Three dates frame everything here. The RED’s cybersecurity rules went live last summer, on 1 August 2025. The Commission then published the act repealing them on 29 April 2026. That repeal takes effect on 11 December 2027, when the Cyber Resilience Act (CRA) takes over.
That sounds like the problem is going away. It isn’t. Under EU RED, anything you place on the market before December 2027 stays under the old rules, and market surveillance authorities can still check it afterwards.
So this guide covers what applies to you right now under the EU RED Directive. You’ll see which products are caught, which standards give you a shortcut, and where the shortcut stops. I’ll also cover what UK manufacturers should do about Great Britain and Northern Ireland.
What Is the Radio Equipment Directive and Who Does It Cover?
The EU RED Directive, Directive 2014/53/EU, sets the rules for putting radio equipment on the EU market. If your product transmits or receives radio waves, it’s almost certainly in scope. That covers Wi-Fi, Bluetooth, Zigbee, cellular and plenty more. Making RED compliance essential for manufacturers placing wireless products on the EU market.
For years the directive said little about cybersecurity. Article 3(3) listed security-related requirements, but they didn’t bind anyone until the Commission flipped the switch in Delegated Regulation (EU) 2022/30, adopted on 29 October 2021. Then the date slipped. The rules of the radio equipment directive were due a year earlier, and they only applied from 1 August 2025.
What Switched On in August 2025?
Three parts of Article 3(3) became mandatory for certain equipment. Don’t stop at the first one that doesn’t fit your product. Check all three.
| Requirement | What It Demands | Who’s Caught |
|---|---|---|
| Article 3(3)(d) | Equipment mustn’t harm the network or misuse network resources | Radio equipment that can reach the internet, directly or through other equipment |
| Article 3(3)(e) | Safeguards that protect personal data and privacy | Internet-connected equipment, childcare equipment, toys and wearables |
| Article 3(3)(f) | Features that protect against fraud | Internet-connected equipment that lets users transfer money, monetary value or virtual currency |
That phrase, “or through other equipment”, trips up a lot of teams. Take a Zigbee sensor with no internet link of its own. If it reaches the internet through a hub, it’s caught. Suddenly half your portfolio is in scope.
Does the EU RED Directive Apply to UK Manufacturers?
Yes, if you sell into the EU. Brexit doesn’t change that. A UK company shipping a smart thermostat to Germany needs the same CE marking as a German one.
The UK picture splits in two. Government guidance on the 2022/30 factsheet explains how.
- Great Britain: CE-marked radio equipment can still go on the GB market, and it’s deemed to meet the Radio Equipment Regulations 2017. The government has also said that CE recognition for radio equipment runs indefinitely.
- Northern Ireland: Different story. Under the Windsor Framework, the extra cybersecurity requirements apply here from 1 August 2025, so you’ll need a conformity assessment and refreshed technical documentation.
One more wrinkle. The UK’s PSTI regime, which bans universal default passwords, is a separate piece of law. Radio equipment covered by the RED Directive and sold in Northern Ireland is exempt from it, but products sold in Great Britain still need to meet PSTI. Check both before you call a product done.
Which Standards Prove Conformity? EN 18031 and Its Restrictions
You can show compliance by applying harmonised standards. The Commission cited three of them through Implementing Decision (EU) 2025/138, adopted on 28 January 2025. TÜV SÜD reports that publication in the Official Journal followed on 30 January 2025.
The catch is that the Commission cited them with restrictions. Ezurio’s breakdown of the decision lists them like this.
| Standard | Covers | Restriction |
|---|---|---|
| EN 18031-1:2024 | Article 3(3)(d), network protection | No presumption of conformity if users can skip setting a password (clauses 6.2.5.1 and 6.2.5.2) |
| EN 18031-2:2024 | Article 3(3)(e), data and privacy | Same password restriction, plus no presumption for childcare and toy equipment without parental access control (ACM-4) |
| EN 18031-3:2024 | Article 3(3)(f), fraud | Same password restriction, plus clause 6.3.2.4 (secure updates, SUM-2) gives no presumption. |
All three also exclude the “rationale” and “guidance” sections from the presumption of conformity. In short, the standards help, but they don’t protect you from a weak first-boot flow.
Module A or Notified Body: Which Route Fits Your Product?
Here’s the practical consequence. Internal production control, known as Module A, only works when you’ve applied the harmonised standards in full. A restricted clause that removes the presumption for your design pushes you towards a notified body. The Commission’s own page is clear that only notified bodies can issue certificates of compliance for harmonised products.
Now picture the most common failure. Your device lets a user press “skip” during setup and falls back to a shared admin password. That one design choice hits the restriction in all three standards.
# Weak: setup can be skipped, shared default stays active
def first_boot(user_input):
if user_input == “skip”:
enable_admin(password=”admin”)
else:
enable_admin(password=user_input)
# Stronger: setup can’t finish without a unique credential
def first_boot(user_input):
if not meets_policy(user_input): # length, not a default, not a known-breached value
raise SetupIncomplete(“Set a unique password to continue”)
enable_admin(password=hash_password(user_input))
mark_setup_complete()
To be clear, that’s an illustrative pattern, not something from a client job. But it’s the kind of thing a quick design review catches before testing starts. Want someone to look at your first-boot and update flows? Qualysec can review them with you before you book a notified body.
