Who should lead CRA compliance, and which units need to support it?

Direct answer: the CRA does not name a department. The obligations fall on the manufacturer as a legal entity (Article 13). In practice, final accountability should sit with the product business unit that decides on product design and market release; product security or compliance provides expertise and oversight (the second line); internal audit provides independent assurance (the third line). The IT department runs the company's internal systems, so product security should not be handed to it by default.

First, see how the regulation divides the work

CRA provision	What has to be done	Units involved
Article 13(2) and (3)	Build cybersecurity risk assessment into planning, design, development, production, delivery and maintenance; document it and update it during the support period	R&D, product management, quality
Article 13(4)	Include the risk assessment in the technical documentation (Article 31, Annex VII)	Quality / regulatory, R&D
Article 13(5)	Exercise due diligence when integrating third-party components, including open source	Procurement / supply chain, R&D
Article 13(6)	Inform the manufacturer or maintainer of a component when a vulnerability in it is found	Product security (PSIRT), R&D
Article 13(8)	Set the support period according to the product's expected use time and handle vulnerabilities effectively during it (Annex I, Part II)	Product management (sets the support period), PSIRT, R&D
Article 14	Notify actively exploited vulnerabilities and severe incidents to the CSIRT and ENISA at the same time through the single reporting platform: an early warning within 24 hours, a notification within 72 hours, and a final report (for vulnerabilities, within 14 days after a corrective measure is available; for incidents, within one month after the notification)	PSIRT leads; legal, customer service and senior management support

Four criteria for deciding who leads

Who decides on product design and release: holds final accountability (A). The length of the support period and whether to delay a release are product decisions.
Who can mobilise R&D and report externally within 24 hours: is responsible (R) for running the reporting process, usually the PSIRT or product security contact, with authority granted in advance.
Who holds the supplier and component lists: handles third-party component due diligence, usually procurement or supply chain management together with R&D.
Who is independent of the product line: provides oversight and assurance, and must not be the same person as the one holding final accountability.

If the IT department is the only place in the company with security expertise, its people can be seconded to help, but final accountability should still stay with the product line, because the R&D process, the component lists and release decisions are not in the IT department's hands.

How to use a responsibility matrix (RACI)

R = responsible, A = accountable, C = consulted beforehand, I = informed afterwards. The rule that is broken most often is simple: each task has exactly one A. Two example rows:

Task	Head of product business unit	R&D	Product security / PSIRT	Legal	Internal audit
Cybersecurity risk assessment (Article 13(2) and (3))	A	R	C	I	I
Article 14 reporting	A	C	R	C	I

The remaining tasks (technical documentation, third-party component due diligence, setting the support period, vulnerability handling, periodic review) have to be assigned according to the number of product lines, whether the company sells under its own brand, its role in the supply chain and its existing systems, so the result differs from company to company. Winners Consulting provides the full task list and responsibility matrix, based on your organisation and product lines, during the free mechanism diagnosis.

How it relates to the Three Lines Model

Under the IIA Three Lines Model (published in 2020, updated in 2024):

Governing body (the board): is accountable to stakeholders for oversight and delegates responsibility and resources to management.
First line (management's first-line roles): leads and directs actions, including managing risk. This corresponds to the day-to-day work of the product business unit, R&D and the PSIRT.
Second line (management's second-line roles): provides complementary expertise, support, monitoring and challenge, and reports on the adequacy and effectiveness of risk management, including internal control. This corresponds to product security governance or the compliance function.
Third line (internal audit): is primarily accountable to the governing body, is independent of management, and provides independent and objective assurance and advice.

Smaller companies can combine roles, but final accountability and independent assurance should not sit with the same person.

How to connect it to the systems you already have

CRA work does not need a separate management system. The four connection points below are systems that Taiwan public companies and TWSE/TPEx listed companies already have, so the existing owners can handle the CRA work within their existing processes. Companies that are not public companies are not subject to these regulations and principles, but can use the same approach voluntarily.

Existing system	Where the CRA work goes	Existing owner	Basis
Internal control system (R&D cycle)	The R&D cycle covers product design, prototyping and testing, so it takes on the design-stage risk assessment and technical documentation under Article 13	The units responsible for the R&D cycle; internal audit adds the relevant control points to the self-assessment and the annual audit plan	Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 3 (compliance with laws and regulations is one of the internal control objectives) and Article 7(1)(8)
Corporate governance and risk management	List the CRA as a compliance risk and include it in the existing risk management policy and periodic reporting	The board approves the policy and oversees it; the risk management promotion unit compiles and reports at least once a year	Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies, Articles 2 and 3; Risk Management Best Practice Principles for TWSE/TPEx Listed Companies, Articles 13, 15 and 18
Cybersecurity incident response and reporting	Add an Article 14 external reporting route to the existing cybersecurity incident response and reporting procedure	The dedicated cybersecurity supervisor	TWSE/TPEx cybersecurity control guidelines for listed companies, Article 34
Internal control system (procurement cycle)	The procurement cycle already includes supplier management, so write the Article 13(5) due diligence on external components (including open source) into the supplier evaluation criteria and purchase contracts	Procurement, quality	Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 7(1)(2)

Two distinctions matter:

The reports cover different things: the reporting procedure in the cybersecurity control guidelines deals with incidents in the company's own information systems; CRA Article 14 deals with actively exploited vulnerabilities and severe incidents affecting products. So it is one more route within the same procedure, and the triggers and external contacts have to be written separately.
The rules differ in force: the internal control regulations are mandatory for public companies; the governance and risk management principles and the cybersecurity control guidelines are mostly recommendations ("should" or "may") that companies adopt according to their size and industry.

Where the control points go in each cycle and how the self-assessment items are worded depend on your existing internal control system, and are provided during the free mechanism diagnosis.

Common mistakes

Assuming the IT department is responsible: the R&D process and component lists are not in the IT department's hands, so the risk assessment and technical documentation lose their basis.
Naming a contact without giving authority: Article 14 requires an early warning within 24 hours; if the contact has no authority to decide whether to report, the deadline cannot be met.
Putting the reporting process after the conformity assessment: the Article 14 reporting obligations have applied since 11 September 2026, including to products already on the market, so they should be set up first.

How Winners Consulting helps

At Winners Consulting, one team plans everything from the regulatory assessment through processes to technical controls, and vice-president and director-level consultants advise throughout in person, without outsourcing. We only advise; we do not certify. We help product lines put the responsibility matrix and the Article 14 reporting process into practice with real units and real authority.

What is Winners' track record in EU Cyber Resilience Act (CRA) Compliance Advisory?

As of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA).

Other engagements are anonymised by industry under NDA.

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.