PPWR becomes enforceable in 14 days

Get ready with Certivo's PPWR Starter Package.

Radio Equipment Directive – Cybersecurity (EU RED) Compliance

Cybersecurity & Data Protection Laws

Radio Equipment Directive 2014/53/EU — Delegated Regulation (EU) 2022/30 (Articles 3.3(d), (e), (f))

Every Wireless Product on the EU Market Now Requires Cybersecurity Conformity. Can You Prove It?

RED cybersecurity compliance has been mandatory since August 1, 2025. Every internet-connected radio device placed on the EU market must meet EN 18031 standards for network protection, data privacy, and fraud prevention—or lose CE marking eligibility. Non-compliant products cannot legally be sold.

Certivo automates RED cybersecurity evidence collection from supplier security attestations to audit-ready conformity documentation.

Regulation Overview

Jurisdiction

European Union / European Economic Area

Regulatory Body

European Commission / National Market Surveillance Authorities

Regulation Number

Directive 2014/53/EU; Delegated Regulation (EU) 2022/30; Implementing Decision (EU) 2025/138

Effective Date

Mandatory from August 1, 2025 (repealed December 11, 2027, when CRA takes over)

Official Source

Radio Equipment Directive Source

Key Threshold

All internet-connected radio equipment placed on the EU market.

What is RED Cybersecurity?

The Radio Equipment Directive is the EU's market access framework for radio equipment. Delegated Regulation (EU) 2022/30 activated three cybersecurity essential requirements—Articles 3.3(d), (e), and (f)—making network protection, personal data privacy, and fraud prevention mandatory for internet-connected radio devices.

Since August 1, 2025, all wireless products placed on the EU market must demonstrate cybersecurity conformity against harmonized standards EN 18031-1, EN 18031-2, and EN 18031-3. Products that fail to comply cannot carry CE marking and are blocked from the EU market. The requirements apply to any radio equipment that communicates over the internet directly or through another device.

Key Components / Sub-Frameworks

• Obligation: Radio equipment must not harm networks or misuse resources, causing degradation of service

  • Article 3.3(d) - Network protection

• Obligation: Radio equipment must incorporate safeguards for personal data, traffic data, and location data

  • Article 3.3(e) - Privacy and data protection

• Obligation: Radio equipment enabling monetary or virtual currency transfers must prevent fraud

  • Article 3.3(f) - Fraud prevention

Key Compliance Requirements

Who Must Comply

• Manufacturers of internet-connected radio equipment placed on the EU market
• Importers placing radio equipment with digital connectivity on the EU market
• Distributors making in-scope radio equipment available in the EU
• Non-EU companies selling through EU importers or authorized representatives
• Companies integrating radio modules into finished products (end-product responsibility)
• OEMs using third-party wireless modules in consumer or industrial devices

Key Thresholds

• Internet connectivity: Any radio equipment communicating over the internet directly or via another device.
• Personal data processing: Equipment processing personal, traffic, or location data triggers Article 3.3(e).
• Financial transactions: Equipment enabling money or virtual currency transfers triggers Article 3.3(f).
• Restricted clauses: Triggers requiring Notified Body assessment.

Core Obligations

1. Cybersecurity Conformity
   • Deadline: Mandatory since August 1, 2025
2. CE Marking
   • Deadline: Required for EU market placement
3. Technical Documentation
   • Deadline: Available for market surveillance on request
4. Declaration of Conformity
   • Deadline: At time of market placement
5. CRA Transition
   • Deadline: December 11, 2027

Frequently Asked Questions

• What products are in scope for RED cybersecurity requirements?
  Any radio equipment that communicates over the internet—directly or via another device—is in scope for Article 3.3(d).
• What are the penalties for RED cybersecurity non-compliance?
  Penalties are set by each EU member state and market surveillance authorities can remove non-compliant products from sale.
• How does RED cybersecurity conformity assessment work?
  Manufacturers can self-assess against EN 18031 standards if no restricted clauses are triggered.
• How does Certivo handle the RED-to-CRA transition?
  Certivo maintains parallel conformity tracking for both frameworks and maps existing RED evidence to CRA requirements.

Key Statistics

• 99.2% Supplier attestation extraction accuracy
• 95% Supplier response rate with CORA-powered campaigns

Ready to Automate RED Cybersecurity Compliance?

See how Certivo's product compliance platform transforms RED cybersecurity evidence management into continuous conformity assurance.