Framework
Radio Equipment Directive – cybersecurity
Since 1 August 2025, connected radio equipment must protect the network and, depending on its functions, safeguard personal data and protect against fraud. Complass guides you to CE marking and carries your evidence over into the Cyber Resilience Act.
What is Radio Equipment Directive?
The Radio Equipment Directive 2014/53/EU (RED) sets the essential requirements that radio equipment on the EU market must meet. Since 1 August 2025, Delegated Regulation (EU) 2022/30 has made three of them binding: protection of the network (Art. 3(3)(d)), protection of personal data and privacy (point (e)) and protection from fraud (point (f)). From 11 December 2027 the Cyber Resilience Act takes over this role.
Content as of:
Does it apply to me?
Manufacturers, authorised representatives, importers and distributors of radio equipment that can itself communicate over the internet, directly or via other equipment, are affected. This also applies to machinery, controllers and devices with a built-in Wi-Fi, cellular or Bluetooth module. If they can process personal data, the data protection part applies in addition; for toys with a radio function, radio equipment for childcare and radio equipment worn on the body, it applies under this condition even without an internet connection, and for internet-connected equipment with a payment function, protection from fraud applies in addition.
Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027. For radio equipment placed on the market up to 10 December 2027, the requirements remain decisive and can be checked by market surveillance. After that, the cybersecurity requirements of the Cyber Resilience Act apply.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- Art. 2 REDArticle 2 RED Definitions1. For the purposes of this Directive, the following definitions apply: (1) ‘radio equipment’ means an electrical or electronic product, which intentionally emits and/or receives radio waves for the purpose of radio communication and/or radiodetermination, or an electrical or electronic product which must be completed with an accessory, such as antenna, so as to intentionally emit and/or receive radio waves for the …Open original (EUR-Lex – consolidated version of 30.05.2026) ↗Definition of radio equipment
- Art. 3 Abs. 3 REDArticle 3 RED Essential requirements1. Radio equipment shall be constructed so as to ensure: - (a) the protection of health and safety of persons and of domestic animals and the protection of property, including the objectives with respect to safety requirements set out in Directive 2014/35/EU, but with no voltage limit applying; - (b) an adequate level of electromagnetic compatibility as set out in Directive 2014/30/EU. 2. Radio equipment shall be so …Open original (EUR-Lex – consolidated version of 30.05.2026) ↗Essential requirements (d), (e), (f)
- Art. 1 DelVO (EU) 2022/30Article 1 Delegated Regulation (EU) 2022/301. The essential requirement set out in Article 3(3), point (d), of Directive 2014/53/EU shall apply to any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment (‘internet-connected radio equipment’). 2. The essential requirement set out in Article 3(3), point (e), of Directive 2014/53/EU shall apply to any of the following radio equipment, if …Open original (EUR-Lex – consolidated version of 27.10.2023) ↗Categories of radio equipment concerned
- Art. 2 DelVO (EU) 2022/30Article 2 Delegated Regulation (EU) 2022/301. By way of derogation from Article 1, the essential requirements set out in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU shall not apply to radio equipment to which either of the following Union legislation also applies: - (a) Regulation (EU) 2017/745; - (b) Regulation (EU) 2017/746. 2. By way of derogation from Article 1(2) and Article 1(3), the essential requirements set out in Article 3(3), …Open original (EUR-Lex – consolidated version of 27.10.2023) ↗Exclusions
- Art. 17 REDArticle 17 RED Conformity assessment procedures1. The manufacturer shall perform a conformity assessment of the radio equipment with a view to meeting the essential requirements set out in Article 3. The conformity assessment shall take into account all intended operating conditions and, for the essential requirement set out in point (a) of Article 3(1), the assessment shall also take into account the reasonably foreseeable conditions. Where the radio equipment …Open original (EUR-Lex – consolidated version of 30.05.2026) ↗Conformity assessment procedures
- DB (EU) 2025/138Annex Implementing Decision (EU) 2025/138In Annex I, the following rows are added:Open original (EUR-Lex – OJ L 2025/138, 30.1.2025) ↗EN 18031 with restrictions
