the whole job

RED cybersecurity: the whole job, in order

The cybersecurity requirements for radio equipment reach anyone who makes, imports or sells a device with a radio that talks to the internet, and makers of radio toys, childcare devices and wearables. Here is the job as a plan: four phases, in the order that holds up, with who carries each step, what it produces and the proof it leaves.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, things the product team builds, and checks that someone keeps running. The requirements have applied since 1 August 2025 to every covered device placed on the market. On 11 December 2027 they are repealed and the Cyber Resilience Act takes over, so the last phase prepares that move. Under each step a small note names the legal basis, or says practice where no text sets it.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

know your devices and your role

Find out which of your devices are covered, which of the three requirements applies to each and what role you play.

  1. list your radio devices

    List every product you place on the market that intentionally sends or receives radio waves: Wi-Fi, Bluetooth, mobile, satellite and similar. For each, note whether it can exchange data with the internet, directly or through another device such as a phone or a hub.

    • owner legal or DPO
    • decide and document
    what it produces
    a register of radio devices with the internet question answered for each
    the proof it leaves
    the register, dated and approved by management

    the control: asset-inventory

    basis RED Art. 1(3), 2(1)

  2. mark which requirement applies to each device

    Network protection applies to every internet-connected device. Personal data and privacy applies when the device can process personal, traffic or location data, and covers childcare devices, radio toys and wearables even with no internet link. Fraud applies when an internet-connected device lets the user move money or virtual currency. Mark the exclusions for medical, vehicle, aviation and road toll equipment.

    • owner head of IT
    • decide and document
    what it produces
    a requirement entry per device with the reasoning
    the proof it leaves
    the register entries and the notes behind them

    basis RED DA Art. 1(1), 1(2), 1(3); RED DA Art. 2(1), 2(2)

  3. decide your role for each device

    Mark each device as made by you, imported by you or distributed by you. If you sell a device under your own name or trade mark, or change one so that compliance may be affected, you carry the manufacturer's duties.

    • owner legal or DPO
    • decide and document
    what it produces
    a role entry per device, with the reasoning
    the proof it leaves
    the register entries, reviewed when a product or a contract changes

    basis RED Art. 2(1); RED Art. 14

  4. name an owner and note the dates

    Name one accountable owner per product line. Write the dates beside each device: the requirements apply now, and from 11 December 2027 the Cyber Resilience Act sets the product requirements instead. Find your national market surveillance authority and its penalty rules.

    • owner board
    • decide and document
    what it produces
    an owner per product line and a date sheet
    the proof it leaves
    a board decision naming the owners, and the date sheet with its sources

    basis Regulation 2026/339 Art. 1; CRA Art. 71(2)

you are done with this phase when you can show a device register with the requirements, your role and an owner for every device.
02

build the requirements into the device

Turn the requirements that apply into design rules the team builds and tests.

  1. analyse the risks for each device

    Look at every intended operating condition and every configuration the device can take, and ask how it could harm the network, expose personal data or enable fraud. The conformity assessment has to cover all of them.

    • owner head of IT
    • decide and document
    what it produces
    a documented risk analysis per device
    the proof it leaves
    the analysis, dated, filed in the technical documentation

    the work pagethe control: risk-register

    basis RED Art. 17(1)

  2. design to the harmonised standards

    Use the standard that matches each requirement that applies: network protection, privacy or fraud. Read the restrictions in the publication and design so that none of them bites, because a restricted clause gives no presumption of conformity.

    • owner head of IT
    • build and configure
    what it produces
    a clause-by-clause checklist per device, with owners
    the proof it leaves
    the checklist, signed off before each release

    the control: secure-development

    basis RED Art. 16; Decision 2025/138 Art. 1

  3. require a password the user sets

    Do not let the user skip setting and using a password. For toys and childcare devices, build parental or guardian access control. Both are conditions in the restrictions on the standards.

    • owner head of IT
    • build and configure
    what it produces
    an authentication design per device
    the proof it leaves
    a test showing the device cannot be used without a password set

    the work page

    basis Decision 2025/138 Art. 1

  4. protect personal data on the device and in transit

    Where the device can process personal, traffic or location data, build safeguards that protect it: who can reach it, how it is stored and how it travels. Settings must not open up behind a default password.

    • owner head of IT
    • build and configure
    what it produces
    a data protection design per device
    the proof it leaves
    the design and the test results that check it

    the control: encryption-keys

    basis RED Art. 3(3)(e)

  5. test the device and keep the results

    Test each device against the requirements that apply before release and when the design changes. Record what you found, what you fixed and what you accepted. The results go into the technical documentation, which is kept up to date.

