Short answer
Since 1 August 2025, many internet-connected radio products must meet cybersecurity requirements under Delegated Regulation (EU) 2022/30 of the Radio Equipment Directive, usually demonstrated with the EN 18031 standards. Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act (EU) 2024/2847. From 11 December 2027 the Cyber Resilience Act applies in full and replaces the RED cybersecurity rules.
If you make smart plugs, cameras, routers, wearables, connected toys or anything else with a radio and a network connection, EU cybersecurity rules now apply to you. They come in two layers, with three dates to remember.
Layer 1: RED cybersecurity, since 1 August 2025
Delegated Regulation (EU) 2022/30 activated three essential requirements of the Radio Equipment Directive 2014/53/EU, in Article 3(3)(d), (e) and (f):
- (d) the device must not harm the network or misuse network resources;
- (e) it must protect personal data and privacy;
- (f) it must protect against fraud, for products that handle money or value.
They apply to internet-connected radio equipment, radio-enabled toys and childcare equipment, and wearables.
The EN 18031 standards and their restrictions
The harmonised standards are EN 18031-1, -2 and -3:2024. The European Commission published their references in the Official Journal with restrictions, for example on default passwords. In practice:
- if you apply the relevant EN 18031 standard in full and none of the restrictions affects your product, you can self-declare conformity;
- if a restriction applies, or you do not apply the standards in full, a notified body must issue an EU-type examination certificate before you place the product on the market.
You can find notified bodies competent for Articles 3(3)(d), (e) and (f) in the European Commission’s NANDO database.
Layer 2: the Cyber Resilience Act
The Cyber Resilience Act, Regulation (EU) 2024/2847, covers almost all products with digital elements, with or without radio. It entered into force on 10 December 2024 and applies in stages.
11 September 2026: reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products to the competent CSIRT and to ENISA, through ENISA’s Single Reporting Platform. The first early warning is due within 24 hours. This applies to products already on the EU market too.
For a manufacturer established outside the EU, the competent CSIRT depends on where its EU representative or other EU operator is established. Breaches of the reporting obligations can be fined up to 15 million EUR or 2.5% of worldwide annual turnover, whichever is higher.
11 December 2027: full application
The Act’s security requirements, conformity assessment, technical documentation and CE marking rules apply in full. On the same date, Delegated Regulation (EU) 2022/30 is repealed by Delegated Regulation (EU) 2026/339, so radio products move from the RED cybersecurity rules to the Cyber Resilience Act.
What to do now
- List your products with radio or network functions.
- Check your EN 18031 test reports and whether any restriction applies.
- Set up a vulnerability handling process and an ENISA reporting account.
- Plan your CRA technical documentation for December 2027.
How ISOCONSULT helps
As your EU Authorized Representative, ISOCONSULT S.R.L. checks that your RED documentation covers the cybersecurity requirements, keeps your technical file for authorities and informs you of any request. Reporting under the Cyber Resilience Act remains the manufacturer’s obligation; we help you prepare. Request a quote.
This article is general information about EU product legislation and is not legal advice. Requirements depend on the exact product; contact us for an assessment of your case.