Comparison
CRA vs RED: the Radio Equipment Directive 2014/53/EU, its delegated act and the CRA
Short answer: the Radio Equipment Directive 2014/53/EU (RED) already carries cybersecurity requirements for much connected radio equipment. Delegated Regulation (EU) 2022/30 has made RED’s network, privacy and fraud requirements apply since 1 August 2025. The Commission has repealed that delegated act with effect from 11 December 2027, the day the CRA applies in full, so from that date the cybersecurity of those products runs through the CRA. RED’s other essential requirements stay.
What the Radio Equipment Directive regulates
Directive 2014/53/EU sets the conditions for making radio equipment available on the EU market. Every piece of radio equipment must protect health and safety, meet electromagnetic compatibility and use the radio spectrum efficiently (Article 3(1) and (2)). Article 3(3) lists further essential requirements, points (a) to (i), that apply only to the categories or classes of equipment the Commission names in a delegated act. Three of them concern cybersecurity:
- Point (d): radio equipment does not harm the network or its functioning nor misuse network resources.
- Point (e): radio equipment incorporates safeguards to protect the personal data and privacy of the user and of the subscriber.
- Point (f): radio equipment supports certain features ensuring protection from fraud.
Full text: Directive 2014/53/EU, OJ L 153, 22.5.2014 (RED).
The RED delegated act: Delegated Regulation (EU) 2022/30
Commission Delegated Regulation (EU) 2022/30 of 29 October 2021 names the equipment to which points (d), (e) and (f) apply.
- Point (d) applies to internet-connected radio equipment: any radio equipment that can communicate itself over the internet, directly or via other equipment.
- Point (e) applies, where the equipment can process personal data, traffic data or location data, to internet-connected radio equipment, radio equipment designed exclusively for childcare, radio equipment covered by the Toy Safety Directive 2009/48/EC, and wearable radio equipment.
- Point (f) applies to internet-connected radio equipment that lets the holder or user transfer money, monetary value or virtual currency.
- Carve-outs: none of the three applies to medical devices under Regulation (EU) 2017/745 or in vitro diagnostics under Regulation (EU) 2017/746. Points (e) and (f) do not apply to equipment covered by the civil aviation Regulation (EU) 2018/1139, the vehicle type-approval Regulation (EU) 2019/2144, or the electronic road toll Directive (EU) 2019/520.
The act first set 1 August 2024 as its date of application. Delegated Regulation (EU) 2023/2444 of 20 July 2023 moved that to 1 August 2025, to give the standardisation bodies time to deliver harmonised standards. Full texts: Delegated Regulation (EU) 2022/30, OJ L 7, 12.1.2022 and Delegated Regulation (EU) 2023/2444.
The harmonised standards EN 18031-1, -2 and -3
Commission Implementing Decision (EU) 2025/138 of 28 January 2025, published in the Official Journal on 30 January 2025, added three standards to the list that gives a presumption of conformity under RED:
- EN 18031-1:2024 for internet-connected radio equipment, supporting point (d).
- EN 18031-2:2024 for radio equipment processing data, namely internet-connected, childcare, toy and wearable radio equipment, supporting point (e).
- EN 18031-3:2024 for internet-connected radio equipment processing virtual money or monetary value, supporting point (f).
All three were cited with restrictions. The sections headed “rationale” and “guidance” give no presumption of conformity. None of the three gives a presumption if, under clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password. EN 18031-2 gives none for toy and childcare equipment where parental or guardian access control is not ensured. EN 18031-3 gives none as regards the secure-update assessment criteria in clause 6.3.2.4. Where a manufacturer has not applied a cited standard, or has applied it only in part, Article 17(4) of RED sends the equipment to EU-type examination or full quality assurance, which means a notified body. Full text: Implementing Decision (EU) 2025/138.
What the CRA says about RED
The Radio Equipment Directive is not among the Union acts that exclude products from the CRA. Art. 2(2) to (4) names medical devices, in vitro diagnostic medical devices, vehicle type-approval, certified aviation products and marine equipment.
“This Regulation does not apply to products with digital elements to which the following Union legal acts apply:”
The CRA addresses the overlap in Recital 30, not in an article. The recital states that the CRA’s essential cybersecurity requirements already contain everything in RED points (d), (e) and (f).
“The essential cybersecurity requirements set out in this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU.”
The same recital anticipates that the Commission would repeal or amend Delegated Regulation (EU) 2022/30 for products in CRA scope, and asks it to help manufacturers caught by both in the meantime.
“During the transitional period for the application of this Regulation, the Commission should provide guidance to manufacturers subject to this Regulation that are also subject to Delegated Regulation (EU) 2022/30 to facilitate the demonstration of compliance with the two Regulations.”
The repeal: Delegated Regulation (EU) 2026/339
The Commission did repeal it. Delegated Regulation (EU) 2026/339 of 16 February 2026, published in the Official Journal on 29 April 2026, repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027. Its recitals give the reason: to stop radio equipment being subject to the RED cybersecurity requirements and the CRA at the same time. They also state that the repeal does not affect market surveillance under RED of radio equipment placed on the market between 1 August 2025 and 10 December 2027. Full text: Delegated Regulation (EU) 2026/339.
What is still open
- The overlap window. Until 10 December 2027 the RED cybersecurity requirements apply in full. Parts of the CRA already apply before that: Chapter IV since 11 June 2026 and Article 14 reporting since 11 September 2026. A radio product in CRA scope can carry duties under both in that window.
- The conformity route after the switch. From 11 December 2027 the cybersecurity of such a product is assessed under the CRA, through the CRA conformity routes for its class. EN 18031 was written for RED. Recital 30 asks that this work be taken into account when the CRA harmonised standards are prepared, which does not make EN 18031 a CRA standard.
- Commission guidance. Recital 30 says the Commission should issue guidance for manufacturers subject to both. Check the Commission’s RED pages for it rather than relying on this page.
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
What this means in practice
- Radio equipment placed on the market until 10 December 2027 that falls under Delegated Regulation (EU) 2022/30 must meet RED points (d), (e) and (f), either by applying EN 18031 in full and within its restrictions, or through a notified body.
- Allowing users to skip setting a password, or leaving out parental control on a connected toy, removes the presumption of conformity and brings in a notified body under RED.
- For radio equipment placed on the market from 11 December 2027, plan the cybersecurity case under the CRA. RED’s safety, electromagnetic compatibility and spectrum requirements keep applying alongside it.
- Run the Cybiq check for your CRA status: whether your product is in scope, its class, and the conformity route it faces.
- Cybiq checks the CRA only: it does not assess your product’s compliance with RED or with EN 18031.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Statements about the Radio Equipment Directive, its delegated and implementing acts and EN 18031 were checked against their Official Journal texts and are not quoted. Verify before relying on any item; for a binding assessment consult a qualified lawyer.