CN CRA NotebookCRA 閱讀筆記
Last reviewed 27 Apr 2026最後校閱 2026-04-27 · 9 min read閱讀 9 分鐘 · Mental model心智模型 · Standing校正

You can still ship. You just have to tell on yourself. 還能出貨,但你必須把自己抖出來

11 September 2026 is the most-quoted date in the CRA universe and one of the most misunderstood. It is not the day Article 13 starts. It is not the day vulnerability handling starts. It is the day Article 14 starts — the day reporting starts. Reporting and building are not the same thing, and confusing them is what separates a calm 2026 from a panicky one. 2026 年 9 月 11 日是 CRA 圈裡被引用最多、也被誤解最多的一個日期。它不是 Article 13 開始的那天。它不是弱點處理義務開始的那天。它是 Article 14 開始的那天——是通報開始的那天。通報跟建構不是同一件事,把這兩個搞混,就是「平靜的 2026」跟「焦慮的 2026」的差別。

A factory in Hsinchu builds a Class I PwDE under the CRA — a smart industrial gateway, say, with a network stack and an embedded Linux distribution — and ships it to a German integrator on 12 September 2026. The product is on the EU market. It is unequivocally inside the CRA. Its support period clock has started. Its vulnerability handling obligations are alive.

And yet, on the engineering team’s shared compliance dashboard, the row for “Cyber Resilience Act” shows the project as on track. No SBOM has been generated. No security advisory pipeline exists. No notified body has been engaged. The compliance manager has marked the row green because, in his reading of the regulation, the binding deadline is 11 December 2027 — fifteen months out. He is half right and half wrong, and the half he is wrong about is what 11 September 2026 is for.

That date does bind something. It just doesn’t bind what most people think.

§ 01The thing that activates on 11 September 2026 is Article 14, not Article 13

Article 71(2) of the CRA is unambiguous: “Article 14 shall apply from 11 September 2026.” Article 13 — the article that contains every substantive obligation a manufacturer has to actually build a secure product — does not appear in 71(2). Article 13 applies from 11 December 2027, the same day as the rest of the substantive regulation. Fifteen months separate the two dates, and that fifteen-month gap is doing real work.

Article 14 is the reporting article. It says: when an actively exploited vulnerability comes to your attention, or when a severe incident affecting your product’s security comes to your attention, you must notify the relevant CSIRT and ENISA through the Single Reporting Platform within 24 hours, deliver a detailed notification within 72 hours, and a final report within 14 days (for vulnerabilities) or one month (for severe incidents). It is, structurally, a duty to tell on yourself when something bad surfaces.

Article 13 is the construction article. It says: design securely, do a risk assessment, handle vulnerabilities for the support period, prove it on paper, get a notified body to bless the result if the product is Important or Critical. It is, structurally, a duty to build the product right in the first place.

Reporting an actively exploited vulnerability you discovered is not the same as having built the product securely. Telling on yourself is not the same as compliance. The September 2026 date binds the first; the December 2027 date binds the second.

§ 02What you actually have to do by 11 September 2026

The list is shorter than most consultancies suggest, and the items on it are operational rather than architectural. They can be assembled in three to four months by a focused team that already has a security function. Without a security function, six to nine.

What Why Source
A standing process to detect actively exploited vulnerabilities in your products — CVE feeds for your component stack, monitoring of your bug bounty inbox, a coordinated vulnerability disclosure (CVD) intake channel. You can’t report what you don’t see. Article 14 obliges reporting upon becoming aware, and a regulator’s view of “reasonable awareness” is not generous to teams that didn’t have intake. Art 14(1), Art 14(2)
A 24/72/14-day reporting capability — named owner, escalation path, drafting templates, a tested run-through. The clocks start when a reasonable engineer first thinks “this looks like an actively exploited vulnerability in our product.” Designating the owner after the clock has started is a way to miss the 24-hour mark. Art 14(2)(a)–(c), Art 14(4)(a)–(c)
A coordinator-CSIRT decision — for non-EU manufacturers, the four-step waterfall under Art 14(7) (auth. rep, then importer, then distributor, then users), with each step using a highest-volume tie-breaker. You don’t pick the CSIRT. Art 14(7) picks one for you, and the answer can change as your distribution mix moves. Art 14(7)
A user notification capability — how you reach owners of products in the field with a security advisory, in a structured machine-readable format where appropriate. Art 14(8) requires it “without undue delay” to impacted users, and where appropriate to all users. CSAF (ISO/IEC 20153:2025) is the format. Art 14(8)
An incident response plan with the SRP submission step embedded, not bolted on. Article 14 is alive on day one. The plan has to work the first time a real incident hits, not after a tabletop on day thirty. Art 14(3), Art 16