    • owner head of IT
    • prove and operate
    what it produces
    a test plan and test reports per device
    the proof it leaves
    the reports, dated, tied to firmware versions

    the control: vulnerability-management

    basis RED Art. 21(1), 21(2)

you are done with this phase when you can show, for each device, a risk analysis, a design checked against the standards and test results.
03

show conformity and mark the device

Choose the conformity procedure, keep the proof in a technical file and sign the declaration.

  1. choose the conformity procedure

    If you applied the harmonised standards in full, you can assess the device yourself under internal production control. If you applied them only in part, left them out, or no standard fits, use EU-type examination or full quality assurance, both with a notified body.

    • owner legal or DPO
    • decide and document
    what it produces
    a recorded choice of procedure per device with the reasoning
    the proof it leaves
    the decision note and, where used, the notified body's certificate

    basis RED Art. 17(3), 17(4)

  2. write the technical documentation

    Draw it up before the device goes on the market and keep it current. It holds the data and the means you used to meet the requirements: the risk analysis, the standards applied, the design notes and the test reports.

    • owner head of IT
    • build and configure
    what it produces
    a technical file per device
    the proof it leaves
    the file with a version history

    basis RED Art. 10(3); RED Art. 21(1), 21(2)

  3. sign the declaration and affix the marking

    When the procedure shows conformity, draw up the EU declaration of conformity, which makes you responsible for compliance, and affix the CE marking. Ship a copy of the declaration with each device, or a simplified one with the address of the full text.

    • owner legal or DPO
    • prove and operate
    what it produces
    a signed declaration and the marking applied
    the proof it leaves
    the declaration and the assessment record

    basis RED Art. 10(3), 10(9); RED Art. 18(1), 18(4)

  4. keep the series in conformity and keep the file

    Put procedures in place so that every unit of a series stays in conformity, including when the design or the standards change. Keep the technical file and the declaration for 10 years after the device is placed on the market.

    • owner head of IT
    • prove and operate
    what it produces
    a change check routine and a retention rule
    the proof it leaves
    the change records and the retention rule

    basis RED Art. 10(4), 10(5)

you are done with this phase when you can hand a market surveillance authority a technical file and a declaration of conformity for each device.
04

check the chain and prepare for the CRA

Check what you receive and sell, act when something does not conform, and plan the move to the Cyber Resilience Act.

  1. if you import, check what the manufacturer gives you

    Before you place a device on the market, check that the manufacturer ran the conformity procedure, drew up the technical documentation and applied the marking. If you think it does not conform, do not place it on the market. Keep a copy of the declaration for 10 years.

    • owner procurement
    • build and configure
    what it produces
    an import check list per device and a record of each check
    the proof it leaves
    completed checks and the stored declarations

    the work pagethe control: supplier-management

    basis RED Art. 12(1), 12(2), 12(8)

  2. if you distribute, verify before you sell

    Act with due care. Check the CE marking, the documents and the instructions before you sell. If you have reason to believe a device does not conform, hold it back until it is brought into conformity.

    • owner procurement
    • build and configure
    what it produces
    a distributor intake check
    the proof it leaves
    completed checks and the contact log with suppliers

    basis RED Art. 13(1), 13(2)

  3. act when a device does not conform

    If you learn that a device you placed or sold does not conform, take or make sure of corrective measures, withdrawal or recall. If it presents a risk, inform the authorities in the countries where you sold it.

    • owner legal or DPO
    • prove and operate
    what it produces
    a non-conformity routine with named decision makers
    the proof it leaves
    the corrective action log

    basis RED Art. 10(11); RED Art. 12(7); RED Art. 13(4)

  4. plan the move to the CRA

    Devices that are also products with digital elements already fall under the CRA reporting duty for exploited vulnerabilities and severe incidents. From 11 December 2027 the CRA sets the product requirements alone. Map what you built for the radio rules onto the CRA plan and list the gaps, such as vulnerability handling and a support period.

    • owner head of IT
    • decide and document
    what it produces
    a gap list against the CRA plan, with owners
    the proof it leaves
    the gap list, dated, and the decisions taken on it

    the work pagethe control: vulnerability-disclosure

    basis Regulation 2026/339 Art. 1; CRA Art. 14(1)

  5. watch for standards and guidance

    Check the Official Journal and the Commission's pages on a rhythm for changes to the published standards and their restrictions, and for guidance on devices covered by both the radio rules and the CRA. Update your procedures when something changes.

    • owner legal or DPO
    • prove and operate
    what it produces
    a watch list with an owner and a check rhythm
    the proof it leaves
    the watch list with dates of each check and what changed

    basis working practice. No legal text sets this.

you are done with this phase when you can show import and sales checks, a log of corrective actions and a plan for the CRA.

who carries what

The same steps, grouped by the person who has to act.

legal or DPO

head of IT

board

procurement

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    List every device you sell that has a radio, mark whether it reaches the internet, and note which of the three requirements applies to each.

    read the guide