以資安實力驅動
— 全球市場准入
整合 網路韌性
建構一站式認證 Cybersecurity That Drives
Global Market Access —
Integrating Cyber Resilience
Into One-Stop Certification

安合規律結合 16 年的資安實績與 Applus+ 全球測試認證聯盟，旗下實驗室榮獲 DAkkS (德)、ENAC (西)、COFRAC (法) 與 CMA (中) 等國家級認可，提供涵蓋三大受監管領域的「一站式測試驗證與全球市場准入 (GMA)」取證服務：Backed by 16 years of cybersecurity expertise and our partnership with the Applus+ global testing & certification alliance — whose laboratories hold DAkkS (Germany), ENAC (Spain), COFRAC (France) and CMA (China) national accreditations — we deliver one-stop testing & Global Market Access (GMA) certification across three regulated domains:

• 資安實驗室：專攻 CE RED (EN 18031) 認證、CC (ISO/IEC 15408) 高階評估，並提前佈局歐盟網路韌性法案 (EU CRA)。Cybersecurity Lab: CE RED (EN 18031), CC (ISO/IEC 15408) high-assurance evaluations, and early readiness for the EU Cyber Resilience Act (CRA).
• 醫療器材認證：涵蓋主動/非主動醫材及醫療軟體 (SaMD)，提供直達 MDR (CE 標誌) 與美國 FDA 510(k) 的跨國雙軌取證，以及完整的醫材資安檢測。Medical Device Certification: Active/non-active devices and SaMD — dual-track certification to EU MDR (CE mark) and US FDA 510(k), plus comprehensive medical-device cybersecurity testing.
• 金融支付資安：由專家主導的高強度 PCI DSS v4.0 稽核、ASV 外部弱點掃描，並結合 Applus+ 的 EMVCo L1-L3 與 PCI PTS 終端安全評估。Payment Security: Expert-led PCI DSS v4.0 audits, ASV external vulnerability scanning, plus Applus+ EMVCo L1–L3 and PCI PTS terminal security evaluations.

我們深知取證時程對醫療器材上市的重要性。安合規律透過聯盟 Applus+ 擁有的歐盟雙公告機構（Notified Body, NB 2764 / NB 3121）資源，能為客戶直接主導審查。這種雙 NB 架構提供了高效的分流與備援機制，能有效突破目前市場上 MDR 取證塞車的困境，協助製造商以最快路徑進入歐美市場。We understand how critical certification timelines are for medical-device launches. Through our Applus+ alliance, we have direct access to two EU Notified Bodies (NB 2764 / NB 3121) and lead reviews ourselves. This dual-NB structure provides an efficient routing & redundancy mechanism, helping manufacturers cut through MDR backlogs and reach EU & US markets via the fastest possible path.

歐盟 CRA 將於 2026 年底至 2027 年全面實施，涵蓋所有含數位元件的軟硬體產品。我們建議企業應盡早導入「資安韌性符合性」評估。安合規律的 ISO 17025 資安實驗室能協助您提前佈局，提供符合國際標準（如 prEN 40000 系列、EN 304 6xx 系列）的深度技術檢測，包含威脅建模、SBOM（軟體物料清單）建置與漏洞滲透測試，確保您的產品生命週期無縫接軌新法規。EU CRA enters full enforcement between late 2026 and 2027, covering all hardware & software products with digital elements. We recommend onboarding cyber-resilience conformity assessment as early as possible. Our ISO 17025-accredited cybersecurity lab provides deep technical testing aligned with international standards (e.g. prEN 40000 series, EN 304 6xx series) — including threat modeling, SBOM construction and penetration testing — so your product lifecycle aligns seamlessly with the new regulation.