Key dates
- Publication of Delegated Regulation (EU) 2022/30 in the Official Journal · OJ L 7, 12.1.2022Article 3 Delegated Regulation (EU) 2022/30This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 1 August 2025.Open original (EUR-Lex – consolidated version of 27.10.2023) ↗
- References of the harmonised standards EN 18031-1, -2 and -3:2024 published with restrictions · OJ L 2025/138, 30.1.2025; Art. 2 Implementing Decision (EU) 2025/138
- Date of application: Art. 3(3)(d), (e) and (f) RED apply to the radio equipment under Delegated Regulation (EU) 2022/30 · Art. 3 Delegated Regulation (EU) 2022/30Article 3 Delegated Regulation (EU) 2022/30This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 1 August 2025.Open original (EUR-Lex – consolidated version of 27.10.2023) ↗
- Entry into force of Delegated Regulation (EU) 2026/339, which repeals Delegated Regulation (EU) 2022/30 as of 11.12.2027 · Delegated Regulation (EU) 2026/339
- Reporting obligations under Art. 14 CRA apply, including for radio equipment with digital elements already placed on the market · Art. 71(2), Art. 69(3) CRAArticle 71 Cyber Resilience Act Entry into force and application1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2. This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
- Repeal of Delegated Regulation (EU) 2022/30; the CRA applies to newly placed radio equipment with digital elements · Art. 1 Delegated Regulation (EU) 2026/339, Art. 71(2) CRA
- Validity of existing EU-type examination certificates for cybersecurity under other Union law ends (subject to Art. 69(1) CRA) · Art. 69(1) CRAArticle 69 Cyber Resilience Act Transitional provisions1. EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to Union harmonisation legislation other than this Regulation shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred …Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027; from that day the Cyber Resilience Act applies in full.
How Complass helps
- 9phases
- 28guided steps
- 11document templates
- 41requirements in the catalogue
Guided RED project
Nine phases from classification as radio equipment through risk assessment and requirements (d), (e), (f) to the choice of procedure, CE marking and the transition to the CRA.
Catalogue Art. 3(3)(d), (e), (f)
Protection goals per requirement, restrictions of EN 18031 in the wording of the Official Journal and the obligations of economic operators, each with status and evidence.
Templates
Including classification and choice of procedure, risk assessment, security concept, check of the standard restrictions, update concept, technical documentation, EU declaration of conformity and mapping of RED to CRA Annex I.
The phases in the module
- Applicability, role and timeline
- Product, interfaces, configurations and assets to be protected
- Cybersecurity risk assessment
- Requirement d: protection of the network
- Requirement e: protection of personal data and privacy
- Requirement f: protection from fraud
- Harmonised standards, restrictions and conformity assessment procedures
- Technical documentation, EU declaration of conformity and CE marking
- Post-market obligations, supply chain and transition to the CRA
Catalogue: Requirements catalogue – Art. 3(3)(d), (e), (f) RED, restrictions of standards and formal obligations
Matching modules
Compliance management
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreVulnerability management
Find known vulnerabilities in your assets, prioritise them in context and work through them with recommendations and deadlines.
Learn moreAsset management
IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.
Learn moreFrequently asked questions
We build a radio module into our machine. Does the RED concern us?
As a rule, yes: the machine with a radio module is then itself radio equipment, and if it can communicate over the internet, the requirement on protection of the network applies. The Complass RED module helps you with the classification.
Is self-assessment with EN 18031 sufficient?
Only if you apply harmonised standards in full for all applicable essential requirements and none of the restrictions published in the Official Journal applies, for example because the user is allowed to skip setting or using a password when clauses 6.2.5.1 and 6.2.5.2 of EN 18031 are applied. Otherwise a notified body must be involved.
Is it still worth it if the CRA applies from December 2027?
Yes. Radio equipment placed on the market until then must meet the RED requirements, and the risk assessment, security concept and test reports can be carried over into your CRA project.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.