Radio Equipment Directive Cybersecurity Requirements
The Radio Equipment Directive (Directive 2014/53/EU), or RED, sets the requirements for radio equipment placed on the market in the European Union. It lays down the essential requirements for safety, health, electromagnetic compatibility, and the efficient use of the radio spectrum. Commission Delegated Regulation (EU) 2022/30, the RED Delegated Act, activates the cybersecurity requirements in Article 3(3), points (d), (e), and (f), of the RED for certain categories of equipment. These requirements have applied since August 1, 2025. The harmonized standards of the EN 18031 series put them into technical terms.
Contents
Scope of the RED
The RED covers “radio equipment”: electrical or electronic products that intentionally emit or receive radio waves, or both, for the purpose of radio communication or radiodetermination. Examples include mobile phones, Wi-Fi routers, radio remote controls, and many more.
Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 specifies the essential requirements of the RED for internet-connected radio equipment. This means any radio equipment that can itself communicate over the internet, whether directly or via other equipment.
The simplified flowchart below shows how to decide whether a product must meet the requirements of the delegated regulation.
First, determine whether the product falls within the scope of the RED. If it does, check whether it can access the internet on its own. If it cannot, check whether it uses internet protocols or can communicate with the internet indirectly via another device. If so, the product must conform to the delegated regulation. If not, point (d) requires no action. The flowchart covers only the requirement in Article 3(3), point (d). For point (e) (protection of personal data) and point (f) (protection from fraud), check separately whether the product processes personal data or enables payments. Radio equipment for childcare, toys, and wearable radio equipment fall under point (e) if they process personal data, even without an internet connection (Article 1(2) of Delegated Regulation (EU) 2022/30).
In practice, it is often unclear whether a product falls under the delegated regulation, especially when it connects to the internet indirectly. If you want to clarify this for your radio equipment, a short call can help.
Essential requirements
Article 3 of the Radio Equipment Directive (Directive 2014/53/EU) defines the essential requirements for radio equipment. Delegated Regulation (EU) 2022/30 activates the cybersecurity requirements in Article 3(3) for internet-connected radio equipment.
For cybersecurity, Article 3(3), points (d), (e), and (f), matter most:
- Network protection, Article 3(3)(d): Radio equipment must not harm the network or its functioning, nor misuse network resources. EN 18031-1 puts this requirement into technical terms.
- Data protection and privacy, Article 3(3)(e): Radio equipment must incorporate safeguards to protect the personal data and privacy of the user and the subscriber. EN 18031-2 covers this requirement.
- Protection from fraud, Article 3(3)(f): Radio equipment must support features that protect against fraud, in particular when paid services are used. EN 18031-3 covers this requirement.
How the RED relates to the Cyber Resilience Act
The Cyber Resilience Act (CRA) replaces the RED Delegated Act for cybersecurity. With Commission Delegated Regulation (EU) 2026/339 of February 16, 2026, the Commission formally repealed Delegated Regulation 2022/30 with effect from December 11, 2027, the day the CRA applies in full. The reason given is regulatory consistency. As Recital 3 of the repealing regulation states, Annex I of the CRA includes all the elements of the essential requirements in Article 3(3), points (d), (e), and (f), of the RED. If both acts applied in parallel, the same protection goals would be addressed twice.
For manufacturers, this means a clearly defined transition in two phases:
- Until December 10, 2027: The RED Delegated Act remains fully applicable. Conformity assessment is based on the harmonized EN 18031 series.
- From December 11, 2027: Radio equipment with digital elements falls under the CRA. Annex I of the CRA and the upcoming horizontal standard EN 40000-1-4 replace the RED Delegated Act route.
This matters for market surveillance. Under Recital 5 of the repealing regulation, the RED requirements remain the yardstick for radio equipment placed on the market between August 1, 2025, and December 10, 2027, even after the repeal. Market surveillance authorities can still check these products against the RED Delegated Act and EN 18031.
