The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you

Radio equipment cybersecurity

RED delegated act vs CRA: what changes on 11 December 2027

Delegated Regulation (EU) 2026/339, Article 1, and Regulation (EU) 2024/2847, Article 71(2), read in the Official Journal on 18 October 2026

On 11 December 2027 Delegated Regulation (EU) 2022/30 is repealed, and on 11 December 2027 the Cyber Resilience Act applies in full: the same day, set by two acts. For a radio-equipment maker, the EN 18031 presumption goes and CRA conformity starts. The day counts per unit, so one model can ship under both.

Who it applies to
Manufacturers, importers and distributors of radio equipment that connects, is worn, is a toy, or is made for childcare.
The dates
From 11 December 2027, for every unit placed on the market. Units placed from 1 August 2025 to 10 December 2027 stay under the Directive's market surveillance.
The one thing to do
Pick the units and where the CRA lists the product to see the law, the route and whether a notified body is involved.

Your units, before and from 11 December 2027

The day counts per unit, not per model. The answer is read from Delegated Regulation (EU) 2026/339 and Regulation (EU) 2024/2847. Nothing you pick leaves this page.

Which units are you asking about?
Where does the CRA list the product?

Pick the units, and for a unit the CRA reaches, where it lists the product.

Placed before 1 August 2025

The law
Neither the Directive's Article 3(3)(d), (e) and (f), which reach units placed from 1 August 2025, nor the CRA's requirements, unless the unit is substantially modified from 11 December 2027.
The standard
Not needed for these three points.
Your route
The Directive's procedure for the rest of Article 3, as when the unit was placed.
Notified body
As it was when the unit was placed
Reporting
CRA Article 14 has applied since 11 September 2026: actively exploited vulnerabilities and severe incidents are reported (Article 69(3)).
What to do now
Nothing changes on 11 December 2027. A substantial modification from that day brings the CRA in.

Placed from 1 August 2025 to 10 December 2027

The law
Directive 2014/53/EU, Article 3(3)(d), (e) and (f). After 11 December 2027 the unit stays answerable to them: recital 5 of Delegated Regulation (EU) 2026/339 keeps market surveillance in place.
The standard
EN 18031, where its citation's restrictions allow, presumes conformity with the three points.
Your route
Internal production control with the cited standards applied in full; otherwise a notified body (the Directive's Article 17(3) and (4)).
Notified body
Only if EN 18031 is not applied in full
Reporting
CRA Article 14 has applied since 11 September 2026 (Article 69(3)).
What to do now
Keep the technical documentation and the declaration 10 years from the day each unit was placed. The repeal does not end that duty.

Not listed

Placed on the market from 11 December 2027Substantially modified from 11 December 2027

The law
Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
The standard
EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
Your route
Internal control, module A, signed by you (Article 32(1)).
Notified body
No
Reporting
Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
What to do now
Build the CRA technical documentation and sign its declaration of conformity. Your EN 18031 test results carry over as evidence, not as a presumption.

Annex III, class I

Placed on the market from 11 December 2027Substantially modified from 11 December 2027

The law
Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
The standard
EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
Your route
Module A only with harmonised standards, common specifications or a European certification scheme at level substantial applied in full. No harmonised standard is cited. Otherwise modules B and C, or H (Article 32(2)).
Notified body
Yes, unless one of those is in place when you place the unit
Reporting
Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
What to do now
If you self-assess under the Directive today, plan a notified body for units placed from 11 December 2027, unless a standard is cited first.

Annex III, class II

Placed on the market from 11 December 2027Substantially modified from 11 December 2027

The law
Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
The standard
EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
Your route
EU-type examination with conformity to type (modules B and C), full quality assurance (module H), or a European certification scheme at level substantial (Article 32(3)).
Notified body
Yes, or a certification scheme
Reporting
Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
What to do now
Choose a notified body or a certification route now, so units placed from 11 December 2027 have one.

Annex IV, critical

Placed on the market from 11 December 2027Substantially modified from 11 December 2027

The law
Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
The standard
EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
Your route
A European cybersecurity certification scheme where a delegated act under Article 8(1) requires one, otherwise the class II procedures (Article 32(4)).
Notified body
Yes, or the certification the delegated act requires
Reporting
Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
What to do now
Check whether a delegated act under Article 8(1) names a scheme for your category, then plan the route for units placed from 11 December 2027.
Start the CRA file

No card to start · cancel in-app anytime

The CRA's requirements as a catalogue, the technical file built from them, and the dates they come back, in one workspace.

Delegated Regulation (EU) 2026/339, Article 1 and recital 5; Regulation (EU) 2024/2847, Articles 27, 32, 69 and 71(2); the Blue Guide 2022, section 2.3. Read on 18 October 2026.

