Scope ของ CRA
ครอบคลุม Products with Digital Elements:
- Hardware: smart home, industrial IoT, network equipment, smart meters
- Software: applications, OS, drivers, firmware
- Class I important: browsers, password managers, antivirus, VPN
- Class II critical: OS, industrial firewall, HSM
- Excluded: medical devices, motor vehicles, aviation, defense
ข้อกำหนดหลัก 6 ข้อ
- 1) Security by Design — risk assessment + secure default
- 2) Vulnerability Handling — coordinated disclosure (ENISA)
- 3) Security Updates ฟรี ตลอด support period (≥ 5 ปี)
- 4) Conformity Assessment — self หรือ 3rd party
- 5) Technical Documentation เก็บ 10 ปี
- 6) CE Marking บนผลิตภัณฑ์ + packaging
Thai Exporters กระทบ
- Electronics: WD, Seagate, Hana — HDD/SSD/IC ส่ง EU USD 8.5B/ปี
- Smart appliances: Hitachi Thailand, Sharp Thailand
- Automotive electronics: Denso, Aapico — ECU, infotainment
- Software/SaaS: Thai fintech, gaming, AI startups
- Contract manufacturers — joint liability กับ brand owner
Compliance Roadmap
- Q3 2026: Gap analysis + risk assessment workshop
- Q4 2026: Vulnerability Disclosure Policy + ENISA reporting
- Q1 2027: Security architecture review + SBOM
- Q2 2027: Conformity Assessment + Documentation
- Q3 2027: Pre-market testing + CE marking
- Q4 2027: Go-live ก่อน 11 ธ.ค. 2027