Complass
Radio Equipment Directive: cybersecurity for connected radio equipment until the CRA
A charger with an app, a machine with a cellular modem, a toy with Bluetooth: since August 2025, cybersecurity requirements apply to all of them. What the Radio Equipment Directive requires, why self-assessment is often not enough and what changes from December 2027.
Since 1 August 2025, radio equipment that communicates over the internet must protect the network and, depending on its functions, safeguard personal data and protect against fraud (Art. 3(3)(d), (e), (f) RED, Delegated Regulation (EU) 2022/30). This also applies to machinery and devices with a built-in radio module.
The whitepaper explains who is in scope, what the three requirements mean, why the restrictions of EN 18031 in the Official Journal often require a notified body, what the technical documentation and declaration of conformity look like and how to carry your evidence over into the Cyber Resilience Act, which takes over from 11 December 2027 – with a ten-step plan and a checklist.
Each obligation chapter includes a short "Implementation in Complass" box; only features already live are named.
14 pages · Version 1.0 · as of 06.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.