Compliance, from cost to capability 合規從成本變能力

Part 1 framed the map. Part 2 worked the priority order. Part 3 named the three capabilities worth building. This essay closes the series.

The thread that ties the four together: the CRA is not only a compliance burden — it’s also a window during which industry positions get redrawn. Manufacturers who build capability earlier in this window land in a different position on the EU market post-2027.

That isn’t optimistic framing; it’s what surfaces when the 22 principles from Part 2 and the three capabilities from Part 3 are placed back into the market context. This essay opens four layers of that context: the EU-market entry ticket, the ODM bargaining position, the industry restructuring window, and the cognitive shift from cost centre to operational capability.

§ 01Entry-ticket layer: how CRA compliance binds to EU market access

Start with the baseline.

CRA Article 64(2) sets administrative fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher, for breaches of Annex I requirements or Articles 13 and 14 obligations. For APAC manufacturers, though, the fine isn’t the most consequential exposure — market access is.

The CRA is wired into the broader EU market-surveillance architecture. Articles 54 through 58 give market surveillance authorities the power to require corrective action from manufacturers, restrict or prohibit a product’s availability on the EU market, order recalls or withdrawals, and notify peer Member States. In other words, non-compliance under the CRA isn’t a Member State-specific fine — the consequence runs across the entire EU single market.

For many APAC manufacturers, the EU is a meaningful market — especially in networking equipment, IP cameras, IoT edge devices, and embedded systems, which are the largest ODM categories. The impact of losing EU market access doesn’t sit at the “added cost” level; it sits closer to “specific product lines facing market continuation questions.”

This reframing matters for CRA prioritisation: the CRA is not a Compliance department to-do — it’s a company-level market strategy question.

The timeline reality: how much time sits between now and December 2027

Stacking the key dates together:

• 11 June 2026: Chapter IV (Articles 35-51, the Notified Body designation framework) applies, per Article 71(2)
• 11 September 2026: Article 14 reporting obligations apply, the ENISA Single Reporting Platform (SRP) goes live
• 11 December 2026: Member States shall strive to ensure (per Article 35(2)) sufficient NB capacity is in place
• 11 December 2027: full CRA application

Counting from May 2026, that’s about 19 months to full application. Bringing the four Tier 1 principles to a “defensible to an external auditor” level takes 9 to 12 months; designing contract interfaces with brand customers adds another 3 to 6 months; threat modelling, release gates, and support-period planning need to thread through the same window as Tier 2 work.

The window isn’t as short as it might feel, but it isn’t as long as it might feel either. The premise: starting now rather than waiting until first half of 2027 to sprint.

§ 02Bargaining-position layer: the ODM’s place in the compliance chain gets redefined

This is the layer most worth thinking through carefully for APAC ODMs.

The CRA’s regulated party is the manufacturer — the entity that markets the product under its own name or trademark. In an ODM model, that manufacturer is the brand customer, not the ODM itself. On the surface, the ODM’s statutory obligations look smaller, the responsibility lighter, the risk lower.

That surface read, though, misses the operating reality. To complete CRA compliance, the brand customer needs most of what sits on the ODM’s side:

• SBOM: needs to come from the ODM, because firmware and hardware integration sit there
• Vulnerability information: chipset SDKs, third-party libraries, accumulated dependency issues — the ODM has clearer visibility than the brand customer
• Secure-update release capability: OTA mechanisms, signing infrastructure, rollback flow — usually on the ODM side
• Support-period commitment: chipset EOL, library EOL, the ODM’s own maintenance capacity directly determine how many years the brand customer can credibly commit to its EU customers

Translated: for the brand customer to sign CRA-anchored commitments to its EU customers, the brand customer first needs the ODM to deliver the ingredients those commitments depend on. The ODM’s CRA readiness directly shapes the brand customer’s path to market.

This shift inverts the ODM’s traditional position. ODMs have historically been the passive party on compliance — the brand customer asked for tests and certifications, the ODM accommodated. Under the CRA, the ODM becomes an active supplier of compliance ingredients — whether you can deliver an SBOM, whether you can carry a multi-year support commitment, whether you can respond to vulnerability information within 24 hours, all of which directly shape whether you can land the order.

ODMs that move earlier shift from “interchangeable contract manufacturer” to “key node on the compliance chain.” Among ODMs that move later, compliance capability becomes one more dimension on which they get evaluated — if an ODM can’t deliver an SBOM, the brand customer’s whole product line can stall on EU market entry.

MRSM: still a concept, but with particular strategic relevance for the ODM model

ENISA Playbook Chapter 5 introduces the Machine-Readable Security Manifest (MRSM) concept. It’s currently an illustrative example, not a standard, and not a regulatory requirement. But for ODM-to-brand-customer compliance evidence exchange, the concept is worth watching early.

The reasoning is direct: under the CRA, what an ODM hands to the brand customer isn’t a PDF report — it’s a package of machine-readable, verifiable, downstream-passable evidence: SBOMs, dependency-scan results, signing records, build provenance, support-period status, known-vulnerability disposition. If those move as PDFs, the brand customer has to spend headcount digesting, translating, and integrating them into its own compliance documentation, which scales poorly. As machine-readable artifacts, they can be ingested directly into the customer’s toolchain.

