Role 3角色 3 A reading for distributors 寫給經銷商的讀法
The lightest CRA obligations — and the lowest trap door. CRA 最輕的義務，以及最低的陷阱門。
Distributors are the third role with CRA-specific obligations. The verification duties are narrower than an importer's, the post-market liability is lighter than a manufacturer's, and the article that defines them — Article 20 — is short. But Article 21's threshold for converting a distributor into a manufacturer sits surprisingly low. The reading below is for an EU distributor handling APAC-made hardware in volume. 經銷商是 CRA 三個有特定義務的角色裡最輕的一個。驗證義務比進口商窄、上市後責任比製造商輕、定義條文（第 20 條）也短。但第 21 條把經銷商升級成製造商的門檻、低得出乎意料。下面這份讀法、是給「規模性處理 APAC 製造硬體的歐盟經銷商」的開頭。
Block 1 · The threshold question 區塊 1 · 入會門檻
A distributor is everyone in the chain who is not the manufacturer or the importer. 經銷商是供應鏈裡不是製造商也不是進口商的所有人。
The CRA defines distributor in Article 3(17) — any natural or legal person in the supply chain, other than the manufacturer or the importer, who makes a product with digital elements available on the EU market without affecting its properties. The definition is residual: if you are not a manufacturer (Article 3(13)) and not an importer (Article 3(16)), and you sell or rent EU-placed CRA products, you are a distributor.
"Without affecting its properties" is the operative phrase. As long as you sell the product as it came to you — same firmware, same configuration, same packaging — you are a distributor. The moment you alter it, Article 21's trap door opens.
This residual definition catches more parties than people expect. A retailer is a distributor. A B2B reseller is a distributor. A system integrator who resells unmodified product is a distributor. An EU subsidiary of a non-EU brand that resells what its EU-importer parent imports — also a distributor, not an importer.
The distributor's job is narrow but real: verify before selling, retain records, alert upstream when something is wrong. Three things, on a much shorter list than the manufacturer's twenty-five paragraphs of Article 13.
CRA 在第 3 條第 (17) 款定義經銷商，供應鏈中、除製造商與進口商以外、將具數位元素產品在歐盟市場上提供而不影響其屬性的自然人或法人。這是個殘差定義：如果你不是製造商（第 3(13) 條）也不是進口商（第 3(16) 條）、又銷售或出租已投入歐盟市場的 CRA 產品、你就是經銷商。
「不影響其屬性」是關鍵字。只要你賣的產品跟收到時一模一樣，同個韌體、同個設定、同個包裝，你就是經銷商。一旦你動它、第 21 條陷阱門就開了。
這個殘差定義抓到的對象比想像的多。零售商是經銷商。B2B 經銷商是經銷商。轉售未經修改產品的系統整合商是經銷商。非歐盟品牌的歐盟子公司、轉售它的歐盟進口母公司進的貨，也是經銷商、不是進口商。
經銷商的工作窄但真實：賣之前先驗證、保留紀錄、發現問題向上游通報。三件事、比製造商第 13 條 25 段的清單短得多。
Block 2 · Anchor articles 區塊 2 · 主軸條文
Two articles. One of them is the trap door. 兩條條文。其中一條是陷阱門。
The distributor's reading is the shortest of the three roles. But the trap door article is shared with the importer — and it triggers more often than people realise.
經銷商的讀法是三個角色裡最短的。但陷阱門條文跟進口商共用，而且觸發頻率比想像高。
Article 20
Obligations of distributors 經銷商義務
Three duties: verify CE marking and DoC availability before placing on market, keep traceability records, inform manufacturer or importer if a vulnerability is found. The shortest obligation set in the CRA — but enforcement still follows. 三項義務：投入市場前確認 CE 標示與 DoC 可取得、保留可追溯性紀錄、發現弱點時通知製造商或進口商。CRA 中最短的義務組合，但仍會被執法。
Article 21
Cases where distributor becomes manufacturer 經銷商成為製造商的情況
The trap door — same triggers as for importers. (1) place under your own name or trademark, or (2) substantial modification. Either makes you the manufacturer for CRA purposes, with the full Art 13 obligation set. The bar is lower than people think. 陷阱門，觸發條件跟進口商相同。(1) 以自身名字或商標投入市場、或 (2) 實質修改。任一條件讓你成為 CRA 下的製造商、繼承整套第 13 條義務。門檻比想像低。
Article 23
Identification of economic operators 經濟經營者識別
10-year traceability — same standard as importers. You must know who you bought from, who you sold to, in both directions, retrievable within 10 working days when the market surveillance authority asks. 10 年可追溯性，標準跟進口商相同。你必須知道向誰買、賣給誰、雙向都要、市場監督機關查詢時必須在 10 個工作天內回覆。
Article 3(30)
Substantial modification (definition) 實質修改（定義）
The single phrase in Article 3 that decides whether your re-bundle, re-flash, or re-pack triggers Art 21. Read it before any value-add activity. The Commission's Feb 2026 guidance gives examples worth reading alongside. 第 3 條中的單一定義、決定你重新打包、重新刷韌體、重新包裝是否觸發第 21 條。在做任何 value-add 活動前先讀。執委會 2026 年 2 月指引提供值得搭配讀的範例。
Block 3 · The timing 區塊 3 · 時程
When distributor obligations turn on. 經銷商義務什麼時候啟動。
Distributor obligations all activate together on full applicability. The preparation lead time is shorter than for the manufacturer or importer roles — but the verification routine has to be operationally live on the day.
