Does the RED Delegated Act Cover Your Wireless Product?

Last reviewed: 3 November 2026. General information, not legal advice.

If you sell a wireless product in the EU that goes online, EU security rules very likely apply to it. The same goes for a wireless toy, baby monitor or wearable that handles personal data. Regulators can order a product that fails them off the market, and those rules have applied since 1 August 2025.

They come from the RED delegated act, an add-on to the Radio Equipment Directive (RED), the EU law for radio products.

A delegated act is a rule the European Commission adds under a law that’s already passed, to fill in detail the law left open. This one, Delegated Regulation (EU) 2022/30, switched on three security protections the radio law had listed since 2014. And it’s repealed from 11 December 2027, when the Cyber Resilience Act (CRA), the EU’s wider security law for connected products, takes over.

Does it cover your product?

The act holds three separate requirements, each with its own trigger and each matched by one part of EN 18031, a set of three European standards written for these requirements. Your product can meet one trigger, two or all three, so check each row on its own.

Some products sit outside the rules. Medical devices and in-vitro diagnostic devices are outside all three. Radio equipment covered by the EU’s rules for vehicle type-approval, civil aviation or electronic road tolls still has to protect the network, but not the other two.

Not sure where your design sits? Our self-check on whether EN 18031 applies to your device walks through it question by question. If your product comes with a phone app or a cloud service, our checklist on whether EN 18031 covers your companion app and cloud covers that part.

Six example products

Here’s how we’d read the three triggers for some common designs. Treat each row as a worked example rather than a ruling on your own product.

The speaker still has to meet the radio law’s other requirements, such as safety and use of the radio spectrum. It’s only the three security requirements that don’t reach it.

Since when, and until when?

The act was adopted in 2021 and was due to apply from 1 August 2024. Then the Commission pushed that back a year, so the European standards bodies had time to write matching standards. The rules have applied since 1 August 2025 to products placed on the EU market, and a 2026 act repeals them from 11 December 2027, the day the Cyber Resilience Act applies in full.

The repeal doesn’t wipe the slate clean, though. The repealing act’s own reasons say regulators can still check radio products placed on the market between 1 August 2025 and 10 December 2027 against these rules. So a product you ship today can still be checked against them after 2027.

What does it make you do?

The act doesn’t list technical controls. Instead, it says the product must be built to meet each requirement that applies. The radio law then asks you to prove it the usual way, before the product goes on sale:

1. Meet the requirement. Design the product so it protects the network, personal data or against fraud, as each applies.
2. Show it. Run a conformity assessment, the process that shows your product meets the rules, and keep a technical file of the evidence.
3. Declare it. Sign an EU declaration of conformity and put the CE marking on the product, the mark that says it meets EU law.
4. Keep it. Hold the technical file and the declaration for 10 years after the product is placed on the market.

Where EN 18031 comes in

How you run step 2 depends on EN 18031. It’s a harmonised standard, one the EU has listed in its Official Journal, so following it gives a presumption of conformity: the product is presumed to meet the requirements it covers. If you apply it in full, you can assess the product yourself.

If you don’t apply it, or apply only part of it, the law says a notified body, an independent test body approved by an EU country, must take part. And that’s where the restrictions matter. The EU listed EN 18031 with exceptions, and if your design falls into one, the standard gives no presumption for that requirement:

• Skippable passwords. All three parts: no presumption if “the user is allowed not to set and use any password”.
• Toys and childcare products. Part 2: no presumption if parental or guardian access control isn’t ensured.
• Products that move money. Part 3: one set of assessment criteria, for secure updates, gives no presumption at all.

In our reading, a design caught by one of these needs a notified body for that requirement, and so does any Part 3 product. If that’s you, plan for one from the start.

Who checks, and what if you don’t comply?

Each EU country has market surveillance authorities, the national regulators who check products on sale. If they have reason to think a radio product doesn’t meet one of its requirements, the law tells them to evaluate it, and if it fails, to make you fix it, withdraw it or recall it. If you don’t act in time, they can ban or restrict it on their market, or withdraw or recall it themselves.

Missing paperwork counts too. A product with no CE marking, no declaration of conformity or an incomplete technical file can be restricted, withdrawn or recalled if the gap isn’t fixed. Importers also have to check that you’ve done the assessment, the technical file and the CE marking before they place your product on the market.

Fines aren’t set at EU level. Each country sets its own penalties, which the directive says must be “effective, proportionate and dissuasive” and “may include criminal penalties for serious infringements”. So the amount depends on where the problem is found.

Selling in the UK too?

