law
RED cybersecurity
Cybersecurity requirements for radio devices that connect to the internet, plus toys, childcare and wearable devices. They have applied since 1 August 2025 and give way to the Cyber Resilience Act on 11 December 2027.
at a glance
- what it is
- Commission Delegated Regulation (EU) 2022/30. It switches on three requirements of the Radio Equipment Directive (2014/53/EU) that had been dormant: protection of the network, of personal data and privacy, and from fraud.
- who it covers
- Manufacturers, importers and distributors of radio equipment that can talk to the internet, plus radio toys, childcare devices and wearables that handle personal data.
- the size line
- None. The texts set no size threshold and no relief for small companies.
- fine ceilings
- No EU figure. Each member state sets its own penalties, which must be effective, proportionate and dissuasive, and may be criminal for serious infringements.
- dates
- 1 August 2025 the requirements apply, after a one-year delay. 11 December 2027 the delegated regulation is repealed and the Cyber Resilience Act applies in full.
- status
- Applies now. The repeal was adopted on 16 February 2026 and published on 29 April 2026.
basis RED Art. 2(1), 46; RED DA Art. 1(1), 1(2), 3; Regulation 2023/2444 Art. 1; Regulation 2026/339 Art. 1
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhich of the three requirements reaches which device
- does not apply
- applies if the device can process personal, traffic or location data
- applies
basis RED DA Art. 1(1), 1(2), 1(3), 2(1), 2(2)
from the radio rules to the cyber resilience act
- 130 January 2025 harmonised standards published, with restrictions
- 21 August 2025 the three requirements apply, after a one-year delay
- 329 April 2026 the repeal is published
- 411 September 2026 reporting of exploited vulnerabilities and severe incidents applies
- 511 December 2027 the delegated regulation is repealed
- 611 December 2027 the rest of the regulation applies
basis Decision 2025/138 Art. 2; Regulation 2023/2444 Art. 1; Regulation 2026/339 Art. 1, recital 5; CRA Art. 71(2)
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- know your devices and your role
Find out which of your devices are covered, which of the three requirements applies to each and what role you play.
- build the requirements into the device
Turn the requirements that apply into design rules the team builds and tests.
- show conformity and mark the device
Choose the conformity procedure, keep the proof in a technical file and sign the declaration.
- check the chain and prepare for the CRA
Check what you receive and sell, act when something does not conform, and plan the move to the Cyber Resilience Act.
the dates
What applies when. The reference sits under each date.
- 1 August 2025the cybersecurity requirements for radio equipment applyRegulation 2023/2444 Art. 1applies now
- 11 December 2027the delegated regulation is repealed and the Cyber Resilience Act applies in fullRegulation 2026/339 Art. 1coming
the fine ceilings
The ceilings each text sets. The reference sits under each.
- penaltiesno EU figure; member states set the penalties, which may include criminal penalties for serious infringementsRED Art. 46
Look it up in your national law. The penalties must be effective, proportionate and dissuasive.
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.