經銷商義務在 CRA 全面適用時一起啟動。準備期比製造商或進口商角色短，但驗證例行作業必須在當天就營運中。
| Date日期 | What turns on啟動的義務 | What you should be doing你該在做什麼 |
|---|---|---|
| 11 Dec 2024 Entry into force生效 |
Regulation legally binding. No distributor obligations active yet.法規有法律拘束力。經銷商義務尚未啟動。 | Inventory your SKU lines. Identify which ones you sell unmodified vs which ones you re-bundle. The latter need an Article 21 review.盤點你的 SKU。識別哪些是原樣轉售、哪些是 re-bundle。後者需要第 21 條審視。 |
| 11 Sept 2026 Reporting on (manufacturer-side)通報義務啟動（製造商端） |
Manufacturers' Article 14 reporting active. Distributors do not directly report, but must relay vulnerability information up the chain when found.製造商第 14 條通報啟動。經銷商不直接通報、但發現弱點時必須往上游傳。 | Have the contact info for each upstream party — manufacturer, importer, or both. A clean intake channel for end-customer vulnerability reports.準備好每一個上游單位的聯絡資訊，製造商、進口商、或兩者。準備好一條乾淨的端客戶弱點通報受理通道。 |
| 11 Dec 2027 Full applicability全面適用 |
Article 20 verification, Article 23 traceability, Article 21 trap door — all active. Every CE-bearing CRA product passing through your hands must be verified at receipt.第 20 條驗證、第 23 條可追溯性、第 21 條陷阱門，全部啟動。每一個經過你手的 CE 標示 CRA 產品、收貨時都必須驗證。 | Verification at receipt SOP live. 10-year record system live. Re-bundle SKUs reviewed against Art 21 — re-priced or discontinued where needed.收貨驗證 SOP 上線。10 年紀錄系統上線。Re-bundle 的 SKU 對第 21 條重新審視，必要時重新定價或下架。 |
Block 4 · APAC perspective 區塊 4 · APAC 觀點
What distributors of APAC-made product consistently get wrong. 經銷 APAC 產品的經銷商常踩的雷。
1 · "Distributor obligations are too light to take seriously." 1 · 「經銷商義務太輕、不用認真」
Article 20 is short, but Article 23 (10-year traceability) and Article 21 (the trap door) are not. Penalties under Article 64 apply equally to distributors. The lighter obligation set does not equal a lighter enforcement risk — it equals a smaller compliance program with the same audit standards.
第 20 條短、但第 23 條（10 年可追溯性）跟第 21 條（陷阱門）都不短。第 64 條罰則對經銷商同樣適用。義務組合輕、不等於執法風險低，只等於合規程序較小、但稽核標準相同。
2 · "Re-bundling for our region is just packaging." 2 · 「為了區域 re-bundle 只是換包裝」
Repackaging without altering the product is fine. But "re-bundling" often means combining the product with accessories, region-specific adapters, localised firmware, or branded software. If the bundle changes the product's risk profile or expands its intended purpose, Article 21 says you have substantially modified it — and you are now the manufacturer. Many APAC-region distributors will need to re-paper their bundle SKUs before 11 Dec 2027.
不影響產品本身的重新包裝沒問題。但「re-bundle」常常是把產品搭配配件、區域轉接頭、在地化韌體、或品牌軟體一起賣。如果這個 bundle 改變了產品的風險屬性或擴展了預期用途、依第 21 條你就實質修改了，而且你現在是製造商。多數 APAC 區域經銷商必須在 2027/12/11 前重新處理 bundle SKU 的合約。
3 · "Our markup justifies skipping verification." 3 · 「我們的毛利不允許做驗證」
A distributor's verification under Article 20 is shallower than an importer's under Article 19 — but it is not optional, and it is not free. You must check that the CE mark is present, that the DoC is available on request from the manufacturer or importer, and that the product comes with required user information. If you place a non-conforming product on the market, you carry liability — even with thin margins.
經銷商在第 20 條下的驗證、比進口商在第 19 條下的淺，但不是可選、也不是免費。你必須檢查 CE 標示有貼、DoC 可向製造商或進口商要到、產品附帶必要的使用者資訊。如果你把不合規產品投入市場、責任在你身上，毛利再薄也一樣。
4 · "We just sell, we don't care about post-market." 4 · 「我們只負責賣、上市後不關我們的事」
Article 20(4) requires distributors to inform the manufacturer or importer "without delay" when they suspect a product is non-conforming or has a vulnerability that could affect security. End-customers report problems to whoever sold them the product — that is you. Your post-market role is small but it is a hinge: it is what triggers the manufacturer's Article 14 reporting clock if you are the first to know.
第 20 條第 (4) 款要求經銷商在懷疑產品不合規或有可能影響安全的弱點時、「不延遲地」通知製造商或進口商。終端客戶會把問題回報給賣家，那就是你。你的上市後角色小、但是個樞紐：如果你是第一個知道的人、你就是觸發製造商第 14 條通報時鐘的人。
Block 5 · Continue reading 區塊 5 · 繼續閱讀