CRA Timeline & Deadlines-其陽科技 AEWIN Technologies

Our Approach to the CRA

AEWIN treats cyber resilience as a core strategic direction for industrial computing, embedding security into product architecture from the ground up. AEWIN maintains a rigorous security process across design, development, testing, and lifecycle maintenance. With the EU Cyber Resilience Act (CRA) ushering in mandatory cybersecurity compliance for digital products, AEWIN has proactively begun related technical and process preparations to help customers align with international standards efficiently and reduce compliance costs.

The CRA (EU 2024/2847) establishes cybersecurity requirements for all products with digital elements sold into the EU. AEWIN's early preparation ensures its industrial computing equipment delivers superior built-in defense capability and market competitiveness.

To give manufacturers sufficient time to adjust and align, the EU Cyber Resilience Act (CRA) adopts a phased rollout strategy. The regulation officially took effect on December 10, 2024, and will be progressively implemented over the following years.

During this transition period, companies must pay particular attention to two key milestones: first, September 11, 2026, when mandatory reporting of security vulnerabilities becomes a legal requirement; and second, December 11, 2027, the "full compliance deadline," by which all products falling within the scope of the CRA must meet the relevant market access requirements. This timeline will affect CE marking and eligibility for sale in the EU market for applicable products.

Security Advisories & Vulnerability Procedures

AEWIN has established a Product Security Incident Response Team (PSIRT), taking a proactive approach through established processes to help reduce product security risks and helping customers obtain relevant security information and support resources to address cybersecurity challenges.

We evaluate, investigate, and handle reports that may affect the security of AEWIN products according to our established vulnerability management procedures. We have therefore developed a Security Vulnerability Management Policy and established a Security Advisories section to provide customers with guidance and information when security vulnerabilities are discovered. This policy ensures that all customers have ongoing access to clear resources for understanding how AEWIN resolves or mitigates security vulnerabilities reported by customers.

PSIRT

If you discover a potential security vulnerability in a AEWIN product

please submit a detailed report to help expedite our risk assessment and enable us to provide a fix or mitigation as quickly as possible.

The report should include the following information:

Product name and model	Steps to reproduce the issue (please include images or code where possible)	Packet capture of the attack process
Software/firmware version	Proof of concept or exploit code	Any other supplementary information you believe would aid the analysis
Equipment and software required to reproduce the issue	Description of potential attack impact

Report a Security Vulnerability

PSIRT@aewin.com

CRA Frequently Asked Questions (FAQ)

What is the EU Cyber Resilience Act (CRA)?

Which products are actually covered by the CRA?

The EU Cyber Resilience Act (CRA) has an extremely broad scope, covering all Products with Digital Elements (PwDE) that can connect directly or indirectly to other devices or networks — whether connectable hardware such as smartphones, IoT devices, and routers, or software such as operating systems, applications, and software libraries. Only specific products already regulated under other dedicated regulations, such as medical devices and vehicles, as well as non-commercial open-source software, are exempt. In response to this new regulation, most of DFI's network-connectable industrial computers, embedded systems, and related software may fall within the CRA's definition of PwDE, though actual applicability still depends on the product configuration and market use. DFI has included relevant product lines within the scope of CRA preparation and assessment, to help customers align with international cybersecurity requirements.

What are the main obligations manufacturers must fulfill?

Under the CRA framework, manufacturers' compliance obligations span the product's entire lifecycle, from development to post-sale support. During the pre-market readiness phase, companies must carry out cybersecurity risk assessments to ensure compliance, and complete the preparation of technical documentation, conformity assessment procedures, and CE marking; during the operational phase after product launch, manufacturers must fulfill security update and vulnerability management obligations throughout the support period, and proactively and promptly report to the relevant authorities in the event of an actively exploited vulnerability or a major security incident.

What are CRA harmonized standards?

Harmonized standards are technical specifications developed by European standardization bodies such as CEN, CENELEC, and ETSI, whose core purpose is to translate the essential security requirements of the Cyber Resilience Act (CRA) into clear, implementable specifications for R&D teams. These standards are built on existing global cybersecurity standards, with the "horizontal" and "vertical" standards expected to be published in August and October 2026 respectively; DFI will continue to track the latest standards developments and progressively adjust its product development and security processes to remain aligned.

When does the CRA take effect, and what are the deadlines?

Understanding the CRA compliance timeline helps reduce compliance risk when bringing products into the EU market. The regulation will be implemented in two key phases: starting September 11, 2026, vulnerability and security incident reporting will become a mandatory statutory obligation; and the most critical full compliance deadline is set for December 11, 2027, by which time the relevant CRA market access requirements will formally apply — products that do not meet the requirements will be unable to obtain CE marking, so companies must accelerate their product line security planning starting now.

What penalties apply for non-compliance with the CRA?

Companies that fail to meet CRA requirements may face administrative fines, product withdrawal from the market, or restrictions on market sales. The regulation establishes strict penalty mechanisms for core violations, with fines of up to €15 million or 2.5% of a company's total global annual turnover, whichever is higher; other technical or procedural violations carry corresponding penalties. This clearly demonstrates the EU's determination to comprehensively strengthen the cybersecurity of digital devices, and CRA compliance will become an essential condition for applicable products to enter the EU market.

How does the CRA differ from the NIS2 Directive?

The EU's CRA and NIS2 are two cybersecurity regulations advancing in parallel, but they establish different dimensions of security defense. The NIS2 Directive focuses on protecting the information systems and network security of "operators of critical infrastructure and essential services," whereas the CRA focuses directly on "the digital product itself," mandating security-by-design from the source and full lifecycle vulnerability governance. The two regulations complement each other, together building comprehensive defense resilience across Europe's digital environment, and DFI's industrial computing platforms can serve as an important foundation for customers building CRA-ready products, helping them adopt secure design, vulnerability management, and long-term maintenance mechanisms.

What is a Software Bill of Materials (SBOM)?

A Software Bill of Materials (SBOM) is a "digital ingredient list" detailing all software components and libraries contained within a product. The CRA requires manufacturers to establish relevant lists and technical documentation for their product's software components, in order to support vulnerability management and compliance verification. While current regulations do not require manufacturers to proactively disclose this information to the public, companies must be able to provide the relevant SBOM information upon request from regulators or market surveillance authorities as required by law.

歐盟網路韌性法案 (CRA)