Our connected device faces new cybersecurity rules

The Radio Equipment Directive 2014/53/EU has always contained cybersecurity requirements in Article 3(3): radio equipment must not harm the network or misuse network resources (point (d)), must incorporate safeguards for personal data and privacy (point (e)) and must support features that protect from fraud (point (f)). Those requirements only bite for the categories the Commission names by delegated act.^[1]

Delegated Regulation (EU) 2022/30 names them. Point (d) applies to internet-connected radio equipment; point (e) applies to internet-connected radio equipment, childcare radio equipment, radio toys and radio wearables that can process personal, traffic or location data; point (f) applies to internet-connected radio equipment that lets the holder transfer money, monetary value or virtual currency (Article 1). Medical and in vitro diagnostic devices are excluded, and radio equipment also covered by Regulation (EU) 2018/1139 (civil aviation), Regulation (EU) 2019/2144 (motor-vehicle type-approval) or Directive (EU) 2019/520 (electronic road tolls) is excluded from points (e) and (f) (Article 2). After an amendment by Delegated Regulation (EU) 2023/2444, it applies from 1 August 2025 (Article 3).^[2]

The harmonised standards EN 18031-1, -2 and -3:2024 were published with restrictions. They confer no presumption of conformity for their rationale and guidance sections, nor where the user is allowed not to set and use any password, and EN 18031-2 not for the equipment covered by its clauses 6.1.3 to 6.1.6 where parental or guardian access control is not ensured (Implementing Decision (EU) 2025/138, Annex). Where a manufacturer has not applied, or only partly applied, harmonised standards for the Article 3(3) requirements, the equipment must go through EU-type examination or full quality assurance (Radio Equipment Directive Article 17(4)).^[3]

The Cyber Resilience Act, Regulation (EU) 2024/2847, is the next layer. It applies to products with digital elements whose intended or foreseeable use includes a data connection to a device or network (Article 2(1)). It applies from 11 December 2027, but the reporting obligations of Article 14 apply from 11 September 2026 and the rules on notified bodies from 11 June 2026 (Article 71(2)). Manufacturers report actively exploited vulnerabilities with an early warning within 24 hours and a notification within 72 hours of becoming aware of them, and a final report within 14 days after a fix is available (Article 14(1) and (2)); severe incidents are reported in the same way (Article 14(3) and (4)). Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027 (Article 1).^[4][5]