Budget-season decision guides

CRA complexity is not about how many products you have, but about the combination of each product family's class and each product line's supply-chain role. Estimate internal effort, consulting, external assessment and ongoing cost from that combination.

Reporting obligations have applied since 11 September 2026; the main obligations apply from 11 December 2027. Harmonised standards matter, but waiting for their official publication before starting is too late.

A TISAX budget consists of the ENX registration fee, the audit provider's assessment fee, consulting and internal effort; assessment objectives, number of sites and information-security maturity determine the amount.

ENX cannot estimate the overall timeline; what you can control is the order of the three steps: registration, assessment and exchange. Automotive digital products may also be governed by the CRA.

ISO 27701:2025 can be certified on its own, but it is not GDPR compliance. Estimate roles, scope, regulatory mapping, consulting and certification costs along one of two routes: stand-alone implementation or integration with ISO 27001.

Inventory and define roles first, then design controls, operate long enough to leave records, and only then certify. The personal-data inventory is the step most often underestimated.

The AI Act's high-risk obligations are postponed but not cancelled: stand-alone high-risk AI applies from 2 December 2027, AI embedded in products from 2 August 2028. ISO 42001 is a management system you can build now.

When choosing a CRA consultant, first check whether they can classify each product family and determine your supply-chain role for each product line, and whether they can handle legal compliance, process and security technology together. Criteria and questions you can put to any consultant.

When choosing a TISAX consultant, first check whether they can define the assessment scope and objectives correctly and make the right call between AL2 and AL3; automotive digital products also need the CRA considered at the same time.

ISO 27701:2025 can be certified on its own, but it is not GDPR compliance. Choose a consultant who can map it to both the GDPR and Taiwan's Personal Data Protection Act, and who correctly determines whether you are a controller or a processor.

An AI governance consultant must be able to classify risk and determine roles under the AI Act, build an auditable management system with ISO 42001, and handle data governance and model validation.

When choosing an ISO 22301 consultant, check whether the business impact analysis is solid, whether recovery objectives have been verified, and whether exercises actually expose problems.

When choosing an ERM consultant, look for one who can turn the risks scattered across departments into a structure the board can decide on, and keep monitoring it with key risk indicators.

When choosing an ISO 56001 and trade secret consultant, look for one who can institutionalise the innovation process and build reasonable confidentiality measures that can be evidenced.

The US uses federal procurement to require things of AI suppliers, the EU regulates through the AI Act and the draft CSA 2.0, and Japan promotes "trustworthy AI" through its AI Act and the AI Guidelines for Business. What the three have in common, and the 2027 timeline.

The Taiwan Stock Exchange's Risk Management Best Practice Principles for TWSE/TPEx Listed Companies draw on COSO ERM 2017 and ISO 31000:2018. The budget depends on organisational structure, the scope of the risk inventory and disclosure requirements; the timeline follows the board calendar.

ISO 22301 can be certified by a certification body. The budget depends on the number of critical activities and sites in scope, the depth of the business impact analysis, and the current state of backup and disaster-recovery technology.

ISO 56001 is a certifiable innovation management system standard. The budget depends on the coverage of the innovation process and the current state of trade secret protection measures.