RED delegated act vs CRA: what changes on 11 December 2027
Delegated Regulation (EU) 2026/339, Article 1, and Regulation (EU) 2024/2847, Article 71(2), read in the Official Journal on 18 October 2026
On 11 December 2027 Delegated Regulation (EU) 2022/30 is repealed, and on 11 December 2027 the Cyber Resilience Act applies in full: the same day, set by two acts. For a radio-equipment maker, the EN 18031 presumption goes and CRA conformity starts. The day counts per unit, so one model can ship under both.
- Who it applies to
- Manufacturers, importers and distributors of radio equipment that connects, is worn, is a toy, or is made for childcare.
- The dates
- From 11 December 2027, for every unit placed on the market. Units placed from 1 August 2025 to 10 December 2027 stay under the Directive's market surveillance.
- The one thing to do
- Pick the units and where the CRA lists the product to see the law, the route and whether a notified body is involved.
Your units, before and from 11 December 2027
The day counts per unit, not per model. The answer is read from Delegated Regulation (EU) 2026/339 and Regulation (EU) 2024/2847. Nothing you pick leaves this page.
Pick the units, and for a unit the CRA reaches, where it lists the product.
Placed before 1 August 2025
- The law
- Neither the Directive's Article 3(3)(d), (e) and (f), which reach units placed from 1 August 2025, nor the CRA's requirements, unless the unit is substantially modified from 11 December 2027.
- The standard
- Not needed for these three points.
- Your route
- The Directive's procedure for the rest of Article 3, as when the unit was placed.
- Notified body
- As it was when the unit was placed
- Reporting
- CRA Article 14 has applied since 11 September 2026: actively exploited vulnerabilities and severe incidents are reported (Article 69(3)).
- What to do now
- Nothing changes on 11 December 2027. A substantial modification from that day brings the CRA in.
Placed from 1 August 2025 to 10 December 2027
- The law
- Directive 2014/53/EU, Article 3(3)(d), (e) and (f). After 11 December 2027 the unit stays answerable to them: recital 5 of Delegated Regulation (EU) 2026/339 keeps market surveillance in place.
- The standard
- EN 18031, where its citation's restrictions allow, presumes conformity with the three points.
- Your route
- Internal production control with the cited standards applied in full; otherwise a notified body (the Directive's Article 17(3) and (4)).
- Notified body
- Only if EN 18031 is not applied in full
- Reporting
- CRA Article 14 has applied since 11 September 2026 (Article 69(3)).
- What to do now
- Keep the technical documentation and the declaration 10 years from the day each unit was placed. The repeal does not end that duty.
Not listed
Placed on the market from 11 December 2027Substantially modified from 11 December 2027
- The law
- Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
- The standard
- EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
- Your route
- Internal control, module A, signed by you (Article 32(1)).
- Notified body
- No
- Reporting
- Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
- What to do now
- Build the CRA technical documentation and sign its declaration of conformity. Your EN 18031 test results carry over as evidence, not as a presumption.
Annex III, class I
Placed on the market from 11 December 2027Substantially modified from 11 December 2027
- The law
- Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
- The standard
- EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
- Your route
- Module A only with harmonised standards, common specifications or a European certification scheme at level substantial applied in full. No harmonised standard is cited. Otherwise modules B and C, or H (Article 32(2)).
- Notified body
- Yes, unless one of those is in place when you place the unit
- Reporting
- Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
- What to do now
- If you self-assess under the Directive today, plan a notified body for units placed from 11 December 2027, unless a standard is cited first.
Annex III, class II
Placed on the market from 11 December 2027Substantially modified from 11 December 2027
- The law
- Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
- The standard
- EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
- Your route
- EU-type examination with conformity to type (modules B and C), full quality assurance (module H), or a European certification scheme at level substantial (Article 32(3)).
- Notified body
- Yes, or a certification scheme
- Reporting
- Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
- What to do now
- Choose a notified body or a certification route now, so units placed from 11 December 2027 have one.
Annex IV, critical
Placed on the market from 11 December 2027Substantially modified from 11 December 2027
- The law
- Regulation (EU) 2024/2847, in full, from 11 December 2027. Article 3(1) and (2) of the Directive still apply to radio equipment.
- The standard
- EN 18031 presumes conformity with the Directive's three points, not with the CRA. Article 27(1) presumes conformity only for standards cited for Annex I, and none is, read on 18 October 2026.
- Your route
- A European cybersecurity certification scheme where a delegated act under Article 8(1) requires one, otherwise the class II procedures (Article 32(4)).
- Notified body
- Yes, or the certification the delegated act requires
- Reporting
- Article 14 has applied since 11 September 2026, to units placed before 11 December 2027 as well (Article 69(3)).
- What to do now
- Check whether a delegated act under Article 8(1) names a scheme for your category, then plan the route for units placed from 11 December 2027.
