Do the radio equipment cybersecurity requirements apply to your product?

Who it applies to

Manufacturers, importers and distributors of radio equipment that connects, is worn, is a toy, or is made for childcare.

The dates

Binding since 1 August 2025.

The one thing to do

Decide which of Article 3(3)'s three requirements reach the product, then assemble the technical file and the declaration that say how it meets them.

The determination on its own page

The requirements, in the Official Journal's words

• 3(3)(d)

  Do not harm the network or misuse its resources

  radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service;

• 3(3)(e)

  Build in safeguards for personal data and privacy

  radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected;

• 3(3)(f)

  Support features that protect against fraud

  radio equipment supports certain features ensuring protection from fraud;

These requirements end, and the Cyber Resilience Act takes over

Commission Delegated Regulation (EU) 2026/339 repeals the act that switched these three requirements on, with effect from 11 December 2027. That is the day the Cyber Resilience Act applies in full.

The hand-off is deliberate. The Commission says Annex I to that Regulation already covers all the elements of points (d), (e) and (f). So the repeal stops one product being held to both.

Keep the records anyway. Market surveillance under the Radio Equipment Directive is untouched for equipment placed on the market between 1 August 2025 and the day before 11 December 2027. The design and test evidence behind it outlives the act that asked for it.

What changes on 11 December 2027, unit by unit

What switches each requirement on

The two derogations, and how far each reaches

• Medical devices are outside all three requirements

  By way of derogation from Article 1, the essential requirements set out in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU shall not apply to radio equipment to which either of the following Union legislation also applies: (a) Regulation (EU) 2017/745; (b) Regulation (EU) 2017/746.

• Aviation, vehicles and tolling lose only (e) and (f)

  By way of derogation from Article 1(2) and Article 1(3), the essential requirements set out in Article 3(3), points (e) and (f), of Directive 2014/53/EU shall not apply to radio equipment to which any of the following Union legislation also applies: (a) Regulation (EU) 2018/1139; (b) Regulation (EU) 2019/2144; (c) Directive (EU) 2019/520.

The conformity route, and what the standard is worth

• Directive 2014/53/EU, 17(3)

  Apply the cited standard and self-assessment stays open

  Where, in assessing the compliance of radio equipment with the essential requirements set out in Article 3(2) and (3), the manufacturer has applied harmonised standards the references of which have been published in the Official Journal of the European Union, he shall use any of the following procedures: (a) internal production control set out in Annex II; (b) EU-type examination that is followed by the conformity to type based on internal production control set out in Annex III; (c) conformity based on full quality assurance set out in Annex IV.

• Directive 2014/53/EU, 17(4)

  Without the cited standard a notified body is required

  Where, in assessing the compliance of radio equipment with the essential requirements set out in Article 3(2) and (3), the manufacturer has not applied or has applied only in part harmonised standards the references of which have been published in the Official Journal of the European Union, or where such harmonised standards do not exist, radio equipment shall be submitted with regard to those essential requirements to either of the following procedures: (a) EU-type examination that is followed by the conformity to type based on internal production control set out in Annex III; (b) conformity based on full quality assurance set out in Annex IV.

EN 18031, and why it is named rather than quoted

The harmonised standard series written for these three requirements is EN 18031. It is a paid standard, so this page names it and reproduces none of it. What the page carries is the citation below, in the Official Journal's own words. It says which part supports which requirement, and where the presumption of conformity does not reach.

A cited harmonised standard carries the presumption

Radio equipment which is in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the essential requirements set out in Article 3 covered by those standards or parts thereof.

The three parts, and where the presumption stops

• EN 18031-1:2024

  Supports Article 3(3)(d)

  Do not harm the network or misuse its resources

  2 limits on the presumption

  • The sections named “rationale” and “guidance”, in this harmonised standard, do not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (d), of Directive 2014/53/EU.
  • This harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (d), of Directive 2014/53/EU if, when applying its clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password.