That’s the binding list. It is doable. It is also not a substitute for what arrives fifteen months later.

§ 03What you do not have to finish by 11 September 2026

This is the part the loudest consultancy decks tend to compress, because compressing it sells more services. The honest answer is that none of the substantive construction obligations bind on this date. They bind on 11 December 2027.

What When it actually binds
Full secure-by-design programme satisfying Annex I Part I 11 Dec 2027 — Art 13 applies
Complete risk assessment integrated with technical documentation 11 Dec 2027 — Art 13(2)
Vulnerability handling programme satisfying Annex I Part II in full (not just Article 14’s reporting subset) 11 Dec 2027 — Art 13(8) read with Annex I Part II
SBOM and HBOM generated and maintained as the standard practice 11 Dec 2027 — via Annex I Part II point 1
Notified body conformity assessment for Important Class II and Critical products Window opens with Chapter IV from 11 Jun 2026; certificates needed by 11 Dec 2027
EU Declaration of Conformity and CE marking for new products placed on the market 11 Dec 2027 — Art 28, Art 30
Reporting obligations for products already placed on the market before 11 Dec 2027 Article 14 binds them too, from 11 Sep 2026 — per Art 69(3)

The last row is the genuinely awkward one. Article 69(3) means that products you shipped years ago are caught by the reporting obligations from September 2026, even though they were never built to Article 13 standards and never will be. The compliance posture for a 2018-vintage product still in the field on 11 September 2026 is: I will report any actively exploited vulnerability or severe incident through the SRP, but I make no claim that the product was built to CRA construction standards. That is the lawful answer, and a regulator who understands the regime knows that’s the only honest answer for legacy fleet.

You can still ship. You just have to tell on yourself.

§ 04Why the distinction is worth real money

Three reasons why getting the September 2026 / December 2027 distinction wrong is structurally expensive, and why getting it right releases capacity.

Reason one: capacity allocation. If a manufacturer treats 11 September 2026 as the day Article 13 binds, the engineering organisation gets a hard deadline pressing on every architectural decision: SBOM tooling, secure coding training, design reviews, threat modelling, notified body engagement, conformity assessment evidence binders. None of these can be delivered with quality in the runway available. The result is performative compliance — documents written to look right, processes that don’t survive contact with reality, and a notified body audit in 2027 that finds the substance missing. Treating September 2026 as a reporting deadline allows the construction work to be sequenced properly across the fifteen-month runway: SBOM and CI/CD integration in Q4 2026, secure-by-design uplift across H1 2027, notified body engagement in mid-2027, conformity assessment evidence by Q4 2027. The total work is the same; the schedule is realistic.

Reason two: vendor pricing. Consultancies and tool vendors price urgency. A “September 2026 or you cannot ship” framing supports premium pricing for compressed delivery. A “September 2026 reporting, December 2027 construction” framing exposes the runway, and the runway exposes the bargaining range. The same SBOM tool, the same advisory engagement, the same notified body negotiation costs materially less when the buyer knows the deadline is fifteen months further out than the seller is implying.

Reason three: legacy fleet posture. An organisation that conflates the two dates ends up either over-investing in retrofitting old products to construction standards they were never designed to meet, or under-investing in reporting capability for the products that are still in the field. Both are expensive. The right posture is binary: products you place on the market on or after 11 December 2027 are full Article 13 products with all the construction obligations, evidence, and conformity assessment routing; products already in the field before that date are reporting-only under Article 14, and the construction case is closed by support-period expiry, not by retrofit.

