Direct answer: three kinds of requirement belong in the R&D process. First, internal ones: a Taiwanese public company's internal control must cover the R&D cycle, including basic research, product design, technology development, prototyping and testing, R&D records and document keeping, and the acquisition, maintenance and use of intellectual property; and R&D output is protected under the Trade Secrets Act only with reasonable confidentiality measures. Second, those for products entering the EU: Article 13 of the EU CRA requires manufacturers to apply the essential requirements of Annex I according to a cybersecurity risk assessment across planning, design, development, production, delivery and maintenance, and to handle vulnerabilities in components, including open-source ones. Third, customer and industry requirements: ISO/SAE 21434 and TISAX prototype protection for automotive, IEC 62443-4-1 for industrial control, ISO/IEC 29147 and 30111 for vulnerability disclosure and handling, and ISO 42001 and the EU AI Act for AI products. The CTO's job is to fit these into the existing development process rather than build a second one.
The CTO's responsibilities in the rules
| Rule | Key wording | What it means for the CTO |
|---|---|---|
| Internal control regulations for public companies, Article 7, item 8: R&D cycle | Policies and procedures for basic research, product design, technology development, prototyping and testing, R&D records and document keeping, and the acquisition, maintenance and use of intellectual property | R&D records, document keeping and IP management fall within internal control audits |
| Trade Secrets Act, Articles 2 and 3 | Secrecy, economic value and reasonable confidentiality measures; trade secrets researched or developed by employees in the course of their duties belong to the employer | R&D output is protected only if reasonable measures can be seen |
| National Security Act, Article 3 | Prohibits obtaining trade secrets of national core key technologies by improper means; such technologies must be identified and take effect on announcement by the Executive Yuan | Applies only to technologies identified and announced by the Executive Yuan, not to all R&D |
| Act Governing Relations between the People of the Taiwan Area and the Mainland Area, Article 9 | People working on government-commissioned, subsidised or funded projects above a threshold involving identified national core key technologies need approval to enter mainland China, including within three years after leaving | Applies only to staff on government-commissioned, subsidised or funded projects above the threshold |
| EU CRA, Article 13(1), (2) and (6) | Design, develop and produce according to Annex I Part I; assess cybersecurity risks and take them into account in planning, design, development, production, delivery and maintenance; report component vulnerabilities to the component maintainer and remediate them | Secure design and vulnerability handling become part of the R&D process |
TWSE ESG evaluation: the indicator the CTO prepares
The ESG evaluation replaced the corporate governance evaluation from 2026 and covers listed companies. Indicator S-10 asks whether the company has set and disclosed an intellectual property management plan linked to its business goals, with its implementation, reported to the board at least once a year; implementing TIPS (Taiwan Intellectual Property Management System), ISO 56001 or a similar standard with third-party certification earns one extra point overall (same wording in 2026 and 2027).
Requirement by requirement: what the CTO decides, how it fits the development process, how long it takes
EU Cyber Resilience Act (CRA)
- Decide first: whether the product is in CRA scope, which category it falls into and which conformity assessment route applies.
- What the R&D process adds: the Annex I Part I essential requirements according to the risk assessment; the Annex I Part II vulnerability handling process, including an SBOM in a commonly used, machine-readable format; the Annex VII technical documentation.
- Dates: the Article 14 reporting obligations have applied since 11 September 2026; the other main obligations apply in full from 11 December 2027.
- Go deeper: EU CRA compliance, Who leads CRA, CRA timeline
IEC 62443-4-1 secure development lifecycle
- What it means for the CTO: IEC 62443-4-1 governs the organisation's secure development lifecycle (SDL); before a 4-2 product certification, the organisation must complete 4-1 certification. IEC 62443 certification is not a presumption of CRA conformity (CRA Article 27).
- Timeline (as listed on the service page): 4-1 SDL organisational certification usually 6–9 months; 4-2 product certification 4–8 months (excluding 4-1).
- Go deeper: IEC 62443, Choosing an IEC 62443 consultant
ISO/SAE 21434 automotive cybersecurity engineering
- What it means for the CTO: the core is TARA (threat analysis and risk assessment), from which cybersecurity goals and requirements are derived and carried through development and verification; it covers the whole lifecycle of vehicle E/E systems, from concept and development to production, operation, maintenance and decommissioning.
- How it fits existing processes: organisations with ASPICE or ISO 26262 processes can add 21434 incrementally to the existing development framework; when integrated with 26262, security analysis results feed the safety hazard analysis.
- Go deeper: ISO/SAE 21434, Choosing a 21434 consultant
ISO/IEC 29147 and 30111 vulnerability disclosure and handling
- What it means for the CTO: 29147 covers receiving external reports and publishing advisories; 30111 covers internal verification, rating, root cause analysis, fix development and testing. In the JRC and ENISA mapping, 30111 covers five of the eight vulnerability handling items in Annex I Part II of the CRA; the SBOM, regular testing and secure distribution of updates must be covered by other standards or procedures.
- Recommendation: implement the two as a pair so the hand-off leaves no audit gap.
