07.13 AI Hardware Compliance Supplement: CRA / SBOM / Algorithm Filing / Cross-Border Data
Governance metadata | Owner: Head of Finance/Legal | Last reviewed: 2026-10-22 | Next review: 2027-01-31
Core principle: AI hardware compliance is not "attach a privacy policy before launch." It is an end-to-end engineering effort spanning product definition, cloud services, models, data flows, and vulnerability response.
1. Compliance Map
| Product form | Main applicability |
|---|---|
| Connected, no AI generation | CE-RED 3.3 d/e/f, GDPR, CRA, SBOM |
| AI generation/conversation | Above + EU AI Act transparency, China generative-AI filing |
| Camera/microphone | Above + privacy, data minimization, child protection |
| Child-directed | Above + COPPA, age verification, parental consent |
2. EU CRA (Cyber Resilience Act)
- Applies to products with digital elements placed on the EU market;
- Manufacturer obligations: secure design, vulnerability handling, security updates, support period, technical documentation;
- Vulnerability disclosure: proactively report exploited vulnerabilities and severe incidents;
- Relationship with EN 18031: RED covers the cybersecurity baseline for radio equipment; CRA covers the broader digital-product lifecycle.
Application dates and obligations are subject to the official text. Legal must confirm the timeline at project kickoff.
3. SBOM (Software Bill of Materials)
Minimum fields:
| Field | Description |
|---|---|
| Component name | Open-source/commercial component |
| Version | Exact version |
| Supplier | Origin |
| License | SPDX identifier |
| Dependency | Direct/transitive |
| Known vulnerabilities | CVE references |
Requirements: update with each release, machine-readable (SPDX/CycloneDX), retained with security updates.
4. China: Algorithm Filing and Generative AI
| Item | Trigger | Deliverable |
|---|---|---|
| Algorithm filing | Algorithms with public-opinion or social-mobilization capability | Filing number, algorithm description |
| Generative-AI service filing | Public generative-AI services | Filing/registration, security assessment |
| Cross-border data | Providing personal information/important data abroad | Security assessment/standard contract/certification |
Thresholds and procedures are subject to current CAC/competent-authority rules.
5. Cross-Border Data
- Classify and grade data: personal information, sensitive personal information, important data;
- Minimize: collect only what the function requires;
- Prefer domestic storage; when cross-border transfer is necessary, choose security assessment/standard contract/certification;
- Map supplier data flows (cloud, model, customer service);
- Implement user consent and withdrawal mechanisms.
6. Vulnerability and Incident Response
- Establish a PSIRT (Product Security Incident Response Team);
- Disclosure window: receive → assess → fix → disclose;
- Regulatory notification: within the deadlines required by CRA/GDPR/CAC;
- Link recalls/OTA circuit breakers with the gray-release mechanism in 02.07.
7. Documentation and Evidence Chain
- Technical documentation (architecture, data flows, threat model);
- Risk assessment and mitigations;
- Declaration of Conformity (DoC);
- SBOM and vulnerability records;
- Retention period per regulation and company policy.
8. Execution Checklist
[ ] Product-form classification and applicable-regulation mapping
[ ] CRA obligations and timeline confirmed
[ ] SBOM generation process and field standard
[ ] Vulnerability disclosure and PSIRT process
[ ] China algorithm/generative-AI filing assessment
[ ] Cross-border data path selection and records
[ ] Supplier data-flow mapping
[ ] Technical documentation and DoC archived
[ ] OTA security updates linked to circuit breakers
[ ] Annual compliance drill
9. Related Documents
- 02.04 Paired App and IoT Software GTM
- 05.08 EU Market Entry Field Guide
- 07.02 US/EU/JP Wireless Compliance and EPR
- 07.01 China CCC and PIPL
- 02.07 Firmware OTA Gray Release and Circuit Breaker
Disclaimer: This is an internal compliance framework, not legal advice. Obligations and timelines are subject to the official texts and legal counsel.
10. Key CRA Dates (Review Supplement)
| Date | Milestone |
|---|---|
| 2024-12-11 | CRA enters into force |
| 2026-09-11 | Vulnerability and severe-incident reporting obligations apply |
| 2027-12-11 | Main product requirements and vulnerability-handling obligations fully apply |
The above is the public timeline; applicability remains subject to the official text and legal counsel.
Review record (2026-10-22): This is an AI-hardware compliance operating framework. The CRA timeline and other key points have been checked against public official information; it does not constitute legal advice. Applicability remains subject to Legal and the official texts.
Official References (for review)
- EU CRA (European Commission): https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- EU AI Act (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- China CAC (algorithms/generative AI): https://www.cac.gov.cn