RED cybersecurity compliance workflow

Start with the actual product architecture and user journey. Article 3(3)(d) applies to radio equipment that can communicate itself over the internet, directly or through other equipment. Article 3(3)(e) applies when a listed category can process personal data, traffic data, or location data; the listed categories are internet-connected radio equipment, equipment designed or intended exclusively for childcare, radio equipment covered by the Toy Safety Directive, and equipment designed or intended to be worn on, strapped to, or hung from the body or clothing. The last three categories do not need an internet connection to enter the Article 3(3)(e) test. Article 3(3)(f) applies to internet-connected radio equipment that enables the holder or user to transfer money, monetary value, or virtual currency.

The classification memo should be short enough to review at release, but detailed enough to show how firmware, companion apps, cloud services, sensors, payment functions, and user roles were considered.

Before assigning controls, confirm whether another EU regime removes the product from one or more RED cyber requirements. Delegated Regulation (EU) 2022/30 excludes radio equipment covered by medical-device and in vitro diagnostic medical-device rules from Article 3(3)(d), (e), and (f). It also excludes equipment covered by the cited aviation, motor-vehicle, and electronic-road-toll legislation from Article 3(3)(e) and (f).

The application date was changed by Commission Delegated Regulation (EU) 2023/2444. The requirements apply to covered equipment placed on the Union market from 1 August 2025 through 10 December 2027. Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 from 11 December 2027, but expressly preserves RED market surveillance and compliance control for equipment placed on the market during that interval.

The evidence matrix should connect each applicable RED cyber requirement to concrete product evidence. A reviewer should be able to trace from the legal trigger to the product feature, safeguard, verification result, residual issue, release owner, and technical-documentation location.

Do not use a single cybersecurity policy as the only evidence. RED evidence should include product-specific architecture, firmware and software behavior, data flows, authentication and access controls, update behavior, abuse cases, test results, supplier inputs, and conformity-assessment decisions.

After classification and evidence mapping, decide how the manufacturer will demonstrate conformity. OJEU-cited harmonised standards give presumption of conformity only for the essential requirements and parts they cover. Standards are not mandatory, but Article 17 requires Annex III or Annex IV for an Article 3(3) requirement when the manufacturer does not apply the relevant cited standards, applies them only in part, or no such standards exist. Commission Implementing Decision (EU) 2025/138 cites EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 with notices that restrict presumption of conformity, so the standards record must identify the relevant part and every notice that affects the product's implementation.

Keep cyber evidence aligned with the broader RED technical documentation, EU declaration of conformity, CE marking decision, instructions, and post-release change controls. A firmware or cloud-service change can undermine the original evidence if the release process does not re-run the affected Article 3(3)(d/e/f) checks.