CRA and RED Cybersecurity comparison for connected products

Covers products with digital elements placed on the EU market, including software or hardware products and covered remote data-processing solutions.

Covers categories of radio equipment specified in Delegated Regulation (EU) 2022/30, through RED Article 3(3)(d), (e), and (f).

Classify radio-equipment status and product-with-digital-elements status separately. A product can be both, but one conclusion does not prove the other.

CRA generally applies from 11 December 2027, with Article 14 reporting from 11 September 2026 and notified-body provisions from 11 June 2026.

For categories covered by Delegated Regulation (EU) 2022/30, the Commission FAQ describes a RED cybersecurity window for products placed on the market from 1 August 2025 through 10 December 2027.

For a radio product, keep the market-placement date in the release file. The applicable cybersecurity route can turn on whether the product is placed before or after 11 December 2027.

CRA duties include cybersecurity risk assessment, essential cybersecurity requirements, effective vulnerability handling during the support period, technical documentation, conformity assessment, EU declaration of conformity, CE marking, user instructions, and cooperation with market-surveillance authorities.

The RED delegated act makes RED cybersecurity essential requirements applicable to covered radio equipment; evidence should stay tied to the RED conformity route and applicable radio-equipment standards or tests.

A RED technical file is not automatically a complete CRA file. Check whether it also covers support-period rationale, vulnerability-handling processes, CRA technical documentation, and Article 14 reporting readiness.

Products with digital elements placed on the market before 11 December 2027 are generally subject to CRA requirements only if substantially modified from that date, but Article 14 reporting applies to in-scope products.

If covered radio equipment was placed on the EU market during the RED cybersecurity window, later repeal of the delegated act would not undo RED market-surveillance treatment for that period.

Do not retrofit every pre-11 December 2027 product into full CRA documentation solely because the CRA starts applying. Do keep Article 14 reporting readiness and preserve RED evidence for radio equipment placed during the RED window.

CRA harmonised standards are being developed under a CRA standardisation request and must address the CRA's own essential cybersecurity requirements.

RED delegated-act standards work, including the EN 18031 context described by the Commission FAQ, can inform CRA standards and evidence where requirements overlap.

Reuse mappings, tests, and controls only after identifying which CRA requirement and which RED requirement each item supports.

The CRA applies in full from 11 December 2027, with earlier Article 14 reporting from 11 September 2026 and Chapter IV from 11 June 2026.

The RED cybersecurity delegated act applies to covered radio equipment placed on the market from 1 August 2025 and is described by the Commission as a transition measure until 10 December 2027.

Use the product's first EU market-placement date to decide whether the file needs RED transition evidence, CRA evidence, or both.

Under the CRA, the technical file must support conformity assessment, CE marking, the EU declaration of conformity, and market-surveillance responses for products with digital elements.

Under the RED delegated act, the evidence file must support compliance with the RED cybersecurity requirements for the covered radio-equipment category and the standards used for that route.

Keep one file structure, but split the legal basis. A shared test report can sit in both files only if each file says exactly what it proves.

The CRA can still apply to a wireless product even when the product also falls within the RED cybersecurity scope.

The RED delegated act can still govern radio-equipment cybersecurity for the same product during the transition window.

Treat overlap as an evidence-management problem, not as a choice between regimes. Decide which obligations come from the CRA and which come from the RED route.

If the product is a product with digital elements, apply the CRA analysis for the unit or software version being placed on the market.

If the product is covered radio equipment under Delegated Regulation (EU) 2022/30, apply the RED delegated-act analysis for the same market-placement event.

Use the same release record to answer both questions, then file the CRA and RED conclusions separately so the compliance team can see which regime is doing which job.