§ 05The 2026 calendar that actually matches the obligations

If 11 September 2026 is read correctly as the reporting activation date, the rest of the 2026 calendar falls into place around it.

Q2 2026: stand up the CVE monitoring, CVD intake, bug bounty pipeline. Pick the coordinator CSIRT under Art 14(7). Draft the 24/72/14-day reporting templates. Designate the owner. Tabletop the SRP submission flow once. By the end of June, the reporting machinery should be testable.

Q3 2026: tabletop the reporting flow twice more, once with engineering, once with executive notification included. Verify the user notification mechanism reaches the field installed base. Begin drafting the security advisory templates in CSAF format. By 11 September, the reporting capability is live and tested.

Q4 2026: Article 14 is in force. Reporting machinery runs in production. In parallel, the construction work begins: SBOM integration into CI/CD, secure development lifecycle uplift, supplier due diligence under Art 13(5), early conversations with notified bodies for any Important Class II or Critical product lines.

2027: the substantive year. Annex I conformance evidence assembled. Risk assessments documented. Notified body engagement formalised. Technical documentation written. Conformity assessment routes selected and traversed. All of this paced across the year, not compressed into a quarter.

11 December 2027: CE-marked products with full Article 13 construction evidence ready to be placed on the market. The fifteen-month gap between reporting activation and full construction binding has been used the way the legislator intended.

The factory in Hsinchu shipping its smart gateway on 12 September 2026 has, in this calendar, exactly what it needs. The product is in scope. The reporting machinery is alive. The support period clock is running. And the construction obligations — the heavy ones — will land on the next product placed on the market after 11 December 2027, by which time the CI/CD pipeline produces SBOMs, the secure development lifecycle is in place, the notified body is engaged, and the EU Declaration of Conformity is honest. That product is the real CRA product. The September 2026 product is a reporting-bound legacy product, and saying so is not weakness. It is precision.

The most expensive misreading of the CRA right now is the conflation of those two dates. Reading them as one date produces panic and waste. Reading them as two dates — with fifteen months of work in between, and a clear sequencing of which work belongs where — produces a calm 2026 and an honest 2027.

新竹一家工廠做一台符合 CRA Class I PwDE 的智慧工業閘道——有網路堆疊、有嵌入式 Linux 發行版——2026 年 9 月 12 日出貨給德國系統整合商。產品在歐盟市場上,毫無疑問落在 CRA 內、support period 時鐘已經開始走、弱點處理義務已經啟動。

但工程團隊的合規 dashboard 上、「Cyber Resilience Act」那一列還是綠色。沒生 SBOM、沒建安全公告流程、沒接觸任何公告機構。合規經理把那列標綠是因為、依他的法規讀法、真正的截止日是 2027 年 12 月 11 日——還有 15 個月。他一半對、一半錯。錯的那一半,正是 2026 年 9 月 11 日存在的目的。

那個日期確實綁住了某些東西。只是它綁住的不是多數人以為的東西。

§ 012026 年 9 月 11 日生效的是 Article 14、不是 Article 13

CRA 第 71(2) 條寫得不能再清楚:「Article 14 shall apply from 11 September 2026.」第 13 條——含有所有「實際上要把產品建得安全」實質義務的那一條——沒出現在 71(2) 裡。第 13 條從 2027 年 12 月 11 日才適用、跟法規其他實質部分同一天。15 個月的差距分開兩個日期,這 15 個月是真的在做事的。

第 14 條是通報條。它說:當你知悉一個被積極利用的弱點、或當你知悉一個影響產品安全的嚴重事件,你必須在 24 小時內透過 Single Reporting Platform 通報相關 CSIRT 跟 ENISA、72 小時內提交詳細通報、最終報告 14 天內(弱點)或 1 個月內(嚴重事件)交。它在結構上是一個「把自己抖出來」的義務、當不好的事情浮現時。

第 13 條是建構條。它說:安全地設計、做風險評估、在 support period 內處理弱點、用文件證明、產品落入 Important 或 Critical 級別時請公告機構背書。它在結構上是「從一開始就把產品做對」的義務。