No card to start · cancel in-app anytime
The CRA's requirements as a catalogue, the technical file built from them, and the dates they come back, in one workspace.
Delegated Regulation (EU) 2026/339, Article 1 and recital 5; Regulation (EU) 2024/2847, Articles 27, 32, 69 and 71(2); the Blue Guide 2022, section 2.3. Read on 18 October 2026.
What changes on 11 December 2027
| Question | Answer | Source |
|---|---|---|
| Delegated Regulation (EU) 2022/30 | Repealed from 11 December 2027. | Delegated Regulation (EU) 2026/339, Article 1 |
| The Cyber Resilience Act | Applies in full from 11 December 2027. | Regulation (EU) 2024/2847, Article 71(2) |
| Why the same day | The CRA's Annex I covers all the elements of the Directive's Article 3(3)(d), (e) and (f), and the repeal stops one product being held to both. | Recitals 3 and 4 of Delegated Regulation (EU) 2026/339 |
| EN 18031 | Its citation presumes conformity with the Directive's three points only. A unit placed from 11 December 2027 does not owe them, so the citation gives it nothing. | Implementing Decision (EU) 2025/138 |
| Harmonised standards under the CRA | None cited, read on 18 October 2026. Article 27(1) presumes conformity only for standards cited for Annex I. | The Commission's index of harmonised standards |
| Class I radio products | Routers, baby monitors, connected toys and wearables for children or health are in Annex III, class I. Self-assessment needs a cited standard, common specifications or a certification scheme, applied in full. | Regulation (EU) 2024/2847, Article 32(2) and Annex III |
| Units placed from 1 August 2025 to 10 December 2027 | Stay answerable to the Directive's Article 3(3) after the repeal. Market surveillance of them continues. | Recital 5 of Delegated Regulation (EU) 2026/339 |
| Units placed before 11 December 2027 | Come under the CRA only if substantially modified from that day. Its reporting duties reach them already, since 11 September 2026. | Regulation (EU) 2024/2847, Article 69(2) and (3) |
| One model, two regimes | The day counts per unit. A unit placed from 11 December 2027 must meet the CRA even if the model first shipped years before. | The Blue Guide 2022, section 2.3 |
| The rest of the Directive | Article 3(1) and (2), health and safety, electromagnetic compatibility and spectrum, are untouched. Only the delegated act is repealed. | Delegated Regulation (EU) 2026/339, Article 1 |
StandardOS reads the two acts, the Commission's index and the Blue Guide. We do not certify radio equipment and are not a notified body.
Questions about 11 December 2027
When is the RED delegated act repealed?
From 11 December 2027, by Article 1 of Delegated Regulation (EU) 2026/339. The Cyber Resilience Act applies in full from 11 December 2027 under its own Article 71(2). The two dates are set separately and fall on the same day.
Does EN 18031 still give a presumption of conformity after 11 December 2027?
Not for a unit placed from that day. The citation in Implementing Decision (EU) 2025/138 presumes conformity with the Directive's Article 3(3)(d), (e) and (f), which such a unit no longer owes. Under the CRA, Article 27(1) presumes conformity only for standards cited for Annex I, and none is cited, read on 18 October 2026.
Can a class I radio product still be self-assessed under the CRA?
Only with harmonised standards, common specifications or a European certification scheme at level substantial applied in full (Article 32(2)). No harmonised standard is cited under the CRA, read on 18 October 2026. Without one of the three, units placed from 11 December 2027 need a notified body.
What happens to units already on the market?
A unit placed from 1 August 2025 to 10 December 2027 stays answerable to the Directive's Article 3(3), and market surveillance of it continues (recital 5 of Delegated Regulation (EU) 2026/339). It comes under the CRA only if substantially modified from 11 December 2027 (Article 69(2)).
Do the CRA's reporting duties wait for 11 December 2027?
No. Article 14 has applied since 11 September 2026, and Article 69(3) extends it to products placed on the market before 11 December 2027. Radio equipment in the CRA's scope already reports actively exploited vulnerabilities and severe incidents.
Is the whole Radio Equipment Directive replaced?
No. Only the delegated act that switched on Article 3(3)(d), (e) and (f) is repealed. Health and safety, electromagnetic compatibility and the efficient use of spectrum stay under the Directive (Article 3(1) and (2)).
Where to start
Sort your products by units, not models. Units shipping today stay answerable to the Directive after 11 December 2027. Units shipping from that day are CRA products, and their route depends on Annex III.
Whatever the route, the CRA technical file is yours to build. The CRA technical file
Radio equipment cybersecurity: the three requirementsThe Cyber Resilience ActEvery free tool and template
Sources, read on 18 October 2026: Delegated Regulation (EU) 2026/339 on EUR-Lex, Regulation (EU) 2024/2847 on EUR-Lex, The Commission's index of harmonised standards, The Blue Guide 2022 on EUR-Lex. This page reads the two acts, the Commission's index and the Blue Guide. It is not legal advice.