Cyber Resilience Act Response Center Request a demoDemo

Glossary Last updated

Radio Equipment Directive (RED)

If you sell devices with Wi-Fi, Bluetooth or mobile connectivity, you already know the RED. Its cybersecurity requirements are absorbed into the CRA in December 2027; certificates remain valid until June 2028.

The Radio Equipment Directive (RED) is the EU product legislation for devices that transmit or receive radio signals. Its cybersecurity requirements are set out in Delegated Regulation (EU) 2022/30 and are being replaced by the Cyber Resilience Act.

Definition in the Regulation

Delegated Regulation (EU) 2022/30 activates the cybersecurity requirements of Article 3(3)(d), (e) and (f) of the RED. It has applied since 1 August 2025. With Delegated Regulation (EU) 2026/339 of 16 February 2026, published on 29 April 2026, the Commission repeals Regulation 2022/30 with effect from 11 December 2027. The reasoning: the CRA requirements contain all the elements of the RED requirements, and double regulation is to be avoided. For radio equipment placed on the market between 1 August 2025 and 10 December 2027, market surveillance under the RED remains possible.

Article 69(1) CRA keeps EU type-examination certificates relating to cybersecurity requirements under other legislation valid until 11 June 2028, unless they expire earlier.

What it means for manufacturers

Until 10 December 2027, radio equipment must meet the requirements of Regulation 2022/30; from 11 December 2027, those of the CRA. A type-examination certificate under the RED is not evidence of CRA compliance: although it remains valid until June 2028, according to the Commission guidance C(2026) 5252 (paragraph 248) it covers only the risks addressed by the other legislation, and Annex I of the CRA goes further. The reporting obligation under Article 14 CRA has applied to radio equipment since 11 September 2026.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Learn more

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month per domain including VAT. Try it free for 30 days.

Try it free for 30 days