Role 2角色 2 A reading for importers 寫給進口商的讀法
If you are the EU side of a non-EU manufacturer, this is your CRA. 如果你是非歐盟製造商在歐盟那一邊、這是你的 CRA。
An importer is the party who places a non-EU manufacturer's product on the EU market. The CRA gives importers a tighter, more verification-shaped obligation set than people expect — and a quiet trap door that turns importers into manufacturers when they cross certain lines. The reading below is what I would hand to an EU-based importer of APAC-made hardware. 進口商是「把非歐盟製造商的產品放到歐盟市場上」的那一方。CRA 給進口商的義務、比想像中更緊、更偏向驗證型，還有一道安靜的陷阱門、會在你越過某條線時把你變成製造商。下面這份讀法、是我給「進口 APAC 製造硬體的歐盟進口商」的開頭。
Block 1 · The threshold question 區塊 1 · 入會門檻
Two doors in. One door out. 兩道門進。一道門離開。
The CRA defines importer in Article 3(16) — a natural or legal person established in the Union who places on the EU market a product with digital elements that bears the name or trademark of a person established outside the Union. Two facts decide it: you are inside the EU, and the manufacturer behind the product is outside the EU.
If you are a Taiwan, Japan, Korea or India business with no EU establishment, you are not an importer in the CRA sense — even if you ship product to the EU. Your EU customer who places the goods on the market is the importer. This sits behind the typical APAC export structure.
The trap door is Article 21. If an importer puts the product on the market under their own name or trademark, or substantially modifies the product, that importer is treated as the manufacturer for CRA purposes. The full Article 13 obligation set transfers to the importer. This is the door that re-routes commercial relationships and re-prices contracts.
Substantial modification includes more than people expect. Article 3(30) and the Commission's Feb 2026 draft guidance both say software updates that change the risk profile or the intended purpose can count. Importers who re-flash firmware before reselling — read this paragraph carefully.
CRA 在第 3 條第 (16) 款定義進口商，設立於歐盟內、將「掛名為設立於歐盟外人士」的具數位元素產品投入歐盟市場的自然人或法人。兩個事實決定身份：你在歐盟境內、產品背後的製造商在歐盟境外。
如果你是台日韓印度的廠商、在歐盟沒有設立、就不是 CRA 意義下的進口商，即使你出貨到歐盟也一樣。把貨投入市場的歐盟客戶才是進口商。典型 APAC 出口結構的背後就是這個邏輯。
陷阱門是第 21 條。進口商若以自己的名字或商標把產品投入市場、或對產品做實質修改、依第 21 條被視為製造商。整套第 13 條義務轉移到進口商身上。這扇門會重新繞商業關係、重新定價合約。
「實質修改」抓得比想像廣。第 3 條第 (30) 款跟執委會 2026 年 2 月指引草案都說、改變風險屬性或預期用途的軟體更新都算。在轉售前重新刷韌體的進口商，這段要仔細讀。
Block 2 · Anchor articles 區塊 2 · 主軸條文
Two articles for you, plus the one that flips the table. 兩條是你的、加上會翻桌的那條。
An importer's CRA reading is shorter than a manufacturer's — but each anchor article cuts deeper than its length suggests.
進口商的 CRA 讀法、比製造商短，但每一條主軸條文、實質份量都比字數看起來重。
Article 19
Obligations of importers 進口商義務
Eight verification duties before placing on the market: confirm CE marking, verify DoC, check technical documentation availability, ensure manufacturer designation. The importer is a gatekeeper, not a passive shipper. 投入市場前的 8 項驗證義務：確認 CE 標示、查驗 DoC、確認技術文件可取得、確認製造商標示。進口商是把關者、不是被動出貨人。
Article 23
Identification of economic operators 經濟經營者識別
10-year traceability. You must keep records of who you bought the product from and who you supplied it to, going both directions. The market surveillance authority can ask, you must answer within 10 working days. 10 年可追溯性。你必須保留向誰買、賣給誰的紀錄、雙向都要。市場監督機關可以查詢、你必須在 10 個工作天內回覆。
Article 21
Cases where importer becomes manufacturer 進口商成為製造商的情況
The trap door. Two trigger conditions: (1) you place the product under your own name or trademark, or (2) you substantially modify it. Either one transfers the full Article 13 manufacturer obligation set to you. This article re-prices many APAC import contracts. 陷阱門。兩個觸發條件：(1) 以你的名字或商標投入市場、或 (2) 你對產品做實質修改。任一條件都會把整套第 13 條製造商義務轉到你身上。這條會重新定價許多 APAC 進口合約。
Article 14
Reporting obligations 通報義務
Importers do not directly trigger Art 14. But importers must inform the manufacturer without delay if they suspect a vulnerability or non-conformity. The 24-hour clock starts at the manufacturer end — your delay in informing them eats into their window. 進口商不直接觸發第 14 條。但進口商若懷疑有弱點或不合規、必須立即告知製造商。24 小時時鐘從製造商端開始算，你延遲告知會吃掉他的窗口。
Article 13
Manufacturer obligations 製造商義務
Read this even though you are not a manufacturer. You will need to verify what the manufacturer has done before you can clear your Article 19 verification duties. Article 13 is the spec your supplier must meet for you to do your job. 即使你不是製造商也要讀。你必須先核驗「製造商做到什麼」、才能完成你第 19 條的驗證義務。第 13 條是你供應商必須達到的規格、你才能做你自己的事。
Article 22
Other cases applicable to manufacturers 其他適用於製造商的情況
When a non-EU manufacturer has not designated an authorised representative and there is no importer for a particular shipment, that shipment cannot legally enter the EU market. Article 22 closes the loophole — and explains why your role is structurally necessary, not optional. 當非歐盟製造商沒指定授權代表、特定出貨也沒有進口商時、那批貨無法合法進入歐盟市場。第 22 條把這個法律漏洞封掉，也說明你的角色為什麼是結構必須、不是可選。
Block 3 · The timing 區塊 3 · 時程
When importer obligations turn on. 進口商義務什麼時候啟動。
Importer obligations all activate together on full applicability. But the verification machinery has to exist before that date — because the first product placed on the market on 11 Dec 2027 cannot wait for the system to be built.