A Practical RED Compliance Path in Six Steps
Most teams lose time on the order of work, not the engineering itself. Here’s a sequence that keeps rework down.
| Step | What You Do | Watch Out For |
|---|---|---|
| 1. Scope | Decide which products fall under (d), (e), or (f) | Devices that reach the internet through a hub |
| 2. Gap check | Check each product against the three EN 18031 parts | Password skip, default credentials, update paths |
| 3. Fix design | Change firmware and setup flows | Fixing late costs more than fixing now |
| 4. Choose route | Pick Module A or a notified body | Any restriction that removes the presumption |
| 5. Test | Run technical testing against the standards | Test the shipping firmware, not a lab build |
| 6. Document | Update the technical file and the EU declaration of conformity | Keep one version per hardware revision |
If you only do one thing from this list, make it step 2. A gap check costs a fraction of a failed test, and it tells you early whether Module A is even on the table. Everything after it gets simpler once you know.
Then you affix the CE RED marking and keep the technical file on hand. It’s the first thing an authority asks for. Does it match the firmware you actually ship?
Where UK Teams Usually Trip Up
I’ve seen the same slips more than once, so here they are.
Thinking Great Britain is the whole market. CE marking is accepted in GB, which makes a GB-only checklist feel safe. Then a pallet heads to Dublin or Belfast, and the full cybersecurity rules apply. Write the technical file for the strictest market you sell into.
Testing the wrong build. Somebody hands the lab a clean image. The product that ships has extra services, another bootloader, and a factory provisioning step. Authorities check the shipped one.
Reading the standard as a guarantee. EN 18031 gives you a presumption of conformity. It isn’t a promise. When a restriction removes it, you’ve lost your shortcut, and that usually happens late. Check the restricted clauses first.
People also leave the declaration of conformity until the end. Don’t. It names the requirements you met, so update it with every hardware revision.
None of these needs new tooling. They need someone to own the checklist, and in most firms that person is the compliance officer.
What Happens on 11 December 2027? The CRA Handover
Delegated Regulation (EU) 2026/339 is dated 16 February 2026 and repeals 2022/30 from 11 December 2027. Why? The Commission says the CRA’s Annex I requirements “include all the elements” of the old Article 3(3)(d), (e) and (f) rules, and running both would duplicate effort.
Don’t read that as an amnesty. Anything placed on the market between 1 August 2025 and 10 December 2027 stays subject to the old requirements for market surveillance.
My advice: build once. Design to the EN 18031 controls now, then watch what the CRA adds, like vulnerability handling and support periods. New harmonised standards are coming under standardisation request M/536, though nobody’s given dates.
So you’ve got two clocks running. One covers what you ship today. The other covers redesigns once the EU CRA applies in full. Put both on one planning board.
How Qualysec Helps Before the Notified Body Does
Qualysec isn’t a notified body and can’t issue certificates. What it can do is catch the problems a notified body would flag for the EU RED Directive, while fixing them is still a firmware tweak and not a redesign.
Start with your setup flow
Qualysec checks your device against EN 18031-1, -2 and -3, restrictions included. The usual culprits are a “skip” button on password setup (6.2.5.1 and 6.2.5.2), missing parental access control on childcare gear and toys (ACM-4), and update paths that fall foul of 6.3.2.4. You get a list of the clauses most likely to cost you your presumption of conformity, with the cheapest fixes at the top. It also tells you early whether Module A is realistic or whether you should book a notified body now.
Testing the firmware
Then comes the security testing, and it’s done on the firmware you actually ship. Not the clean lab image. Qualysec goes through the production build, the mobile app, and the cloud back end, including the extra services and factory provisioning step that lab builds tend to leave out. That’s where default credentials, weak update paths, and exposed services usually turn up.
Retest and dated evidence
Once your team has fixed things, Qualysec retests and writes up the results with dates and build numbers. That evidence goes into your technical file, and your notified body starts from a much tidier place.
If you’re about to book a notified body, talk to Qualysec first. You’ll walk away with a clause-by-clause gap list.
Conclusion
The RED Directive isn’t going away on 11 December 2027. Its obligations carry on for everything you ship before then, and the EU CRA picks up the same ground afterwards. If you sell into the EU or Northern Ireland, there’s no waiting for the handover.
Start with scope. Then fix your setup and update flows, and only then pick your route with the restrictions in mind. Do it in that order, and RED compliance stops being a launch-week scramble.
Want to see where your product stands? Book a RED readiness review with Qualysec, and you’ll get a clause-by-clause gap list.
Frequently Asked Questions
1. What is the Radio Equipment Directive?
The EU RED Directive 2014/53/E is the EU law for anything that uses radio. Since 1 August 2025, it’s also been the home of cybersecurity rules for connected devices, childcare gear, toys and wearables.
2. Do UK manufacturers still need to follow EU RED?
Yes, if you sell into the EU or Northern Ireland. In Great Britain, CE-marked radio equipment is accepted and deemed to meet the UK Radio Equipment Regulations 2017. PSTI applies on top.
3. When did the RED cybersecurity requirements start?
1 August 2025. It was meant to be 1 August 2024, but the date slipped a year.
4. Which standards do I use?
EN 18031-1, -2 and -3 (2024 editions). They come with restrictions, though. If your design lets users skip password setup, you don’t get the presumption of conformity.
5. Do I need a notified body?
Not always. You can use Module A only if you apply the harmonised standards in full before CE RED marking. If a restriction takes the presumption away, you’ll need a notified body.
6. What happens to the rules after 2027?
Regulation 2026/339 repeals 2022/30 on 11 December 2027, and the CRA picks up the same ground. Products you’ve already placed on the market stay under the old rules for market surveillance.
