What Is the EU CRA? Who Counts as a Manufacturer and Which Products Are in Scope?

The EU Cyber Resilience Act (CRA) is a cybersecurity regulation for “products with digital elements”. If your products are sold on the EU market, your company in Taiwan needs to understand its role and responsibilities.

📌 Key points of the CRA

🔹 Scope: Hardware and software products that can be connected, directly or indirectly, to a device or a network. Products already covered by their own dedicated legislation, such as medical devices and vehicles, are not subject to the CRA.
🔹 Manufacturer: Whoever places a product on the EU market under their own name or trademark bears the main responsibility, regardless of whether the company is established in the EU.
🔹 Other roles: Importers and distributors have verification obligations; anyone who substantially modifies a product is treated as the manufacturer.

👉 Which role does your company play under the CRA?

🏭 Own-brand industrial PCs: If you sell products under your own brand to European system integrators, your company is the manufacturer.
🔧 ODM manufacturing: The brand customer is the manufacturer, but it will usually ask your company to provide SBOMs, vulnerability information and test records.
🌐 Networking and energy storage equipment: When products are sold through a European agent, the agent acts as the importer and will ask your company for conformity documentation.
⚠️ A single company may hold several roles at the same time, and CRA responsibilities may differ from one product line to another.

📋 Recommended approach
First clarify, product line by product line, whether you act as an “own brand” or as a “contract manufacturer”. Then take stock of the data you will need to provide to customers and authorities, as the basis for your subsequent CRA compliance planning.

👉 Want to understand the roles and responsibilities of each of your product lines under the CRA?
Get in touch with Anselm (安盛資訊). We can help you clarify your product compliance requirements and set up product cybersecurity management and traceability.

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Next article: EU CRA: Three Key Dates, and Why Existing Models Matter Too

This article is for general information only and does not constitute legal advice.