Cybersecurity & Data Protection Laws
Essential cybersecurity requirements now mandatory (Articles 3.3(d), (e), (f))
Enforcement date—already in effect
CRA transition date—RED cybersecurity repealed, CRA takes over
The Radio Equipment Directive is the EU's market access framework for radio equipment. Delegated Regulation (EU) 2022/30 activated three cybersecurity essential requirements—Articles 3.3(d), (e), and (f)—making network protection, personal data privacy, and fraud prevention mandatory for internet-connected radio devices.
Since August 1, 2025, all wireless products placed on the EU market must demonstrate cybersecurity conformity against harmonised standards EN 18031-1, EN 18031-2, and EN 18031-3. Products that fail to comply cannot carry CE marking and are blocked from the EU market. The requirements apply to any radio equipment that communicates over the internet directly or through another device.
RED cybersecurity compliance requires component-level security attestations from suppliers—covering authentication mechanisms, default credential policies, encryption, secure update processes, and vulnerability handling. When restricted clauses in EN 18031 are triggered, Notified Body involvement becomes mandatory.
Key Components / Sub-Frameworks
Manufacturers of internet-connected radio equipment placed on the EU market
Importers placing radio equipment with digital connectivity on the EU market
Distributors making in-scope radio equipment available in the EU
Non-EU companies selling through EU importers or authorized representatives
Companies integrating radio modules into finished products (end-product responsibility)
OEMs using third-party wireless modules in consumer or industrial devices
Key Thresholds
You follow EN 18031 for self-assessment—but your product allows users to skip password setup. That single design choice triggers a restricted clause, voids your presumption of conformity, and forces Notified Body involvement. Without systematic tracking of restricted clause applicability across your product portfolio, you discover the gap during market surveillance—not during design.
RED cybersecurity is mandatory now. CRA replaces it on December 11, 2027. Your product roadmap spans both timelines. Products placed on the market before December 2027 remain under RED surveillance. Products placed after must meet CRA requirements. Without a unified compliance evidence management system, you're maintaining two parallel conformity programs.
EN 18031 certification applies to the finished product, not individual modules. Your supplier's pre-certified Wi-Fi module supports RED compliance—but doesn't replace it. The end-product manufacturer bears full responsibility. If your supplier's security attestation doesn't cover restricted clauses, your conformity assessment fails.
You need security attestations from every supplier providing radio modules, firmware, or connected components. Supplier 1 provides a generic cybersecurity statement. Supplier 2 has no EN 18031 mapping. Supplier 3 references ETSI EN 303 645 instead of EN 18031. None of the evidence maps cleanly to your Declaration of Conformity.
Certivo In Action
Certivo in Action — RED Cybersecurity Workflow
From Manual Evidence Assembly to Automated Conformity Documentation
CORA collects, parses, and validates supplier cybersecurity attestations automatically. Your team focuses on restricted clause decisions and conformity pathway routing—not chasing security PDFs from module suppliers.
Conformity Documentation Acceleration
Generate complete, audit-ready RED cybersecurity technical files in hours—not the weeks of manual compilation across suppliers, test labs, and engineering teams.
Continuous RED Compliance Monitoring
When product designs or supplier attestations trigger EN 18031 restricted clauses, Certivo flags the Notified Body pathway instantly. Know your conformity route before market surveillance does.
Key Statistics
Frequently Asked Questions
What products are in scope for RED cybersecurity requirements?
Any radio equipment that communicates over the internet—directly or via another device—is in scope for Article 3.3(d). Equipment processing personal, traffic, or location data must also meet Article 3.3(e). Devices enabling monetary or virtual currency transfers must meet Article 3.3(f). This includes smartphones, IoT devices, smart home products, wearables, baby monitors, routers, industrial sensors, and connected toys. Certivo helps manufacturers classify their product portfolios and identify applicable EN 18031 standards.
What are the penalties for RED cybersecurity non-compliance?
Penalties are set by each EU member state and must be effective, proportionate, and dissuasive. Market surveillance authorities can remove non-compliant products from sale, order recalls, or block products at EU borders. Products without valid CE marking covering cybersecurity requirements cannot legally be placed on the EU market. Where security flaws lead to data breaches, related GDPR penalties of up to €20 million or 4% of global turnover may also apply.
How does RED cybersecurity conformity assessment work?
Manufacturers can self-assess against harmonised standards EN 18031-1, -2, and -3 if no restricted clauses are triggered. If restricted clauses apply—such as allowing users to skip password setup—a Notified Body assessment is mandatory. Products not following harmonised standards in full also require Notified Body involvement. CORA automatically detects restricted clause triggers across your portfolio and routes each product to the correct conformity pathway.
How does Certivo handle the RED-to-CRA transition?
RED cybersecurity provisions are repealed on December 11, 2027, when the Cyber Resilience Act takes full effect. Products placed on the market between August 2025 and December 2027 remain under RED surveillance. Certivo maintains parallel conformity tracking for both frameworks, maps existing RED evidence to CRA essential requirements, and identifies gaps requiring additional supplier evidence—so your transition is seamless, not a second compliance project.
How does RED cybersecurity relate to other EU product compliance frameworks?
RED cybersecurity is one layer of CE marking for radio equipment alongside safety, EMC, and radio spectrum requirements. It overlaps with the Cyber Resilience Act (which replaces it in 2027), intersects with GDPR for personal data protection, and relates to ETSI EN 303 645 for consumer IoT. Certivo validates supplier evidence across all applicable frameworks from a single submission, eliminating duplicate collection campaigns.