---
title: "Our connected device faces new cybersecurity rules"
description: "Since 1 August 2025, Delegated Regulation (EU) 2022/30 applies the Radio Equipment Directive's network, privacy and fraud requirements to internet-connected radio equipment and to toys, childcare and wearable radio products that process personal data. The Cyber Resilience Act, Regulation (EU) 2024/2847, adds reporting duties from 11 September 2026 and applies in full from 11 December 2027, when Delegated Regulation (EU) 2026/339 repeals 2022/30."
type: "problem"
url: "https://www.conphora.com/solutions/problem/radio-cybersecurity/"
markdown: "https://www.conphora.com/solutions/problem/radio-cybersecurity.md"
locale: "en"
language: "en"
updated: "2026-10-04"
author: "Conphora compliance team"
publisher: "Conphora"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014L0053-20260530"
tags: ["RED", "batteries-electronics"]
license: "Free to quote with attribution and a link to the page"
---

# Our connected device faces new cybersecurity rules

Since 1 August 2025, Delegated Regulation (EU) 2022/30 applies the Radio Equipment Directive's network, privacy and fraud requirements to internet-connected radio equipment and to toys, childcare and wearable radio products that process personal data. The Cyber Resilience Act, Regulation (EU) 2024/2847, adds reporting duties from 11 September 2026 and applies in full from 11 December 2027, when Delegated Regulation (EU) 2026/339 repeals 2022/30.

## Why this happens

The Radio Equipment Directive 2014/53/EU has always contained cybersecurity requirements in Article 3(3): radio equipment must not harm the network or misuse network resources (point (d)), must incorporate safeguards for personal data and privacy (point (e)) and must support features that protect from fraud (point (f)). Those requirements only bite for the categories the Commission names by delegated act. [1]

Delegated Regulation (EU) 2022/30 names them. Point (d) applies to internet-connected radio equipment; point (e) applies to internet-connected radio equipment, childcare radio equipment, radio toys and radio wearables that can process personal, traffic or location data; point (f) applies to internet-connected radio equipment that lets the holder transfer money, monetary value or virtual currency (Article 1). Medical and in vitro diagnostic devices are excluded, and radio equipment also covered by Regulation (EU) 2018/1139 (civil aviation), Regulation (EU) 2019/2144 (motor-vehicle type-approval) or Directive (EU) 2019/520 (electronic road tolls) is excluded from points (e) and (f) (Article 2). After an amendment by Delegated Regulation (EU) 2023/2444, it applies from 1 August 2025 (Article 3). [2]

The harmonised standards EN 18031-1, -2 and -3:2024 were published with restrictions. They confer no presumption of conformity for their rationale and guidance sections, nor where the user is allowed not to set and use any password, and EN 18031-2 not for the equipment covered by its clauses 6.1.3 to 6.1.6 where parental or guardian access control is not ensured (Implementing Decision (EU) 2025/138, Annex). Where a manufacturer has not applied, or only partly applied, harmonised standards for the Article 3(3) requirements, the equipment must go through EU-type examination or full quality assurance (Radio Equipment Directive Article 17(4)). [3]

The Cyber Resilience Act, Regulation (EU) 2024/2847, is the next layer. It applies to products with digital elements whose intended or foreseeable use includes a data connection to a device or network (Article 2(1)). It applies from 11 December 2027, but the reporting obligations of Article 14 apply from 11 September 2026 and the rules on notified bodies from 11 June 2026 (Article 71(2)). Manufacturers report actively exploited vulnerabilities with an early warning within 24 hours and a notification within 72 hours of becoming aware of them, and a final report within 14 days after a fix is available (Article 14(1) and (2)); severe incidents are reported in the same way (Article 14(3) and (4)). Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027 (Article 1). [4] [5]

