[Home](/)/[Resources](/resources)/RED Article 3(3) Cybersecurity EURadio / Cybersecurity # RED Article 3(3) Delegated Regulation: Cybersecurity Requirements for Radio Equipment If your product has a radio interface, the EU's cybersecurity rules just got significantly tighter. The delegated regulation (EU) 2022/30 activated the cybersecurity sub-requirements of the Radio Equipment Directive for connected and data-processing radio products — and the mandatory date is August 2025. Here's what that means for your technical file and conformity assessment. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Feu-radio-equipment-directive-cybersecurity) At a glance Delegated Regulation (EU) 2022/30 Scope Internet-connected + data-processing radio Mandatory from August 1 2025 Requirements Art. 3(3)(d)(e)(f) RED ## What the delegated regulation requires ### What the delegated regulation adds to RED The Radio Equipment Directive baseline — Article 3(1)(a) health and safety, 3(1)(b) electromagnetic compatibility, and 3(2) radio spectrum use — already applies to all radio equipment. The delegated regulation (EU) 2022/30 makes Articles 3(3)(d), 3(3)(e), and 3(3)(f) mandatory for specified categories of radio equipment. These sub-requirements were already in the Directive but were previously optional and not activated for most product categories. ### Product categories in scope Three categories of radio equipment fall under the delegated regulation: all radio equipment that can connect to the internet (including Wi-Fi, cellular, and Bluetooth devices with internet connectivity); all radio equipment capable of processing personal data, traffic data, or location data; and all childcare equipment and toys that communicate over radio, including wearable child monitors, connected toys, and infant monitoring devices. ### The three essential requirements Article 3(3)(d) requires that equipment does not harm the network and does not misuse network resources. Article 3(3)(e) requires that equipment incorporates safeguards to ensure the protection of personal data and the privacy of the user and subscriber. Article 3(3)(f) requires that equipment has features to prevent fraud — specifically, features that protect against fraudulent monetary transactions by ensuring that critical payment or authentication functions cannot be bypassed. ### Harmonised standards and the gap ETSI has published EN 18031-1 (network harm protection), EN 18031-2 (personal data protection), and EN 18031-3 (fraud prevention) as the designated harmonised standards for Articles 3(3)(d), 3(3)(e), and 3(3)(f) respectively. Manufacturers using these standards benefit from a presumption of conformity. Where a manufacturer uses an alternative technical solution, the justification in the technical file must be more detailed, documenting how each requirement is met. ## Steps to comply with the RED cybersecurity requirements 01 Confirm your radio equipment falls within one of the delegated regulation's three in-scope categories — internet-connected radio equipment, radio equipment that processes personal or location data, or childcare or toy equipment that communicates via radio. 02 Map your product's functions against each of the three Article 3(3) sub-requirements — document which functions involve network connectivity (d), which functions handle personal or location data (e), and which functions process or facilitate financial transactions or authentication (f). 03 Test or assess compliance against the ETSI EN 18031 series — EN 18031-1 for network harm, EN 18031-2 for personal data protection, and EN 18031-3 for fraud prevention — as applicable to your product's functions; monitor ETSI for updates to these standards as they continue to be refined. 04 Update your Declaration of Conformity to reference the delegated regulation (EU) 2022/30 and the specific Article 3(3) sub-requirements your product must meet, in addition to the base RED references for 3(1)(a), 3(1)(b), and 3(2). 05 Update your technical file with a cybersecurity risk assessment, a description of the security architecture and controls implemented to meet each sub-requirement, and the test evidence or conformity assessment documentation against the EN 18031 series standards. ## Frequently asked questions ### Does the RED delegated regulation replace the EU Cyber Resilience Act for radio equipment? No — they run in parallel. The delegated regulation applies to radio equipment specifically and activates existing RED Article 3(3) sub-requirements. The CRA applies to products with digital elements more broadly and imposes additional obligations including vulnerability reporting, SBOM requirements, and multi-year support periods. A connected radio product sold in the EU from 2027 must satisfy both the RED delegated regulation cybersecurity requirements and the CRA essential requirements. Compliance work can overlap, but the two frameworks are legally distinct. ### What does 'internet-connected radio equipment' mean for Article 3(3)(d)? Internet-connected radio equipment means any radio product that can establish a connection to the public internet — whether through Wi-Fi, cellular, or any other radio interface. This includes routers, smart home hubs, connected appliances, industrial IoT gateways with cellular modems, and consumer electronics with Wi-Fi. Equipment that only communicates point-to-point via Bluetooth or proprietary RF without any path to the internet is generally not in scope under this category, though it may still be in scope if it processes personal data. ### Which products are in the childcare/toy category under (EU) 2022/30? The childcare and toy category covers radio equipment that is primarily intended for use by or with children and that communicates via radio — specifically devices falling within the scope of the Toy Safety Directive or childcare articles. This includes baby monitors with radio transmission, connected toys with Wi-Fi or Bluetooth, and wearable tracking devices marketed for children. The category does not require internet connectivity — any radio-communicating device in this market segment is in scope. ### How do I demonstrate compliance with Article 3(3)(e) personal data protection? Compliance with 3(3)(e) requires demonstrating that the radio equipment implements technical safeguards protecting personal data. ETSI EN 18031-2 provides the benchmark: it covers encryption of personal data in transit and at rest, access control to stored personal data, data minimisation measures, and secure storage of credentials. A conformity assessment against EN 18031-2 is the primary route to the presumption of conformity, but manufacturers can also document an equivalent level of protection using alternative technical measures with detailed justification in the technical file. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇪🇺 CE Marking roadmap for radio equipment Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take radio equipment through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/08-cybersecurity-compliance-connected-electronics)[Prefer to read? Get the book — $24.99](/books/08-cybersecurity-compliance-connected-electronics) Related guides * [EU Cyber Resilience ActEU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [EU AI Act HardwareEU AI Act implications for hardware makers: high-risk AI system classification, notified body conformity assessment, CE marking, and embedded AI component obligations.](/guides/eu-artificial-intelligence-act-hardware) * [CE Marking for Power BanksCE marking for portable chargers and power banks: LVD, EMC Directive, RoHS, EU Battery Regulation (EU) 2023/1542 labeling, and UN 38.3 transport testing obligations.](/guides/ce-marking-for-power-banks) * [EU GPSREU Regulation (EU) 2023/988 GPSR replaced the GPSD in December 2024: new traceability rules, online marketplace duties, digital product identifiers, and the SAREF rapid-alert notification obligation.](/guides/eu-gpsr-general-product-safety)