進口商義務在 CRA 全面適用時一起啟動。但驗證機制必須在那天之前就建好，因為 2027/12/11 第一台投入市場的產品、不能等系統還在建。
| Date日期 | What turns on啟動的義務 | What you should be doing你該在做什麼 |
|---|---|---|
| 11 Dec 2024 Entry into force生效 |
Regulation legally binding. No importer obligations active yet.法規有法律拘束力。進口商義務尚未啟動。 | Map your supplier list. Identify which APAC manufacturers will need authorised representatives if they have no EU establishment. Start the conversation early.盤點你的供應商。識別哪些 APAC 製造商沒有歐盟設立、需要授權代表。對話越早越好。 |
| 11 Sept 2026 Reporting on通報義務啟動 |
Manufacturers' Article 14 reporting active. Importers must be ready to relay vulnerability information to the manufacturer without delay.製造商的第 14 條通報啟動。進口商必須準備好不延遲地把弱點資訊傳給製造商。 | Have a documented escalation channel to each manufacturer. Know who to call at 2am.對每一家製造商都有書面化的升級通報通道。知道凌晨 2 點要打給誰。 |
| 11 Dec 2027 Full applicability全面適用 |
Article 19 verification, Article 23 traceability, Article 21 trap door — all active. CE-bearing products entering the EU through you must be verifiable on the day.第 19 條驗證、第 23 條可追溯性、第 21 條陷阱門，全部啟動。當天透過你進入歐盟的帶 CE 標示產品、必須當下可被核驗。 | Verification SOP in place. 10-year record system live. Re-priced contracts where Art 21 risk is real. Cleared inventory on questionable products.驗證 SOP 就位。10 年紀錄系統上線。對 Art 21 風險真實存在的合約已重新定價。對問題產品已清庫存。 |
Block 4 · APAC perspective 區塊 4 · APAC 觀點
What EU importers of APAC product consistently get wrong. 進口 APAC 產品的歐盟進口商常踩的雷。
1 · "Verification means the CE mark is on the box." 1 · 「驗證就是看 CE 標示有沒有貼在盒子上」
Article 19 lists eight specific verification duties. CE marking is one of them, but only one. You must also verify the DoC has been drawn up, that the EU manufacturer designation is correct, that the technical documentation is available on request, and that the contact information for vulnerability reporting is reachable. A counterfeit CE mark is the easy case to spot — a missing manufacturer designation is the hard one, and it will appear in audits.
第 19 條列出 8 項具體驗證義務。CE 標示只是其中之一。你還必須核驗 DoC 已製作、歐盟製造商標示正確、技術文件依要求可取得、弱點通報聯絡資訊可達。仿冒 CE 標示容易抓，但缺漏的製造商標示是難的、稽核時會跑出來。
2 · "If something is wrong, that's the manufacturer's problem." 2 · 「東西出問題那是製造商的事」
Article 19(3) says the importer must not place a non-conforming product on the market. If you place it knowing it is non-conforming, you carry liability — even if the manufacturer is the source of the non-conformity. Your verification is not a courtesy to the manufacturer; it is the bar you must clear before you can ship.
第 19 條第 (3) 款說、進口商不得把不合規產品投入市場。如果你「明知不合規」還投入市場、責任在你身上，即使源頭是製造商也一樣。你的驗證不是對製造商的禮貌、是你出貨前必須越過的門檻。
3 · "Re-flashing firmware to localise the language is fine." 3 · 「為了在地化把韌體刷一下沒事」
It depends. Localisation that only changes display language is unlikely to count as substantial modification. But if your re-flash also changes default security settings, opens new ports, or adds features the manufacturer did not test, you may have crossed the Article 21 line and inherited the full manufacturer obligation set. The Commission's Feb 2026 draft guidance gives examples worth reading.
看狀況。只改顯示語言的在地化、通常不會算實質修改。但如果你刷韌體時順便改了預設資安設定、開新 port、或加上製造商沒測過的功能、你可能已經越過第 21 條的線、繼承整套製造商義務。執委會 2026 年 2 月指引草案有舉例、值得讀。
4 · "Private label means we just put our brand on it." 4 · 「私牌就是把我們品牌貼上去」
If you are an EU importer who places the product on the EU market under your own brand, you are no longer just an importer. Article 21(1) makes you the manufacturer for CRA purposes. The full Article 13 obligation set transfers — including support period commitment, technical documentation, conformity assessment liability. Private label arrangements with APAC OEMs need to be re-papered before placing on the market under CRA full applicability.
如果你是歐盟進口商、用自己品牌把產品投入歐盟市場、你就不只是進口商。第 21 條第 (1) 款讓你成為 CRA 下的製造商。整套第 13 條義務轉移，包括 support period 承諾、技術文件、符合性評鑑責任。跟 APAC OEM 的私牌安排、必須在 CRA 全面適用前重新做合約。
Block 5 · Continue reading 區塊 5 · 繼續閱讀