有的。我們獨家開發了 GMA+ 全球市場准入合規管理平台 (SaaS)，專為解決繁瑣的跨國行政摩擦而生。該平台能將 EU CRA、MDR、FDA 及 PCI DSS 等多國標準集中管理，提供：Yes. We've built the GMA+ Global Market Access Compliance Platform (SaaS), designed specifically to eliminate cross-border administrative friction. The platform centralizes management of EU CRA, MDR, FDA, PCI DSS and other multi-country standards, offering:

• 法規落差分析 (Gap Analysis)：內建 ISO 13485 (212 條) 與 PCI DSS v4.0 (310 項) 完整條文樹，並與 IEC 81001-5-1、prEN 40000 (CRA) 等標準雙向對照，一鍵切換檢視。Gap Analysis: built-in ISO 13485 (212 clauses) and PCI DSS v4.0 (310 items) requirement trees, cross-mapped to IEC 81001-5-1 and prEN 40000 (CRA) — switch perspectives with one click.
• FDA 21 CFR Part 11 電子簽章：密碼 + 雙因素驗證雙重簽核；簽章一經完成即永久封存，後續修改全程留痕，符合 FDA 對電子記錄與電子簽章的法規要求。FDA 21 CFR Part 11 e-signature: dual confirmation with password + two-factor (2FA). Once signed, records are permanently sealed and any later change is captured in the audit trail — meeting FDA electronic records / signatures requirements.
• 文件自動化：受監理機關接受的 Word + PDF 模板自動套版，產出 DoC、CoC、Notified Body 送件封包與內部稽核報告，省下大量手工拼湊與排版時間。Document Automation: regulator-accepted Word + PDF templates auto-populate from project data, producing Declaration of Conformity, Certificate of Conformity, Notified Body packages and internal audit reports — no manual assembly.
• 協同送件：客戶端、實驗室與 Notified Body 三方共用同一個平台；@提及對方會立即發出站內與 email 通知，平均縮短 6 週送件往返時間。Collaborative Submission: clients, lab and Notified Body share one platform. @mentions push instant in-app and email notifications — cutting submission turnaround by an average of 6 weeks.

我們提供從硬體終端到軟體收款的端對端測試取證服務，協助企業打造無懈可擊的支付生態圈資安防護。服務涵蓋：We provide end-to-end testing & certification from hardware terminals to software-based acceptance, helping enterprises build airtight cybersecurity across the payment ecosystem. Coverage includes:

• PCI DSS 與 3DS：企業支付環境網路合規與電商交易防欺詐驗證。PCI DSS & 3DS: enterprise payment-environment compliance and e-commerce anti-fraud verification.
• PCI PTS 與 PIN Security：實體刷卡機防篡改、韌體安全及密碼高強度邏輯評估。PCI PTS & PIN Security: physical POS tamper-resistance, firmware security and high-strength PIN logic assessment.
• MPoC：針對商用手機 (COTS) 轉收款終端的軟體資安檢測。MPoC: software security assessment for commercial-off-the-shelf (COTS) phones used as payment terminals.
• PCI ASV：符合官方要求的季度外部弱點掃描服務。PCI ASV: approved quarterly external vulnerability scanning meeting official PCI DSS requirements.

如果您是剛接觸跨國認證領域的新手，可以快速了解以下四個核心名詞：If you're new to cross-border certification, here's a quick primer on four core terms:

• NB (Notified Body) 公告機構：這是歐盟國家政府授權的第三方獨立審查機構（如 Applus+ 的 NB 2764 / 3121）。產品必須通過他們的嚴格審核，才能獲得 CE 標誌並在歐洲合法販售。NB (Notified Body): an independent third-party review body authorized by EU national governments (e.g. Applus+ NB 2764 / 3121). Products must pass their rigorous review to receive the CE mark and be legally sold in Europe.
• CRA (Cyber Resilience Act) 網路韌性法案：歐盟最新的強制性資安法規。未來只要是「連網」或「帶有數位元件」的產品（如路由器、智慧家電、連網醫材），都必須證明其具備防禦駭客攻擊的能力才能上市。CRA (Cyber Resilience Act): the EU's latest mandatory cybersecurity regulation. Any "connected" product or product with "digital elements" (routers, smart appliances, connected medical devices, etc.) must demonstrate cyber-attack resistance before going to market.
• SBOM (Software Bill of Materials) 軟體物料清單：就像食品包裝上的「成分表」。它詳細記錄了產品軟體中使用了哪些開源程式碼或第三方套件，能幫助查明產品是否含有已知的資安漏洞。SBOM (Software Bill of Materials): like the ingredient list on a food package — it details every open-source component or third-party library used in a product's software, helping identify whether known vulnerabilities are present.
• GMA (Global Market Access) 全球市場准入：產品要賣到世界各國，必須符合當地的電氣、資安、環保等法規。GMA 服務就是幫助企業一站式取得多國認證（如美國 FDA、歐盟 CE），順利「通關」進入全球市場。GMA (Global Market Access): selling worldwide means meeting each country's electrical, cybersecurity and environmental rules. GMA service helps enterprises secure multi-country certifications (US FDA, EU CE, etc.) in one place to clear customs into global markets.