通報你發現的被積極利用弱點、跟把產品建得安全、不是同一件事。把自己抖出來、跟「合規」不是同一件事。9 月那個日期綁的是前者;12 月那個日期綁的是後者。

§ 022026 年 9 月 11 日之前你真的要做完的事

清單比多數顧問講的短、而且上面的項目偏操作面、不是架構面。一個已有資安職能的聚焦團隊、三到四個月可以組裝完。沒有資安職能的話、六到九個月。

做什麼 為什麼 條文依據
偵測產品中被積極利用弱點的常駐流程——元件堆疊的 CVE feed、bug bounty 信箱的監測、協調式弱點揭露(CVD)的接收通道。 看不到就通報不出去。第 14 條的義務是於知悉時啟動、主管機關對「合理知悉」的看法、對「沒做接收通道」的團隊不會寬容。 Article 14(1)、Article 14(2)
24 / 72 / 14 天的通報能力——指定負責人、升級路徑、草稿模板、走過一次的演練。 時鐘從一個合理的工程師第一次想「這看起來像我們產品中一個被積極利用的弱點」開始走。時鐘已經走了之後才指定負責人,是錯過 24 小時最常見的方式。 Article 14(2)(a)–(c)、Article 14(4)(a)–(c)
協調者 CSIRT 的決定——非歐盟製造商要走 Article 14(7) 的四步階序(授權代表 → 進口商 → 經銷商 → 用戶)、每一步都用「數量最多」做 tie-breaker。 CSIRT 不是你選的。Article 14(7) 替你選、而且答案會隨你的通路結構改變。 Article 14(7)
使用者通知能力——你怎麼觸達在外面的產品擁有者、發出安全公告、必要時用結構化機讀格式。 Article 14(8) 要求「不得無故拖延」通知受影響使用者、必要時通知所有使用者。CSAF(ISO/IEC 20153:2025)是格式。 Article 14(8)
含 SRP 提交步驟的事件應變計畫——SRP 是內建的、不是事後加上去的。 Article 14 第一天就活了。計畫必須在第一個真實事件來時就能跑、不是第三十天演練之後。 Article 14(3)、Article 16

這就是綁定的清單。可以做完。但不能取代 15 個月後到的那些東西。

§ 032026 年 9 月 11 日之前不必做完的事

這部分是聲量最大的顧問簡報傾向壓縮的部分,因為壓縮這部分能多賣一些服務。誠實的答案是:所有實質的建構義務都不在這個日期生效。它們在 2027 年 12 月 11 日生效。

什麼 實際生效日
滿足附件一第一部分的完整 secure-by-design 程序 2027/12/11——Article 13 適用
整合到技術文件中的完整風險評估 2027/12/11——Article 13(2)
完整滿足附件一第二部分的弱點處理程序(不只是 Article 14 的通報子集) 2027/12/11——Article 13(8) 配附件一第二部分一起讀
SBOM、HBOM 作為標準作業生成並維護 2027/12/11——透過附件一第二部分第 1 點
Important Class II 與 Critical 產品的公告機構符合性評鑑 窗口從 2026/6/11 第四章開啟;2027/12/11 之前要拿到證書
新投入市場產品的 EU Declaration of Conformity 與 CE marking 2027/12/11——Article 28、Article 30
2027/12/11 前投入市場產品的通報義務 Article 14 也綁這些產品、從 2026/9/11 起——依 Article 69(3)

最後一列才是真正尷尬的那一列。Article 69(3) 代表你幾年前出貨的產品、從 2026 年 9 月起也被通報義務抓住,即使它們從未依 Article 13 標準建構、未來也不會。對 2026 年 9 月 11 日仍在外面的 2018 年舊產品、合規姿態是:我會透過 SRP 通報任何被積極利用的弱點或嚴重事件,但我不主張這個產品是依 CRA 建構標準建出來的。這是合法的回答、懂這個機制的主管機關知道,這是對 legacy fleet 唯一誠實的回答。