• EN 18031-2:2024

  Supports Article 3(3)(e)

  Build in safeguards for personal data and privacy

  3 limits on the presumption

  • The sections named “rationale” and “guidance”, in this harmonised standard, do not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (e), of Directive 2014/53/EU.
  • This harmonised standard does not confer a presumption of conformity with Article 3(3), first subparagraph, point (e), of Directive 2014/53/EU if, by applying its clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password.
  • For the classes or categories of radio equipment covered by clause 6.1.3, 6.1.4, 6.1.5 or 6.1.6 of this harmonised standard, this harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (e), of Directive 2014/53/EU if, by applying its clauses 6.1.3.4.2, 6.1.4.4.2, 6.1.5.4.2 and 6.1.6.4.2, parental or guardian access control is not ensured.

• EN 18031-3:2024

  Supports Article 3(3)(f)

  Support features that protect against fraud

  3 limits on the presumption

  • The sections named “rationale” and “guidance”, in this harmonised standard, do not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (f), of Directive 2014/53/EU.
  • This harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (f), of Directive 2014/53/EU if, when applying its clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password.
  • As regards the assessment criteria set out in clause 6.3.2.4 of this harmonised standard, this harmonised standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (f), of Directive 2014/53/EU.

The references and the notices above are quoted from Commission Implementing Decision (EU) 2025/138, which added them to Annex I to Commission Implementing Decision (EU) 2022/2191. Read on 17 October 2026. That list is amended from time to time, so check it before you rely on a presumption.

What a manufacturer produces

• 18(1)Declare that the essential requirements are met
• 21(1)Assemble the technical documentation of Annex V
• 21(2)Have the documentation ready before you place it on the market
• 10(4)Keep the file and the declaration for ten years

What our integrations can and cannot show

Our integrations read your own cloud, identity and device estate. They cannot see what the equipment does, which is what Article 3(3) asks about, so the three essential requirements are always evidenced by your design and test records rather than by a connector. What the connectors do carry is the surrounding management system: the documented procedures, the records you have to keep, and the secure-development controls the file refers to.

Every requirement and derogation above is quoted from the Official Journal, in your language, through the catalogue this page reads. The application date is the one Delegated Regulation (EU) 2023/2444 substituted; the act as published says a year earlier. EUR-Lex

Questions people ask

Why did requirements written in 2014 only start applying in 2025?

Article 3(3) of the Directive reaches only the equipment categories a delegated act names, and for years none did. Delegated Regulation (EU) 2022/30 named them. Its own Article 3 said 1 August 2024, and Commission Delegated Regulation (EU) 2023/2444 replaced that paragraph, so the date that applies is 1 August 2025.

Is a wearable in scope even with no internet connection?

Yes, and this is the part most often read wrongly. The internet condition sits in point (a) of Article 1(2) alone. Childcare equipment, toys under Directive 2009/48/EC and anything worn on, strapped to or hung from the body or clothing are points (b), (c) and (d), and they carry no connection condition. What they do need is the ability to process personal data, or traffic data, or location data. Read the act as first published and you would think traffic and location data were both required: Delegated Regulation (EU) 2023/2444 replaced that introduction and either one is now enough.

Do we have to buy EN 18031?

No. A harmonised standard is voluntary and conformity is owed to the Directive's essential requirements, not to the standard. Article 17 makes the choice expensive rather than compulsory: apply the cited standards and internal production control stays open, so you can assess the equipment yourself. Do not apply them, apply them only in part, or find that none exists, and the equipment goes to EU-type examination or full quality assurance, both of which involve a notified body.

Does the Cyber Resilience Act replace this?

Yes, as of 11 December 2027. Commission Delegated Regulation (EU) 2026/339 repeals the act that switched these requirements on with effect from that day, and the Cyber Resilience Act applies in full from 11 December 2027. Its Annex I covers all the elements of points (d), (e) and (f), so one product is never held to both. Equipment placed on the market before then stays under the Directive's market surveillance.

What records does this leave behind?

The technical documentation of Annex V, drawn up before the equipment goes on the market and kept current, and the EU declaration of conformity stating that the essential requirements have been demonstrated. Both are kept for 10 years after the equipment is placed on the market.

Related:Free toolsArticles