歐盟針對舊版 MDD 醫療器材確實設有 MDR 過渡機制，但並非所有 MDD 證書都能自動延長。根據 EU 2023/607 修正案，過渡期限依產品風險等級區分如下：The EU does provide an MDR transition mechanism for legacy MDD devices, but not all MDD certificates are automatically extended. Under the EU 2023/607 amendment, deadlines vary by product risk class:

• Class III 與 implantable Class IIb：可延長至 2027 年 12 月 31 日Class III & implantable Class IIb: extended until 31 December 2027
• Class IIb（非植入式）、Class IIa 與部分 Class I：可延長至 2028 年 12 月 31 日Non-implantable Class IIb, Class IIa & certain Class I: extended until 31 December 2028

截至目前，只有已於 2024 年完成 MDR 過渡條件的製造商，才能持續適用上述展延期限，包括：As of now, only manufacturers who completed the MDR transition prerequisites by 2024 can benefit from these extensions, including:

• 已向公告機構（NB）提交正式 MDR 申請Having submitted a formal MDR application to a Notified Body (NB)
• 已與 NB 完成簽約（Signed Agreement）Having a signed agreement with the NB

此外，製造商仍需持續符合 MDD 要求，且產品不得發生重大設計變更（Significant Changes）。In addition, manufacturers must continue to comply with MDD requirements, and products must not undergo significant design changes.

近年公告機構對於資訊安全（Cybersecurity）與軟體生命週期文件的要求明顯提高，特別是連網設備與軟體型醫材（SaMD）。實務上，許多專案會在以下項目延長審查時間：In recent years, Notified Bodies have significantly raised cybersecurity and software lifecycle documentation requirements, especially for connected devices and SaMD. In practice, reviews often take longer on:

• 軟體生命週期文件（IEC 62304）Software lifecycle documentation (IEC 62304)
• 漏洞管理流程Vulnerability management processes
• SBOM（Software Bill of Materials）SBOM (Software Bill of Materials)
• PMS / PMCF 文件完整性PMS / PMCF documentation completeness
• MDR Annex I（GSPR）符合性證據MDR Annex I (GSPR) conformity evidence

因此，建議在 MDR 轉換前先進行 Gap Analysis，提早補強技術文件與資安治理機制，以降低審查風險並縮短轉換週期。We therefore recommend conducting a Gap Analysis before MDR transition — strengthening technical documentation and cybersecurity governance early to reduce review risk and shorten the conversion timeline.

AI 醫療軟體（SaMD）的認證核心，除了臨床安全與有效性外，也高度重視軟體驗證（Software Validation）與資訊安全（Cybersecurity）。For AI medical software (SaMD), certification focuses not only on clinical safety and efficacy, but also heavily on Software Validation and Cybersecurity.

