Repeal of the RED Delegated Act and the Transition to the CRA
On April 29, 2026, Commission Delegated Regulation (EU) 2026/339 was published in the Official Journal of the European Union. It repeals the RED Delegated Act (Commission Delegated Regulation (EU) 2022/30) with effect from December 11, 2027. That is the day the Cyber Resilience Act applies in full.
Contents
What happened?
On February 16, 2026, the European Commission adopted Delegated Regulation (EU) 2026/339, which repeals the delegated regulation under the Radio Equipment Directive (RED DA). It was published in the Official Journal of the European Union on April 29, 2026. It enters into force on the twentieth day after publication, but the repeal itself takes effect only on December 11, 2027.
With this, the Commission puts an orderly transition from the RED DA requirements to the CRA in place. The RED Delegated Act remains fully applicable until December 10, 2027. From December 11, 2027, the Cyber Resilience Act replaces it without a gap.
Why is the Commission repealing the RED Delegated Act?
The reason is regulatory consistency. Recital 3 of the repealing regulation refers to the essential cybersecurity requirements in Annex I of the Cyber Resilience Act. They include all elements of the essential requirements in Article 3(3), points (d), (e), and (f), of the RED. If both acts applied in parallel, the same protection goals would be addressed twice, with different assessment routes, harmonized standards, and conformity assessment procedures.
Recital 4 spells out the consequence. To ensure legal certainty and to prevent radio equipment from being subject to cybersecurity requirements under both the RED Delegated Act and the CRA at the same time, the RED Delegated Act is repealed with effect from the date on which the CRA applies in full.
What applies until December 11, 2027?
During the transition, the RED Delegated Act remains fully applicable. Manufacturers of radio equipment within the scope of Delegated Regulation 2022/30 must continue to meet the three protection goals of Article 3(3) of the Radio Equipment Directive:
- Point (d): protection from harm to the network or its functioning
- Point (e): protection of the personal data and privacy of the user and of the subscriber
- Point (f): protection from fraud
The harmonized EN 18031 series (parts 1, 2, and 3) puts these requirements into technical terms. It has provided the presumption of conformity since the delegated act started to apply on August 1, 2025. Manufacturers that place their products on the market before December 11, 2027, continue to assess and document them along this route.
Recital 5 matters here. The repeal does not affect market surveillance and compliance checks for radio equipment placed on the market between August 1, 2025, and December 10, 2027, that was subject to any of the requirements in Article 3(3), points (d), (e), and (f). For these products, the RED requirements remain the yardstick for market surveillance measures even after December 11, 2027.
What applies from December 11, 2027?
Once the Cyber Resilience Act applies, its Annex I and the related vulnerability handling requirements govern the cybersecurity of radio equipment with digital elements. The core assessment dimensions (network protection, data protection, fraud protection) remain in substance. They are, however, embedded in the wider CRA catalog of requirements. It also covers topics such as secure default settings, update mechanisms, the software bill of materials (SBOM), vulnerability handling, and reporting obligations.
The upcoming horizontal EN 40000 series takes over the technical side. EN 40000-1-4 in particular addresses the cybersecurity requirements that previously fell under the RED Delegated Act and EN 18031. Manufacturers of radio equipment with digital elements thus move to a new standards route. It builds conceptually on the existing EN 18031 structures but is embedded in the CRA conformity assessment regime.
What this means for manufacturers
If you are already working on EN 18031 compliance, the repealing regulation is no reason to stop your project. Until December 2027, EN 18031 is the only harmonized standard for the RED Delegated Act. If you do not apply it, or apply it only in part, you must involve a notified body (Article 17(4) of the RED). At the same time, it pays to look ahead. Much of the structure, artifacts, and processes you build for an EN 18031 assessment can be reused under EN 40000-1-4.
Take an NB-IoT sensor with a cloud connection used in facility management. Today, it is placed on the market under the RED and meets protection goals (d), (e), and (f) through an assessment against EN 18031-1 and EN 18031-2. From December 11, 2027, the same sensor falls under the CRA if it is placed on the market again or continues to be placed on the market unchanged. The cybersecurity requirements of Annex I of the CRA then apply, and you can demonstrate them using EN 40000-1-4. Units placed on the market before December 11, 2027, are subject to the CRA requirements only if they undergo a substantial modification from that date, but the reporting obligations under Article 14 of the CRA apply to them as well (Article 69(2) and (3) of the CRA). If a notified body has issued an EU type-examination certificate for the sensor under the RED Delegated Act, that certificate remains valid for the purposes of the CRA until it expires, but no later than June 11, 2028 (Article 69(1) of the CRA). According to the Commission guidance (C(2026) 5252, annex, paragraphs 251 to 254), you can rely on it until then as evidence of compliance for the risks it covers. You must still address any additional risks identified in your risk assessment under Article 13(2) of the CRA, such as vulnerability handling, in accordance with the CRA. The guidance is not binding, and according to the Commission it applies only once it has been formally adopted in all language versions.
From a product strategy perspective, this means that the investment you make for EN 18031 in vulnerability processes, cryptographic design, authentication logic, and secure default settings is not lost. It carries over to the CRA and finds its place in a wider catalog of requirements.
Frequently asked questions
Does the repeal mean my radio equipment no longer has to meet cybersecurity requirements?
No. The RED Delegated Act continues to apply unchanged until December 10, 2027. From December 11, 2027, the Cyber Resilience Act applies. Its Annex I fully covers the protection goals of Article 3(3), points (d), (e), and (f), of the RED and adds further cybersecurity requirements. There is no regulatory gap.
What happens to radio equipment placed on the market under EN 18031?
For radio equipment placed on the market between August 1, 2025, and December 10, 2027, the RED requirements continue to apply, even after Delegated Regulation 2022/30 is repealed. Market surveillance authorities can still check these products against the RED requirements.
Do I need a new conformity assessment for my radio product after December 11, 2027?
If the product is placed on the market for the first time after this date or undergoes a substantial modification, it needs a conformity assessment under the CRA. Article 69 of the CRA sets out the transitional provisions. You can rely on an EU type-examination certificate issued under the RED Delegated Act as evidence for the risks it covers until June 11, 2028, at the latest.
What is the difference between EN 18031 and EN 40000-1-4?
EN 18031 is the harmonized standards series under the RED Delegated Act. It addresses the protection goals of network protection, data protection, and fraud protection. EN 40000-1-4 is part of the upcoming horizontal EN 40000 series under the CRA. It covers the corresponding cybersecurity requirements for radio equipment with digital elements, embedded in the wider CRA catalog of requirements.
When does repealing regulation 2026/339 enter into force?
The regulation enters into force on the twentieth day after its publication in the Official Journal, which is May 19, 2026. The repeal itself takes effect only on December 11, 2027. Until then, the RED Delegated Act remains fully applicable.