Our article on the repeal of the RED Delegated Act covers the repeal and the transition in detail. For background on the CRA itself, see our page on the Cyber Resilience Act.
The CRA noticeably changes the framework for radio equipment. How do the RED, its delegated act, and the CRA relate to each other, and which requirements will remain relevant? We are happy to discuss this with you in a no-obligation call.
Conformity assessment
The RED provides three conformity assessment modules. Manufacturers choose between them depending on their situation:
- Module A, internal production control: Possible if harmonized standards exist, their references are published in the Official Journal of the EU, and you apply them in full. You assess conformity on your own responsibility; no notified body is needed.
- Module B+C, EU-type examination followed by conformity to type: A notified body examines the type, and you ensure that series production matches the examined type. Required if no harmonized standards exist or you do not apply them in full.
- Module H, full quality assurance: A complete quality assurance system under the supervision of a notified body.
Since EN 18031 was published in the Official Journal, module A is available for the first time for the cybersecurity requirements in Article 3(3), points (d), (e), and (f). Manufacturers that do not apply EN 18031, or apply it only in part, must still involve a notified body.
Harmonized standards for the delegated regulation
Based on the European Commission's standardization request, a separate harmonized standard was developed for each of the three protection goals in Article 3(3), points (d), (e), and (f). The result is the EN 18031 series. Its references have been published in the Official Journal of the EU since January 30, 2025 (Commission Implementing Decision (EU) 2025/138). Since the delegated regulation started to apply on August 1, 2025, the standards have given a presumption of conformity, in some cases with restrictions. EN 18031 implements the requirements for the standards: state of the art, proportionality to the risk, and verifiable and reproducible test methods.
EN 18031: standards for the delegated act
EN 18031 is the harmonized series of standards that puts the cybersecurity requirements of Regulation 2022/30 into technical terms. It has three parts, each addressing one of the protection goals in Article 3(3) of the RED:
- EN 18031-1: Requirements for internet-connected radio equipment. Addresses Article 3(3)(d), network protection.
- EN 18031-2: Requirements for radio equipment that processes personal data or traffic and location data. Addresses Article 3(3)(e), data protection and privacy.
- EN 18031-3: Requirements for radio equipment that enables the transfer of money, monetary value, or virtual currency. Addresses Article 3(3)(f), protection from fraud.
The references of the three parts have been in the Official Journal of the EU since January 30, 2025. They have given a presumption of conformity since August 1, 2025. With the repeal of the RED Delegated Act on December 11, 2027, EN 40000-1-4 under the CRA will take over from EN 18031 in the following years. EN 40000-1-4 builds on the structure of EN 18031, so part of the work you have put into EN 18031 compliance remains usable. It does not replace an assessment against EN 40000-1-4.
Market surveillance and reporting channels
Since the cybersecurity requirements of the RED Delegated Act started to apply on August 1, 2025, market surveillance can also check cybersecurity requirements. Under Recital 5 of repealing Regulation 2026/339, this power remains after the repeal of Regulation 2022/30. It covers products placed on the market under the RED Delegated Act until December 10, 2027.
Suspected cases of non-compliant radio equipment can be reported to the national market surveillance authority responsible for radio equipment, for example by email. The report should identify the product, describe the suspected non-compliance, and state when the product was placed on the market. In Germany, for example, this is the Federal Network Agency (BNetzA). Relevant proceedings may become visible in the European ICSMS system.
Current situation in practice
ICSMS has listed the first cases since August 2025, but so far only with formal findings, such as a missing marking. National authorities do not necessarily publish their proceedings. Germany's BNetzA, for example, states on request that ongoing proceedings are generally not published and that it communicates publicly only in “last resort” cases, such as planned market restrictions. The absence of visible cybersecurity cases therefore does not necessarily mean that no checks are taking place.
The RED, its delegated act, and EN 18031 set specific requirements for the development, assessment, and market surveillance of radio equipment. If you want to understand which of them apply to your products and which next steps make sense, we can work this out in a no-obligation call.