CRA and RED Cybersecurity comparison for connected products

The CRA covers software and hardware products with direct or indirect logical or physical data connections to a device or network, including separately placed components and remote data-processing solutions on which a product function depends. Subject to exclusions and special rules, it requires manufacturers to assess cybersecurity risks, meet Annex I product-security and vulnerability-handling requirements, set and communicate a support period, prepare technical documentation, complete conformity assessment, issue an EU declaration of conformity, affix CE marking, give users required information, and cooperate with market-surveillance authorities.

The RED cybersecurity delegated act is narrower and requirement-specific. RED Article 3(3)(d), on avoiding harm to networks and misuse of network resources, applies to internet-connected radio equipment. Article 3(3)(e), on personal data and privacy, applies when specified internet-connected, childcare, toy, or wearable radio equipment can process personal, traffic, or location data. Article 3(3)(f), on protection from fraud, applies to internet-connected radio equipment that enables transfers of money, monetary value, or virtual currency.

The Commission CRA FAQ states that the RED cybersecurity requirements made applicable by Delegated Regulation (EU) 2022/30 apply to covered radio-equipment categories placed on the market on or after 1 August 2025.

Commission Delegated Regulation (EU) 2026/339 now repeals the RED delegated regulation with effect from 11 December 2027. Covered radio equipment placed on the market from 1 August 2025 through 10 December 2027 remains subject to the RED cybersecurity essential requirements, while covered products placed on the market on or after 11 December 2027 follow the CRA cybersecurity requirements. The Commission FAQ also explains that the repeal does not undo RED market-surveillance treatment for equipment placed on the market during the RED period.

A CRA file needs to show the cybersecurity risk assessment and how the product and vulnerability-handling processes meet the CRA's essential cybersecurity requirements. Annex VII names technical-documentation elements such as product description, design and production information, vulnerability-handling process details, software bill of materials where applicable, coordinated vulnerability disclosure policy, secure-update approach, support-period rationale, standards or technical specifications used, test reports, and the EU declaration of conformity.

For RED delegated-act work, keep the evidence tied to the applicable RED essential requirement and conformity-assessment route. The EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 references were published with limitations: the cited Commission decision states that rationale and guidance sections do not confer a presumption of conformity and gives additional limitations for password, parental-control, and payment-product cases. Using an EN 18031 standard therefore requires checking the Official Journal notices, not only the standard title.

The CRA standardisation request says CRA standards should build on RED delegated-regulation work where possible, while fully addressing CRA-specific requirements. A RED test report can support a CRA control only where the team maps the tested property to the relevant CRA requirement and identifies any gap.

Start with product facts. Identify whether the item intentionally emits or receives radio waves for radio communication or radiodetermination, whether it can communicate over the internet itself, whether it processes the data or payments that trigger Article 3(3)(e) or (f), whether it is a product with digital elements, and whether remote data processing is necessary for a product function.

Apply the dates to each individual unit or software product first placed on the EU market; an older model does not exempt newly placed units. Record separate conclusions for RED scope, CRA scope, the applicable date, the conformity route, and CRA reporting. A classification label such as "connected device" is not enough.