What changes on 11 December 2027

What changes for radio equipment on the day the delegated act is repealed, with the source of each line
QuestionAnswerSource
Delegated Regulation (EU) 2022/30Repealed from 11 December 2027.Delegated Regulation (EU) 2026/339, Article 1
The Cyber Resilience ActApplies in full from 11 December 2027.Regulation (EU) 2024/2847, Article 71(2)
Why the same dayThe CRA's Annex I covers all the elements of the Directive's Article 3(3)(d), (e) and (f), and the repeal stops one product being held to both.Recitals 3 and 4 of Delegated Regulation (EU) 2026/339
EN 18031Its citation presumes conformity with the Directive's three points only. A unit placed from 11 December 2027 does not owe them, so the citation gives it nothing.Implementing Decision (EU) 2025/138
Harmonised standards under the CRANone cited, read on 18 October 2026. Article 27(1) presumes conformity only for standards cited for Annex I.The Commission's index of harmonised standards
Class I radio productsRouters, baby monitors, connected toys and wearables for children or health are in Annex III, class I. Self-assessment needs a cited standard, common specifications or a certification scheme, applied in full.Regulation (EU) 2024/2847, Article 32(2) and Annex III
Units placed from 1 August 2025 to 10 December 2027Stay answerable to the Directive's Article 3(3) after the repeal. Market surveillance of them continues.Recital 5 of Delegated Regulation (EU) 2026/339
Units placed before 11 December 2027Come under the CRA only if substantially modified from that day. Its reporting duties reach them already, since 11 September 2026.Regulation (EU) 2024/2847, Article 69(2) and (3)
One model, two regimesThe day counts per unit. A unit placed from 11 December 2027 must meet the CRA even if the model first shipped years before.The Blue Guide 2022, section 2.3
The rest of the DirectiveArticle 3(1) and (2), health and safety, electromagnetic compatibility and spectrum, are untouched. Only the delegated act is repealed.Delegated Regulation (EU) 2026/339, Article 1

StandardOS reads the two acts, the Commission's index and the Blue Guide. We do not certify radio equipment and are not a notified body.

Questions about 11 December 2027

When is the RED delegated act repealed?

From 11 December 2027, by Article 1 of Delegated Regulation (EU) 2026/339. The Cyber Resilience Act applies in full from 11 December 2027 under its own Article 71(2). The two dates are set separately and fall on the same day.

Does EN 18031 still give a presumption of conformity after 11 December 2027?

Not for a unit placed from that day. The citation in Implementing Decision (EU) 2025/138 presumes conformity with the Directive's Article 3(3)(d), (e) and (f), which such a unit no longer owes. Under the CRA, Article 27(1) presumes conformity only for standards cited for Annex I, and none is cited, read on 18 October 2026.

Can a class I radio product still be self-assessed under the CRA?

Only with harmonised standards, common specifications or a European certification scheme at level substantial applied in full (Article 32(2)). No harmonised standard is cited under the CRA, read on 18 October 2026. Without one of the three, units placed from 11 December 2027 need a notified body.

What happens to units already on the market?

A unit placed from 1 August 2025 to 10 December 2027 stays answerable to the Directive's Article 3(3), and market surveillance of it continues (recital 5 of Delegated Regulation (EU) 2026/339). It comes under the CRA only if substantially modified from 11 December 2027 (Article 69(2)).

Do the CRA's reporting duties wait for 11 December 2027?

No. Article 14 has applied since 11 September 2026, and Article 69(3) extends it to products placed on the market before 11 December 2027. Radio equipment in the CRA's scope already reports actively exploited vulnerabilities and severe incidents.

Is the whole Radio Equipment Directive replaced?

No. Only the delegated act that switched on Article 3(3)(d), (e) and (f) is repealed. Health and safety, electromagnetic compatibility and the efficient use of spectrum stay under the Directive (Article 3(1) and (2)).

Where to start

Sort your products by units, not models. Units shipping today stay answerable to the Directive after 11 December 2027. Units shipping from that day are CRA products, and their route depends on Annex III.

Whatever the route, the CRA technical file is yours to build. The CRA technical file

Radio equipment cybersecurity: the three requirementsThe Cyber Resilience ActEvery free tool and template

Sources, read on 18 October 2026: Delegated Regulation (EU) 2026/339 on EUR-Lex, Regulation (EU) 2024/2847 on EUR-Lex, The Commission's index of harmonised standards, The Blue Guide 2022 on EUR-Lex. This page reads the two acts, the Commission's index and the Blue Guide. It is not legal advice.

This page in:DeutschFrançaisNederlandsEspañolDansk