【歐盟 CE mark（MDR）】[EU CE mark (MDR)]

依據 MDR Rule 11，多數 AI SaMD 會被歸類為 Class IIa 以上風險等級，因此通常需要公告機構（NB）介入審查。常見重點包括：Under MDR Rule 11, most AI SaMD are classified as Class IIa or higher, typically requiring Notified Body (NB) review. Key areas include:

• IEC 62304 軟體生命週期管理IEC 62304 software lifecycle management
• ISO 14971 風險管理ISO 14971 risk management
• 臨床評估（Clinical Evaluation）Clinical Evaluation
• AI 模型驗證與性能證據AI model validation and performance evidence
• 資安風險分析與漏洞管理機制Cybersecurity risk analysis and vulnerability management

【美國 FDA 510(k)】[US FDA 510(k)]

FDA 近年大幅提高對醫療資安的要求，特別是具連網能力（Cyber Device）的醫材。若 submission 缺少必要的 cybersecurity documentation，例如：The FDA has significantly raised cybersecurity requirements in recent years, especially for connected medical devices (Cyber Devices). Submissions missing essential cybersecurity documentation may face delays or rejection, including:

• SBOM（Software Bill of Materials）SBOM (Software Bill of Materials)
• Threat ModelingThreat Modeling
• Vulnerability Management ProcessVulnerability Management Process
• Secure Update MechanismSecure Update Mechanism

可能導致 RTA（Refuse To Accept）或延長審查時程。These gaps may result in RTA (Refuse To Accept) or extended review timelines.

因此，建議在產品開發初期即導入 secure SDLC、安全設計（Secure by Design）與 SBOM 管理機制，並參考 IEC 81001-5-1 等醫療資安框架，以降低後續 CE mark 與 FDA 審查風險。We recommend integrating secure SDLC, Secure by Design principles, and SBOM management from early product development, referencing frameworks like IEC 81001-5-1 to reduce CE mark and FDA review risks.

隨著歐盟強化產品資安監管，連網醫療器材未來除了 MDR（Medical Device Regulation）外，也可能受到 EU CRA（Cyber Resilience Act）等法規要求影響。兩者關注面向有所不同：As the EU strengthens product cybersecurity regulation, connected medical devices will need to comply not only with MDR but also potentially with the EU CRA. The two regulations focus on different aspects:

• MDR：聚焦於患者安全、臨床風險與產品有效性MDR: focuses on patient safety, clinical risk, and product efficacy
• CRA：聚焦於產品資安韌性（Cyber Resilience）、漏洞管理與 Secure by DesignCRA: focuses on Cyber Resilience, vulnerability management, and Secure by Design

雖然 CRA 與 MDR 之間存在部分重疊與特別法優先原則（lex specialis）協調機制，但對於具數位元素的連網醫材而言，製造商仍需建立完整的資安治理能力，包括：Although there is some overlap and a lex specialis coordination mechanism between the CRA and MDR, manufacturers of connected devices with digital elements still need comprehensive cybersecurity governance, including:

• SBOM 管理SBOM management
• 漏洞處理流程 Vulnerability Handling ProcessVulnerability Handling Process
• 安全更新機制Secure Update Mechanism
• 協同漏洞揭露 Coordinated Vulnerability Disclosure（CVD）Coordinated Vulnerability Disclosure (CVD)
• 上市後監控 Post-Market MonitoringPost-Market Monitoring

若分別建立 MDR 與 CRA 文件，往往會增加大量重工與維護成本。較有效的策略，是建立統一的「Cybersecurity & Compliance Framework」，將 CRA 所需的漏洞管理與資安監控資料，整合至 MDR 的上市後監視 Post-Market Surveillance（PMS）/ 上市後臨床追蹤 Post-Market Clinical Follow-up（PMCF）流程中。Building separate MDR and CRA documentation often leads to significant rework and maintenance costs. A more effective strategy is to establish a unified "Cybersecurity & Compliance Framework," integrating CRA-required vulnerability management and cybersecurity monitoring into the MDR Post-Market Surveillance (PMS) / Post-Market Clinical Follow-up (PMCF) workflow.

這類整合方式除了有助降低重複作業，也能提升未來面對公告機構（NB）、主管機關與供應鏈客戶稽核時的可追溯性與維運效率。This integrated approach not only reduces duplication but also improves traceability and operational efficiency for future audits by Notified Bodies, regulatory authorities, and supply-chain clients.