## How to solve it

1. **Work out which requirements your product triggers** Network protection applies to radio equipment that can communicate over the internet, directly or via other equipment. Privacy protection applies to internet-connected radio equipment, childcare radio equipment, radio toys and wearables that can process personal, traffic or location data. Fraud protection applies to internet-connected radio equipment that lets the user transfer money or virtual currency. Medical and in vitro diagnostic devices are excluded.
2. **Choose your conformity route with the restrictions in mind** EN 18031-1, -2 and -3:2024 give a presumption of conformity, but with restrictions: not if the user is allowed not to set and use any password, not for the rationale and guidance sections, and, for the equipment covered by clauses 6.1.3 to 6.1.6 of EN 18031-2, not where parental or guardian access control is not ensured. Where you do not apply the standards in full, a notified body must be involved through EU-type examination or full quality assurance.
3. **Assess every configuration and document it** Run the conformity assessment for all intended operating conditions and every configuration the device can take. Keep the technical documentation up to date before and after the product is placed on the market, including test reports and the description of the security measures.
4. **Prepare the product for the Cyber Resilience Act** The Cyber Resilience Act applies to products with a data connection to a device or network. Design to the essential requirements of Annex I, Part I, set a support period of at least five years unless the product is expected to be used for less, draw up a software bill of materials and put a coordinated vulnerability disclosure policy in place.
5. **Be ready to report exploited vulnerabilities from 11 September 2026** From 11 September 2026, a manufacturer notifies an actively exploited vulnerability to the coordinating CSIRT and ENISA through the single reporting platform: an early warning within 24 hours and a notification within 72 hours of becoming aware of it, and a final report within 14 days after a fix is available. Severe incidents affecting the security of the product are notified in the same way. This also applies to products placed on the market before 11 December 2027.

## What you need to show

- **Technical documentation with the security assessment and test reports** — The manufacturer (Radio Equipment Directive Articles 17(1) and 21)
- **EU declaration of conformity** — The manufacturer (Radio Equipment Directive Article 10(3))
- **Software bill of materials and vulnerability disclosure policy (Cyber Resilience Act)** — The manufacturer (Regulation (EU) 2024/2847 Annex I, Part II, points (1) and (5))

## If you do nothing

- **The standard does not protect a no-password option** — EN 18031-1, -2 and -3:2024 confer no presumption of conformity where, applying clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password (Implementing Decision (EU) 2025/138, Annex).
- **Old products are still caught by the reporting duty** — Products placed on the market before 11 December 2027 are subject to the Cyber Resilience Act only after a substantial modification, but the reporting obligations of Article 14 apply to all products in scope placed on the market before that date (Regulation (EU) 2024/2847, Article 69(2) and (3)).
- **Penalties under national law** — Member States lay down effective, proportionate and dissuasive penalties for infringements of the Radio Equipment Directive, which may include criminal penalties for serious infringements (Article 46).

## Questions

### Our product only uses Bluetooth and never goes online. Is it covered?

The network requirement covers radio equipment that can communicate over the internet directly or via any other equipment (Delegated Regulation (EU) 2022/30, Article 1(1)). Childcare products, radio toys and wearables that can process personal data are covered by the privacy requirement even when they are not internet-connected (Article 1(2)(b) to (d)).

### Does the Cyber Resilience Act replace the RED rules?

From 11 December 2027. Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from that date, when the Cyber Resilience Act applies in full, so that the same equipment is not subject to both (Article 1 and recital 4). Until then the RED requirements apply, and equipment placed on the market between 1 August 2025 and 10 December 2027 stays subject to market surveillance under them (recital 5).

### How long must we provide security updates?

Under the Cyber Resilience Act the manufacturer sets a support period that reflects how long the product is expected to be in use, and it is at least five years, unless the product is expected to be used for less (Regulation (EU) 2024/2847, Article 13(8)).

### Our product is a smart lock or a baby monitor. Does that change anything?

Smart home products with security functions, including smart door locks, security cameras and baby monitoring systems, are listed as important products in Class I of Annex III to the Cyber Resilience Act. Check the conformity assessment rules that apply to important products well before 11 December 2027.

### Are medical devices covered?

No. The RED cybersecurity requirements do not apply to radio equipment covered by Regulations (EU) 2017/745 or 2017/746 (Delegated Regulation (EU) 2022/30, Article 2(1)), and the Cyber Resilience Act excludes those products too (Article 2(2)).

## Regulations involved

RED

## Sources

1. [Directive 2014/53/EU on radio equipment (consolidated text of 30 May 2026)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014L0053-20260530) — EUR-Lex, 2026-10-04
2. [Delegated Regulation (EU) 2022/30 on the essential requirements in Article 3(3)(d), (e) and (f) of Directive 2014/53/EU (consolidated text of 27 October 2023)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022R0030-20231027) — EUR-Lex, 2026-10-04
3. [Implementing Decision (EU) 2025/138 on harmonised standards for radio equipment cybersecurity (EN 18031)](https://eur-lex.europa.eu/eli/dec_impl/2025/138/oj) — EUR-Lex, 2026-10-04
4. [Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) — EUR-Lex, 2026-10-04
5. [Delegated Regulation (EU) 2026/339 repealing Delegated Regulation (EU) 2022/30](https://eur-lex.europa.eu/eli/reg_del/2026/339/oj) — EUR-Lex, 2026-10-04