EU Cyber Resilience Act (CRA)

Unex’s Product Security Approach

Unex maintains a structured approach to product security, including vulnerability handling and lifecycle support. This page describes how Unex approaches the EU Cyber Resilience Act (CRA) and the product security information we can provide to support customers in their own assessments.

Scope

The CRA applies to products with digital elements made available on the EU market. Some product categories are governed by other EU legislation. Unex’s V2X communication modules may be relevant to the CRA, depending on the module’s intended use and the end product in which they are integrated.

As radio-equipped components, the modules may also be relevant to the cybersecurity requirements under the Radio Equipment Directive (RED), Delegated Regulation (EU) 2022/30. The applicable regulatory framework and conformity requirements for a complete product depend on how the module is integrated into the customer’s system and on the product’s intended use.

Timeline

10 Dec 2024

CRA (Regulation (EU) 2024/2847) entered into force

11 Jun 2026

Provisions on conformity assessment bodies apply

11 Sep 2026

Vulnerability and severe incident reporting obligations (Article 14) apply.

11 Dec 2027

Main CRA requirements apply

How Unex Approaches Product Security

Security is treated as an ongoing responsibility across the product lifecycle.
Our vulnerability handling follows a structured process:

Identify

Receive and triage potential vulnerabilities affecting Unex products or software components.

Assess

Evaluate affected products, software versions, severity, and potential impact.

Mitigate

Where appropriate, develop fixes, updates, or mitigation guidance.

Communicate

Share relevant vulnerability information and mitigation guidance with affected customers.

Where applicable law requires reporting to authorities, this is handled separately from the steps above.

Product Security Lifecycle Support

Depending on the product, applicable requirements, and identified security risks, Unex may provide security updates, fixes, or mitigation guidance. For product-specific support information, please contact your Unex representative.

V2X Module Portfolio and CRA Status

The table below reflects the current CRA-related status of Unex’s V2X module products.
It may be updated as our security work progresses.

Product	CRA-Related Status	Ongoing Activities
SOM-352	CRA applicability depends on intended use and system integration	Vulnerability handling; security documentation

Roles and Responsibilities

Unex may provide security-relevant information at the component level, where available. Customers integrating Unex modules should evaluate the conformity of their complete product. Each party remains subject to the obligations that apply to it under applicable law.

Unex does not currently have an entity or authorised representative established in the European Union. For product security matters, please contact Unex’s designated product security contact using the address below.

FAQ

Q: Does a security-enabled module automatically make the end product CRA-compliant?

No. Security features at the module level may support, but do not by themselves establish, CRA conformity. Conformity of a complete product depends on the overall system, including host platform, software, interfaces, and intended use.

Q: Does this also cover the Radio Equipment Directive (RED)?

V2X modules are radio equipment and may be relevant to Delegated Regulation (EU) 2022/30. Applicability depends on the product’s intended use and the end product. This page is not a declaration of conformity.

Q: What is Unex’s role versus the customer’s role?

See “Roles and Responsibilities” above.

Q: How do I report a security vulnerability affecting a Unex product?

See “Report a Security Vulnerability” below.

Q: Which Unex products does this page relate to?

This page applies to Unex products generally. The current status by product is listed above and may be updated.

Report a Security Vulnerability

Have you identified a potential security vulnerability affecting a Unex product or software? Please send a report to the address below, where it will be received by Unex’s designated product security contact. Please provide the product, software version, vulnerability details, and steps to reproduce where available.

cra.compliance@unex.com.tw

Please do not include sensitive personal information that is not relevant to the security report.

This page is provided for general information only. It is not legal advice, a declaration of conformity, or a guarantee of compliance of any product.