product with digital elements 定義為「列於附件四」者。這兩個定義看起來像交叉引用——指向法規其他部分的指標——但實務上,它們是決定你在 conformity assessment 上花多少錢的那一條。最便宜路徑跟最貴路徑之間的倍數、不是 20% 或 50%。在 IoT 消費品類別、通常是 5 到 10 倍。在工業跟網路基礎設施類別、包括所有會走到 Notified Body 的東西,可能是 10 到 20 倍以上、時程成本以季計而不是以週計。

附件三列出 19 個 Class I 類別跟 4 個 Class II 類別。附件四列出 3 個 Critical 類別。Implementing Regulation 2025/2392 於 2025 年 12 月 1 日發布、進一步細化附件三的類別、例如把 payment terminals 納入 Class I 範圍。清單本身不是難點。難點是怎麼把清單讀對。

一家做智慧家庭閘道器的 APAC 廠商是最乾淨的範例。產品表面上做幾件事:本地網路管理、使用者驗證、雲端連線。團隊必須決定這個產品對應到附件三的哪幾類。

直覺的做法是去附件三的條文裡找「智慧家庭閘道器」。那個詞不在那裡。附件三列的是功能——network management systems、boot managers、firewalls、smart-home virtual assistants、routers / modems / switches、VPN、password managers、antivirus、browsers、operating systems——不是商品類別。同一台閘道器、根據它韌體實際做了什麼,可能落在 Class I(smart-home virtual assistant、router、operating system)、同時落在 Class II(VPN、network management system;如果它轉發安全事件,SIEM 功能)。產品可能同時在兩列裡,conformity 路徑由它命中的最嚴格那一列決定。

經濟後果是:韌體功能上的小差異、由感覺起來只是日常產品管理的決定驅動,會把 conformity assessment 路徑改變一個數量級。在智慧家庭閘道器上加一個 VPN endpoint,是一個功能決定。從 Article 3(17)/(18) 的角度看,是一個預算決定——這個決定可以把產品從 Module A 自我宣告路徑、拉進 Module B+C、Module H、最壞的情況拉進 EUCC 路徑。歐洲 TIC 市場的 Notified Body 量能是有限的、排期席次稀缺、成本差異反映的是測試工作量加上排隊成本。

雙向的錯誤模式跟 manufacturer 那一節相同。往下讀錯(以為是預設結果是 Class I、或以為是 Class I 結果是 Class II)、conformity assessment 工作要重做、有時候是工程已經凍結之後才重做。往上讀錯(以為是 Class II 但其實是 Class I 而且有 harmonised standard 可以撐 Module A)、預算被 Notified Body 費用過度消耗,但法規本來不要求。第一種錯誤打破時程;第二種錯誤浪費資本。兩個錯誤都來自於把 Article 3(17) 當成查表、而不是對產品實際在做什麼進行功能分析。

錨點:觸發對應條文 Article 32:Conformity assessment 路徑。預設產品 → Module A 自我宣告。Class I important(附件三第一部分) → 若已適用 harmonised standard、走 Module A;否則 Module B+C、Module H 或 EUCC。Class II important(附件三第二部分) → Module B+C、Module H 或 EUCC。Critical(附件四) → 強制 EUCC。Article 3(17)/(18) 決定產品坐在這張表的哪一列、附件三 / 四定義那些列本身。

§ 06Support period:時間軸水閘

Article 3(40) 把 support period 定義為「製造商有義務確保 product with digital elements 的弱點依附件一第一部分 essential cybersecurity requirements 有效處理之期間」。第 13 條第 8 項是這個期間實際被決定的地方:由製造商設定、期間必須反映使用者可合理預期使用該產品之時間、且至少 5 年、除非預期使用期間明顯較短。

那個 5 年下限被大部分 APAC 製造商讀成答案。它不是。它是地板。

想像一家 APAC 工業設備廠商、產品是工廠樓面上的可程式邏輯控制器(PLC)。內部產品規劃對 support 的看法是 5 年——對齊保固期、對齊公司自己用來攤提研發成本的折舊表。從週五下午做計劃的角度看、5 年是個乾淨的數字。但客戶群是歐洲汽車 Tier-1 廠的工廠,他們自己的折舊表跟製程驗證時程跑 10 到 12 年。花了 18 個月驗證的產線、不會因為原供應商認為 5 年夠了就針對新設備重新驗證一遍。