MRSM as drafted integrates existing ecosystems — primarily OSCAL, CycloneDX CDXA, OWASP ASVS, and OpenSSF Security Insights (with ENISA Playbook Section 5.3 also listing TC54 and OpenSSF Scorecard among others) — and proposes a layered architecture: a Control Layer (mapping to security objectives), an Implementation Layer (technical controls), and an Assessment and Verification Layer (verification results). This layering fits the ODM/brand-customer evidence exchange particularly well, because it can move across organisational boundaries without losing fidelity.

A useful posture: there’s no need to adopt MRSM today (it’s still at concept stage), but the underlying artifacts — SBOMs, vulnerability scan results, build provenance — are worth producing in machine-readable form starting now. When MRSM or a similar integration framework matures, the underlying data is already in place; the work becomes upper-layer format conversion.

§ 03Industry-restructuring layer: 2026 prepare, 2027 apply, 2028 the gap becomes visible

Stretch the timeline further out, and the CRA looks like a capability-stratification event for the industry.

Over the past decade, APAC manufacturers have competed on the EU market primarily through cost, flexibility, and lead time. Cybersecurity capability has been a plus, not a precondition. Post-CRA, cybersecurity capability moves from plus to entry condition. Once everyone is past the entry, the maturity of cybersecurity capability becomes the new competitive baseline.

This shift won’t materialise as a single event in December 2027. It surfaces gradually through 2028 and 2029.

A subset of Taiwanese manufacturers is already positioning along this direction — some ODMs joined FIRST (Forum of Incident Response and Security Teams) during 2024 and 2025, set up external PSIRT channels, started publishing security advisories, and built CVD policies. The short-term return on these moves is hard to see; the medium-term effect shows up on customers’ supplier evaluation lists; the long-term effect compounds into a visible capability gap.

A question worth sitting with: if a “supplier CRA compliance maturity” column appears on EU procurement evaluation tables in 2028, where does your company sit? If that column hasn’t appeared yet, when does it appear?

A practical estimate: the column likely starts showing up in the second half of 2027. The reasoning: full CRA application is December 2027, brand customers need to align all their suppliers before that date, and procurement evaluation tables typically run six months to a year ahead of the regulatory date itself. Which puts the question at mid-2027 — around the time you’d want to be ready to answer it.

§ 04Cognitive-shift layer: moving the CRA from cost centre to operational capability

The final layer is an organisational positioning question.

In many APAC manufacturers right now, CRA planning sits inside Compliance or Quality Assurance, framed as “another regulatory burden.” The budget posture follows from that framing — necessary cost, minimised where possible, deferred where possible.

That positioning is worth recalibrating.

The capabilities the CRA requires building — SBOM workflow, vulnerability handling SOP, PSIRT interface, support-period commitments, secure-update infrastructure — are each a product capability in their own right, not just a compliance artifact. Once these are operational:

• The SBOM workflow doubles as supply chain management capability
• The vulnerability handling SOP doubles as quality engineering capability
• The PSIRT interface doubles as customer relationship capability
• The support-period commitment doubles as long-term revenue planning
• The secure-update infrastructure doubles as fleet management capability

Treating these as product features to invest in, versus treating them as compliance cost to absorb, generates very different levels of internal support and resource allocation. The first frame can pull from R&D budget; the second only competes inside the Compliance budget. The first becomes a market sales pitch; the second remains a cost centre.

A practical move on this: shift CRA core capability building from the Compliance function to the operations layer — owned directly by the CTO/COO, with Compliance and QA as supporting functions rather than owners. That’s the organisational shape that lets cross-functional coordination across R&D, PM, QA, and Sales actually take place.

§ 05Closing the series

Across the four essays — from “map, not ticket” through which four of the twenty-two principles to run first, through three capabilities worth building, through compliance moving from cost to capability — the throughline tries to address one question: how can an APAC SME manufacturer, under the CRA, turn this compliance challenge into an upgrade in industry position?

The answer condenses into three lines:

1. See the starting point clearly: the existing national-law training doesn’t map to the CRA’s regulated-party structure; surfacing that gap explicitly is the precondition for sizing the investment correctly
2. Focus the priority: don’t run all 22 principles in parallel — start with the four Tier 1 starters, follow with Tier 2 contract interfaces, let Tier 3 wait for resources
3. Reposition organisationally: CRA capability is product capability, not compliance cost; ownership belongs at the operations layer, not the Compliance layer

The ENISA Playbook is a good engineering map, but it doesn’t make the strategic decisions for you. Picking the principles that matter most for your situation, designing the compliance interface with brand customers, and turning built capability into market differentiation — these are pieces of work each company has to do for itself.

What this series offers is a thinking frame, not an SOP. If only one line carries forward, this is the line: the CRA is not only a compliance threshold — it’s also a window for APAC manufacturers to think again about their place in the global supply chain. Manufacturers that move earlier find themselves in a different position when the post-2027 EU market shapes up.

The clock is now running.