Radio Equipment Directive — cybersecurity
Since 1 August 2025 internet-connected radio equipment must protect networks and personal data and guard against fraud — until the CRA takes over on 11 December 2027.
- Reference
- Delegated Regulation (EU) 2022/30 · EN 18031
- Status
- Applies
- Sources last checked
What it is
Delegated Regulation (EU) 2022/30 activated the cybersecurity essential requirements of Article 3(3)(d), (e) and (f) of the Radio Equipment Directive 2014/53/EU. The harmonised standards EN 18031-1/-2/-3 were cited in the Official Journal in January 2025 — with restrictions. In February 2026 the Commission adopted Delegated Regulation (EU) 2026/339, which repeals these rules with effect from 11 December 2027, when the CRA applies.
Who is affected
Manufacturers, importers and distributors of radio equipment that can communicate over the internet directly or via other equipment (Wi-Fi, Bluetooth, cellular, LoRa, Zigbee …); of wearables, toys and childcare radio equipment that process personal data (even without internet connection); and of internet-connected radio equipment enabling transfers of money or virtual currency.
What you have to do
- Check whether Article 3(3)(d), (e) or (f) applies to each radio product — “internet-connected” includes connection via a hub or a phone.
- Demonstrate compliance with EN 18031 or other evidence; where a restriction published with the standards’ listing in the Official Journal applies (e.g. the user may choose not to set a password), self-declaration is not enough — a notified body is needed.
- Importers: ensure the conformity assessment was carried out and the EU declaration of conformity covers Article 3(3)(d)–(f); good practice: check that the test evidence matches the firmware actually shipped.
Fact check
Not correct “The RED cyber rules end in 2027, so we can ignore them.”
They apply to every product placed on the market before 11 December 2027, and market surveillance can still act on those products afterwards.
Not correct “Bluetooth-only devices are not internet-connected.”
If the device can communicate over the internet via another device — e.g. a phone app or a gateway — it can be in scope.
Partly correct “A CE mark on a radio module covers the finished device.”
A compliant module helps, but the product placed on the market is assessed as a whole — including its software, interfaces and default settings.
Sources
- Delegated Regulation (EU) 2022/30 — Official Journal text (opens external website) ↗
- Radio Equipment Directive (RED) — incl. repeal by (EU) 2026/339 (opens external website) ↗
- Directive 2014/53/EU (Radio Equipment Directive) — Official Journal text (opens external website) ↗
General information, not legal advice. Authentic are only the texts published in the Official Journal of the EU and the Austrian Federal Law Gazette.
Not sure where your product stands?
Send us the product and its documents. We check the technical file against the rules on this radar and tell you what is missing — and source an EU-ready alternative if needed.