Northern Ireland follows the act. The UK government’s factsheet says it “applies from 1 August 2025 in NI under the Windsor Framework”, and radio products made available there are excepted from PSTI, the UK’s own security rules for consumer smart products.

Great Britain is different. There, the same factsheet says “CE marked radio equipment placed on the GB market will need to meet these requirements”, and PSTI applies on top where the product is in its scope. Our comparison of PSTI, the CRA and EN 18031 and when each applies sets the UK and EU rules side by side.

What changes in December 2027

The CRA takes over from the delegated act. The Commission’s repealing act says the CRA’s requirements “include all the elements” of the three radio requirements, and repeals the old act so radio products aren’t “simultaneously subject” to both.

For your products, that plays out in three ways:

• Products you place on the market from 11 December 2027 must meet the CRA, where it covers them, rather than the three radio requirements.
• Products placed on the market before that date fall under the CRA’s main requirements only if they’re substantially modified from then on.
• CRA reporting already applies to both: since 11 September 2026, you must send an early warning within 24 hours of learning that attackers are exploiting a flaw in a product the CRA covers, or of a severe incident affecting its security, including for products already on sale.

The CRA also asks for things the radio rules’ text doesn’t mention, such as a support period for security updates and a contact address for reporting vulnerabilities. Building those now means less rework in 2027.

For how many device apps could we find a way to report a flaw?

A published way to report a security flaw is one of the things the CRA adds, so we checked how many connected-device apps’ makers already publish one.

A route we couldn’t find doesn’t mean a maker is breaking the law, and the radio rules don’t ask for one. But it’s one of the first things a researcher, a buyer or a regulator sees. You can look up a maker in our connected-device readiness explorer, which shows the figures from its own monthly run (read on 3 November 2026), so they can differ from the 21 October study.

What to do this week

1. List every wireless product you sell in the EU and mark which of the three requirements each one triggers, and any exclusion you rely on.
2. Check your design against the EN 18031 restrictions: password set-up, parental controls on toys and childcare products, and secure updates on anything that moves money. If one bites, book a notified body now.
3. Check the paperwork for each product: a technical file that covers the security requirements, a declaration of conformity and the CE marking.
4. Add the UK where it applies: Northern Ireland follows the EU act. In Great Britain, CE-marked radio products must meet it too, and PSTI applies on top where the product is in its scope.
5. Plan for 2027: make sure someone owns the CRA’s 24-hour warnings (exploited flaws and severe incidents) today, and publish a way to report flaws and a support period before the CRA requires them.

We also do this as a paid readiness review: an outside check of which rules reach each product, and of your evidence before a lab or a regulator sees it. Email support@securebydesignlabs.com.

For engineers

The three requirements

• The requirements: Article 3(3) of Directive 2014/53/EU: (d) “radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service”; (e) “radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected”; (f) “radio equipment supports certain features ensuring protection from fraud”. The second subparagraph empowers the Commission to adopt delegated acts specifying which categories or classes each applies to.

Who they apply to, and exclusions

• Who they apply to: Delegated Regulation (EU) 2022/30, Article 1(1): (d) applies to “any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment (‘internet-connected radio equipment’)”. Article 1(2): (e) applies where the equipment is capable of processing personal data, or “traffic data or location data” (wording as corrected by Delegated Regulation (EU) 2023/2444, Article 2), and it is (a) internet-connected, (b) “designed or intended exclusively for childcare”, (c) covered by the Toy Safety Directive 2009/48/EC, or (d) designed or intended to be worn on, strapped to or hung from the body or clothing. Article 1(3): (f) applies to internet-connected radio equipment that “enables the holder or user to transfer money, monetary value or virtual currency”. Recital 5 describes internet-connected equipment as equipment that “operates protocols necessary to exchange data with the internet either directly or by means of an intermediate equipment”.
• Exclusions: Article 2(1): none of the three applies where Regulation (EU) 2017/745 (medical devices) or 2017/746 (in-vitro diagnostics) also applies. Article 2(2): (e) and (f) don’t apply where Regulation (EU) 2018/1139 (civil aviation), Regulation (EU) 2019/2144 (vehicle type-approval) or Directive (EU) 2019/520 (electronic road tolls) also applies.

Dates

• Application: Article 3 of 2022/30 originally read “It shall apply from 1 August 2024”; 2023/2444, Article 1, replaced it with “It shall apply from 1 August 2025.” 2022/30 was published in the Official Journal on 12 January 2022 and 2023/2444 on 27 October 2023.