Article 3(40) 配 Article 13(8) 的讀法是:support period 必須反映使用者的合理預期。如果使用者群合理預期 10 年的營運壽命、而在工業 B2B 情境裡、這個預期通常已經寫在客戶規格、報價範本、採購合約裡——那 5 年不是站得住腳的 support period 承諾。地板還是 5 年,但實際義務是「至少合理預期使用的長度」,可以是 8 年、10 年或更久。

這個成本結構是大部分公司沒建模的部分。Support period 不是行銷宣稱。它是第 13 條第 8 項下的法律義務——整段宣告期間內必須處理弱點、發放免費安全更新、維持 SBOM 可驗證性。把期間從 5 年拉到 10 年、把 SBOM 維護預算、coordinated vulnerability disclosure 基礎建設預算、第 14 條通報能力同樣拉長一倍。對一條毛利薄、生命週期長的工業產品線來說、這是最會打亂 P&;L 的那一行。

策略性讀法(一旦成本上桌)是:support period 不是要極小化的數字、是要跟商務結構對齊的數字。對 B2B 工業廠商來說,正確的做法通常是跟客戶談明確的 7 年或 10 年支援條件、把支援成本反映在單價或維護合約裡,把第 13 條第 8 項後段「停售就停支援」的條款留作有計劃的產品終止事件、不是當逃生門用。這一條允許製造商在宣告期間結束後停止支援(必須通知使用者),但要乾淨地用這個出口、前提是 support period 從一開始就跟現實對齊地宣告了。

同樣的雙向錯誤模式。宣告太短、使用中的客戶在他們合理預期被涵蓋的期間裡失去廠商支援——後果走 Article 13(8) 合規面,也走商務關係面。宣告太長但沒有商務面對齊、support period 變成營運預算上永久虧損的一筆。兩個錯誤都來自於把 Article 3(40) 當日曆項目讀、不是當預算項目讀。

錨點:觸發對應條文 Article 13(8):「製造商應決定 support period [...] 特別考量使用者的合理預期 [...] Support period 應至少 5 年。」Recital 60 說明:對預期使用期較長的產品、特別是 B2B 跟工業情境、預期 support period 較長。5 年是地板、不是預設。

§ 07讀不完的,是訂閱的

回到那位工程主管的週五下午尾聲。如果他讀完第 3 條一次就把檔案關掉、他錯過了文章的一半——不是因為條文難、而是因為他讀的版本是 2024 年 10 月 23 日公布的版本、而他剛剛讀過的幾個定義有第二層解讀、那一層從 2026 年 2 月才開始抵達,會繼續抵達到 2027 年。Substantial modification、software steward、free and open-source software placed on the market、remote data processing solutions:這幾個定義不會在閱讀結束時停下來。

所以對第 3 條的正確心態因此不是「把它讀完」。是「訂閱它」。每一份 Commission Guidance 更新、每一份 implementing regulation、每一次 FAQ 改版、每一個來自會員國主管機關的市場監督 Q&;A、都可能讓其中一個定義動一下。一個定義動一下、所有以它為觸發條件的下游條文跟著動。這種變動很少會被宣告為「定義變了」——通常是針對某個具體問題的指引,定義層的含義要倒推出來。

對 APAC 製造商來說,操作上的含義是:CRA 合規不是有交付日期的專案。是一個常態功能。必須有人追蹤第 3 條的移動、把每一次移動翻譯成 P&;L 影響、把改變傳遞給工程、採購、客戶面團隊。在大部分 APAC 製造商裡、這個角色沒有名字、沒有編列預算、沒有指派人選。這個地區 CRA 落地最大的結構盲點、不是技術能力缺口、是組織盲點。

51 個水閘。其中幾個正在被布魯塞爾的人慢慢轉動。誰在轉、轉去哪裡、什麼時候轉——這是從現在到 2027 年底、值得每月看一次的事。