cybersecurity of radio equipment

The Radio Equipment Directive covers any electrical or electronic product that intentionally sends or receives radio waves to communicate or to find a position: a product with Wi-Fi, Bluetooth, a mobile modem or a satellite receiver. Equipment used only for public security, defence and state security is outside it.

Since 1 August 2025, three of its requirements apply to certain kinds of that equipment. The test that matters most is whether the device can communicate over the internet itself, directly or through another device such as a phone or a hub. The delegated regulation calls this internet-connected radio equipment. A smart plug, a connected camera, a router or a tracker with a mobile modem all qualify. A device whose radio only talks to a nearby device, and which cannot exchange data with the internet even through it, is not internet-connected.

Three kinds of device are covered even with no internet link, for the personal data requirement only: radio equipment made exclusively for childcare (a baby monitor), radio toys, and wearables (anything worn on, strapped to or hung from the body or clothing). The rules apply to the whole device, its non-radio parts included.

Some devices are left out because other laws handle their cybersecurity. Medical devices and in vitro diagnostic devices are out of all three requirements. Vehicles under the type-approval rules, civil aviation products and electronic road toll equipment are out of the personal data and fraud requirements, and still have to protect the network.

Network protection. The device must not harm the network or its functioning, and must not misuse network resources so that service degrades unacceptably. The delegated regulation’s reasoning names the risk: a device taken over to flood a network or cut off a service. This one applies to every internet-connected radio device.

Personal data and privacy. The device must have safeguards that protect the personal data and privacy of the user and the subscriber. It applies when the device can process personal data, or traffic and location data as the e-privacy rules define them. The reasoning points to cameras, microphones, location and health readings, and to settings left open behind a default password.

Fraud. The device must support features that protect against fraud. It applies only to internet-connected radio equipment that lets the holder or user transfer money, monetary value or virtual currency.

The law states these as outcomes. How to reach them is set out in the harmonised standards, covered further down.

The duties follow the product along the chain, as with any CE-marked product.

• The manufacturer makes the device, or has it designed or made, and sells it under its own name or trade mark. It makes sure the device meets the requirements, draws up the technical documentation, runs the conformity assessment, signs the EU declaration of conformity and affixes the CE marking. It keeps the file and the declaration for 10 years after the device is placed on the market.
• The importer is established in the EU and places a device from outside the EU on the market. It may only place compliant devices on the market, and before it does so it checks that the manufacturer ran the assessment, drew up the documentation and applied the marking. It keeps a copy of the declaration for 10 years.
• The distributor passes the device along the chain. It acts with due care and checks the CE marking and the accompanying documents before it sells.

An importer or distributor who sells a device under its own name, or changes one so that compliance may be affected, takes on the manufacturer’s duties. If anyone in the chain has reason to believe a device does not conform, it holds the device back, and where the device presents a risk it tells the market surveillance authorities.

The delegated regulation was first due to apply from 1 August 2024. The Commission moved that to 1 August 2025, because the harmonised standards were not ready. The three requirements have applied since then to every covered device placed on the market.

On 16 February 2026 the Commission adopted a regulation that repeals the delegated regulation with effect from 11 December 2027, the day the Cyber Resilience Act applies in full. The reason given: the CRA’s own product requirements include everything the three radio requirements ask, and a device should not answer to two sets of cybersecurity rules at once. Devices placed on the market between 1 August 2025 and 10 December 2027 can still be checked against the radio requirements by market surveillance after the repeal.

A device that follows harmonised standards published in the Official Journal is presumed to meet the requirements those standards cover. For these three requirements the standards are EN 18031-1 (network protection), EN 18031-2 (personal data and privacy) and EN 18031-3 (fraud), all from 2024. Their references were published on 30 January 2025 with restrictions. The parts labelled rationale and guidance give no presumption. None of the three gives a presumption if the device lets the user skip setting and using a password. The privacy standard gives none for toys and childcare devices that lack parental or guardian access control, and the fraud standard gives none under its assessment criteria for secure updates.

The route to conformity depends on how you used the standards.

• Standards applied in full: you can use internal production control, where you assess the device yourself, or one of the two routes with a notified body.
• Standards applied only in part or left out, or no standard available: you must use EU-type examination or full quality assurance. Both involve a notified body.

So if your design relies on an option a restriction excludes, such as letting the user go without a password, plan for a notified body. The Commission’s page adds that only notified bodies may issue certificates of compliance for products under EU harmonisation rules, and that voluntary or other certificates are not a recognised means of proving compliance.

National market surveillance authorities enforce the radio rules. Where they find a device that does not comply, they can require corrective action, withdrawal from the market or a recall.

The directive sets no fine amount. Each member state lays down its own penalties for breaches of its national law implementing the directive. The penalties must be effective, proportionate and dissuasive, and may include criminal penalties for serious infringements. Check your national law for the authority and the amounts.

The Cyber Resilience Act covers products with digital elements, and most internet-connected radio devices are such products. The CRA says its essential cybersecurity requirements include all the elements of the three radio requirements. Until 11 December 2027 both laws can reach the same device. The radio rules set the product requirements today. The CRA’s reporting duty for actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, including to products already on the market. From 11 December 2027 only the CRA sets the product requirements.

The CRA also asks the Commission to give guidance during the transition to manufacturers covered by both texts, and says the standardisation work behind the radio standards should feed into the CRA’s own standards. Notified bodies that work under the radio rules have to be assessed and notified again under the CRA. A reasonable reading for a manufacturer: build the radio requirements into the device now, and treat them as a first step toward the CRA’s longer list, which also covers vulnerability handling and a support period.