Repeal and the CRA

• Repeal: Delegated Regulation (EU) 2026/339 (published 29 April 2026), Article 1: “Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027.” Recital 3: the CRA’s Annex I requirements “include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU”. Recital 4: the repeal prevents radio equipment “from being simultaneously subject to requirements also concerning cybersecurity set out in Regulation (EU) 2024/2847”. Recital 5: the repeal “does not affect the Union market surveillance and control” of radio equipment placed on the market “between 1 August 2025 … and 10 December 2027”.
• CRA: Regulation (EU) 2024/2847, Article 71(2): “This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.” Article 69(2): products placed on the market before 11 December 2027 are subject to its requirements “only if, from that date, those products are subject to a substantial modification”; Article 69(3): Article 14 applies to all in-scope products placed on the market before that date. Article 14(2)(a): an early warning “within 24 hours” of becoming aware of an actively exploited vulnerability. Article 14(4)(a): the same early warning for “a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it”. Annex I, Part II, point (6): “a contact address for the reporting of the vulnerabilities”. Article 13(8): a support period.

Conformity procedures

• Presumption and procedures: Directive 2014/53/EU, Article 16 (presumption of conformity from harmonised standards published in the Official Journal); Article 17(3) (where those standards are applied for Article 3(2) and (3), internal production control under Annex II, Module A, is one of the permitted procedures); Article 17(4) (where they are “not applied or … applied only in part”, or don’t exist, EU-type examination under Annex III or full quality assurance under Annex IV, both of which involve a notified body). Article 10(3) and (4): technical documentation, conformity assessment, EU declaration of conformity and CE marking; both documents kept “for 10 years after the radio equipment has been placed on the market”. Article 12(2): importers’ checks.

The EN 18031 listing

• EN 18031 listing: Implementing Decision (EU) 2025/138 (published and in force 30 January 2025) adds EN 18031-1:2024, -2:2024 and -3:2024 to Annex I of Implementing Decision (EU) 2022/2191 as rows 164 to 166. Notices on each row: the “rationale” and “guidance” sections confer no presumption; no presumption if, under clauses 6.2.5.1 and 6.2.5.2, “the user is allowed not to set and use any password”. EN 18031-2 Notice 3: no presumption for equipment covered by clauses 6.1.3 to 6.1.6 if “parental or guardian access control is not ensured”. EN 18031-3 Notice 3: “As regards the assessment criteria set out in clause 6.3.2.4 of this harmonised standard, this harmonised standard does not confer a presumption of conformity” with Article 3(3)(f). On 3 November 2026 the acts amending 2022/2191 after 2025/138 contained no change to these rows.

Enforcement

• Market surveillance: Directive 2014/53/EU, Article 40(1), first subparagraph as replaced by Directive (EU) 2022/2380: authorities that have sufficient reason to believe radio equipment “does not comply with at least one of the applicable essential requirements set out in Article 3” carry out an evaluation; second subparagraph: corrective action, withdrawal or recall; Article 40(4): provisional measures to prohibit, restrict, withdraw or recall. Article 43(1)(b), (d) and (f) and 43(2): missing CE marking, declaration of conformity or technical documentation.
• Penalties: Article 46: rules set by Member States, “effective, proportionate and dissuasive”, and they “may include criminal penalties for serious infringements”.
• UK: GOV.UK, Regulation (EU) 2022/30: factsheet (Office for Product Safety and Standards, updated 16 December 2025): Northern Ireland, the Windsor Framework, the PSTI exception for products in the Radio Equipment Directive’s scope made available in Northern Ireland, and CE-marked radio equipment on the GB market.

Sources and limits

• EU legal texts: Directive 2014/53/EU as amended by Directive (EU) 2022/2380, Delegated Regulations (EU) 2022/30, 2023/2444 and 2026/339, Implementing Decision (EU) 2025/138 and Regulation (EU) 2024/2847, as published in the Official Journal. On 3 November 2026 we checked the Publications Office for later amending acts and corrigenda and found none that change what’s quoted here.
• UK: the GOV.UK factsheet on Regulation (EU) 2022/30, read on 3 November 2026.
• We name EN 18031 only as the law lists it; we don’t reproduce the standard.
• Our figures: SecureByDesignLabs check of connected-device makers’ websites, 21 October 2026. We measured what’s published on websites only, not whether any product meets any of these laws. The method and limits are on the linked study.
• The example products are our reading of the rules for typical designs. Where we say “in our reading”, that’s our interpretation, not a statement of the law.

Last reviewed 3 November 2026. This is general information, not legal advice.