你還能出貨。但你必須把自己抖出來。

§ 04為什麼這個區隔值得真金白銀

三個理由說明為什麼搞錯 2026/9 跟 2027/12 的區隔在結構上很貴、為什麼搞對它能釋放產能。

理由一:產能配置。如果一家製造商把 2026/9/11 當成 Article 13 生效日、工程組織會被一個硬截止日壓在每一個架構決定上:SBOM 工具、安全程式設計訓練、設計審查、威脅建模、公告機構接洽、符合性評鑑證據夾。在剩下的時間裡這些都不可能有品質地交出。結果是表演式合規——文件寫得看起來對、流程經不起跟現實的接觸、2027 年公告機構稽核時發現實質缺乏。把 2026/9 當成通報截止日、建構工作可以在 15 個月內適當地排序:2026 Q4 做 SBOM 跟 CI/CD 整合、2027 H1 做 secure-by-design 升級、2027 年中接洽公告機構、2027 Q4 收齊符合性評鑑證據。總工作量一樣、行程是現實的。

理由二:供應商定價。顧問跟工具廠商會靠急迫感賣高價。「2026/9 否則無法出貨」這種敘事支撐壓縮交期的溢價。「2026/9 通報、2027/12 建構」這種敘事把時程亮出來;時程一亮、談判空間就出來了。同一個 SBOM 工具、同一個顧問接洽、同一個公告機構談判、當買方知道截止日比賣方暗示的還遠 15 個月時、價格會實質下降。

理由三:legacy fleet 處理立場。把兩個日期混在一起的組織、要嘛過度投資把舊產品翻修到原本就沒打算達到的建構標準、要嘛在仍然在外的產品上低估通報能力的投入。兩種都很貴。對的處理立場是二元的:2027/12/11 之後投入市場的產品是完整的 Article 13 產品、含全部建構義務、證據、符合性評鑑路徑;之前已經在外的產品只受 Article 14 通報、建構案以 support period 到期收尾、不靠翻修。

§ 05跟義務真的對齊的 2026 年行事曆

把 2026/9/11 正確地讀成通報啟動日、2026 年其他的行事曆就會自動歸位。

2026 Q2:把 CVE 監測、CVD 接收、bug bounty 流程立起來。依 Article 14(7) 選定協調者 CSIRT。寫好 24/72/14 天的通報模板。指定負責人。把 SRP 提交流程演練一次。6 月底時、通報機制應該可以被測試。

2026 Q3:再演練兩次、一次跟工程、一次納入高層通知。驗證使用者通知機制能觸達現場安裝基礎。開始用 CSAF 格式起草安全公告模板。9 月 11 日時、通報能力是活的、是被測過的。

2026 Q4:Article 14 生效。通報機制在生產環境跑。同時、建構工作開始:SBOM 整合進 CI/CD、安全開發生命週期升級、依 Article 13(5) 做供應商盡職調查、開始跟公告機構就 Important Class II 或 Critical 產品線做初期對話。

2027:實質的一年。附件一符合性證據組裝。風險評估文件化。公告機構接洽正式化。技術文件寫成。符合性評鑑路徑選定並走完。所有這些用整年的節奏做、不是壓縮到一個季。

2027 年 12 月 11 日:帶著完整 Article 13 建構證據的 CE 標示產品準備好投入市場。通報啟動跟完整建構生效之間的 15 個月差距、被以立法者原意的方式用掉了。

新竹那家工廠 2026 年 9 月 12 日出貨智慧閘道——以這個行事曆來看,它有它需要的一切。產品在範圍內。通報機制活著。Support period 時鐘在走。建構義務——重的那些——會落在 2027/12/11 之後下一個投入市場的產品上、到時 CI/CD 流程生 SBOM、安全開發生命週期就位、公告機構接洽完、EU Declaration of Conformity 是誠實的。那個產品是真正的 CRA 產品。9 月那個產品是受通報義務綁住的 legacy 產品,這樣說不是示弱。是精準。

CRA 現在最貴的讀錯,是把這兩個日期合成一個。讀成一個日期、產生焦慮跟浪費。讀成兩個日期——中間有 15 個月的工作、清楚地排序哪個工作屬於哪一段——產生平靜的 2026 跟誠實的 2027。