- Go deeper: ISO/IEC 29147, ISO/IEC 30111
ISO 42001 and the EU AI Act
- Decide first: each AI system's role under the EU AI Act (provider or deployer) and its risk tier.
- What R&D prepares: technical documentation, data governance, accuracy and robustness for high-risk AI; ISO 42001 certification is not EU AI Act compliance.
- Timeline (as listed on the service page): EU AI Act compliance for high-risk AI usually 6–9 months, 9–12 months together with ISO 42001 certification.
- Go deeper: EU AI Act, ISO 42001
Trade secret protection
- What it means for the CTO: R&D information needs grading and confidentiality marking, confidentiality agreements that state the scope specifically, a limited circle of people with access logs, and confidentiality contracts before external disclosure; a signed confidentiality agreement alone is not enough.
- Timeline (as listed on the service page): usually 3–6 months; at the end, a departing employee taking materials is simulated from logs to evidence preservation, and the gaps are fixed.
- Go deeper: Trade secret protection programme, Choosing a trade secret consultant
ISO 56001 innovation management system
- What it means for the CTO: ISO 56001:2024 is the first certifiable requirements standard in the ISO 56000 series; IP follows ISO 56005 and links to trade secret protection. ESG indicator S-10 adds one point for ISO 56001 third-party certification.
- Timeline (as listed on the service page): usually 6–9 months; about 5–7 months for organisations with ISO 9001 or 27001. Two or three live innovation projects must run through the full process, and that stage cannot be compressed.
- Go deeper: ISO 56001, Choosing an ISO 56001 consultant
TISAX prototype protection
- What it means for the CTO: a carmaker's TISAX assessment scope can include prototype protection; the level follows the assessment objectives and cannot be chosen freely. Assessments commissioned from 1 January 2027 use VDA ISA2027; where the scope includes prototype protection and the assessment is commissioned after 2027, allow time to restructure documents under ISA2027.
- Go deeper: TISAX assessment consulting, Choosing a TISAX consultant
How it fits the systems you already have
A public company's internal control already covers the R&D cycle; new R&D requirements should connect to its existing control points rather than form a second system. The internal control regulations apply to public companies; companies that are not public companies are not covered by them and can use them voluntarily.
| Rule | What you already have | How the new requirements fold in |
|---|---|---|
| Internal control regulations, Article 7, item 8: product design, technology development, prototyping and testing | Control points for design review, prototyping and testing | Put the CRA risk assessment and Annex I essential requirements, 21434 TARA and 62443-4-1 secure development activities into the existing design review and test gates |
| Internal control regulations, Article 7, item 8: R&D records and document keeping | R&D records and document management | Keep the CRA Annex VII technical documentation, SBOM and vulnerability handling records under the same document rules |
| Internal control regulations, Article 7, item 8: acquisition, maintenance and use of IP | IP management and the patent process | Connect trade secret grading, marking and access logs, and ISO 56001 IP management, to the same process |
How Winners Consulting works
This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.
- Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
- Fit into existing processes: first confirm the existing development framework (such as ASPICE or ISO 26262), then add the new requirements incrementally
- Implement in pairs: 29147 together with 30111; 62443-4-1 before 4-2
- First step: the first mechanism diagnosis is free
Related questions
- What does the R&D cycle of internal control cover? Under Article 7, item 8 of the Regulations Governing Establishment of Internal Control Systems by Public Companies, it covers policies and procedures for basic research, product design, technology development, prototyping and testing, R&D records and document keeping, and the acquisition, maintenance and use of intellectual property. Trade secret protection programme
- What does the EU CRA require of the R&D process? Article 13 requires manufacturers to design, develop and produce products according to the Annex I Part I essential requirements and to take the outcome of a cybersecurity risk assessment into account in planning, design, development, production, delivery and maintenance; when they find a vulnerability in a component, including an open-source one, they must report it to the component's manufacturer or maintainer and remediate it. EU CRA compliance
- Who owns trade secrets developed by employees in the course of their work? Under Article 3 of the Trade Secrets Act, trade secrets researched or developed by employees in the course of their duties belong to the employer, unless the contract provides otherwise. To be protected, they must still meet the Article 2 elements of secrecy, economic value and reasonable confidentiality measures. Trade secret protection programme
- Is all R&D output a national core key technology? No. National core key technologies must be identified and take effect on announcement by the Executive Yuan; the approval requirement for entering mainland China under Article 9 of the cross-strait act applies only to people working on government-commissioned, subsidised or funded projects above a threshold involving identified technologies. Trade secret protection programme
- Which comes first, IEC 62443-4-1 or 4-2? 4-1: before a 4-2 product certification, the organisation must complete 4-1 secure development lifecycle certification. IEC 62443
- Does adopting ISO/SAE 21434 mean rebuilding the development process? No. Organisations with ASPICE or ISO 26262 processes can add 21434 incrementally to the existing development framework; the core is TARA. ISO/SAE 21434
Request a free mechanism diagnosis
What is Winners' track record in EU Cyber Resilience Act (CRA) Compliance Advisory?
As of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA).
Other engagements are anonymised by industry under NDA.
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.