Commission Delegated Regulation (EU) 2022/30 activates RED Article 3(3)(d), (e), and (f) for defined categories of radio equipment, including internet-connected products, childcare equipment, toy radio equipment, wearables, and payment-capable .
This page maps a product to the correct cybersecurity, privacy, and fraud-protection category, checks the exclusions, and explains the current 1 August 2025 to 10 December 2027 RED transition.
The RED cybersecurity category decision has three separate outputs. First confirm Directive 2014/53/EU scope. Then test whether the product is for Article 3(3)(d), whether a listed product can process personal, traffic, or location data for point (e), and whether it enables value transfers for point (f), before applying the sector exclusions. These requirements cover market placement from 1 August 2025 through 10 December 2027; repeal takes effect on 11 December 2027 without ending surveillance of equipment placed during that interval.
1
Section 1
Which product categories trigger Article 3(3)(d), (e), and (f)?
Delegated Regulation (EU) 2022/30 applies three different RED Article 3(3) points to different triggers. Article 3(3)(d), the network-protection requirement, applies when the equipment itself can exchange data with the internet, whether directly or through another product. A Bluetooth or Wi-Fi path through a phone or gateway can therefore qualify; local radio capability with no internet communication does not qualify on that fact alone.
Article 3(3)(e), the personal-data and privacy requirement, applies only when the covered radio equipment can process personal data, traffic data, or location data. The covered categories are , equipment designed or intended exclusively for childcare, equipment covered by the Toy Safety Directive, and equipment designed or intended, exclusively or not, to be worn on, strapped to, or hung from the body or clothing. Examples in the delegated act include child monitors and radio equipment in the form of a wristwatch, ring, wristband, headset, earphone, or glasses.
Article 3(3)(f), the fraud-protection requirement, applies to that enables the holder or user to transfer money, monetary value, or virtual currency. Ordinary online purchasing on a separate device, general internet access, or storage of account data does not establish this trigger without a product function that enables the transfer.
Use Article 3(3)(d) for , including products that reach the internet through other equipment.
Use Article 3(3)(e) only after confirming both a covered category and the ability to process personal data, traffic data, or location data.
Treat baby monitors and other exclusively childcare radio equipment as a separate Article 3(3)(e) category when they meet the data-processing condition, even if they are not internet-connected.
Treat toy radio equipment covered by Directive 2009/48/EC and wearable radio equipment as Article 3(3)(e) categories when the data-processing condition is met.
Use Article 3(3)(f) for that enables transfers of money, monetary value, or virtual currency.
Amends and corrects Delegated Regulation (EU) 2022/30, including the Article 3(3)(e) introductory wording and the application date.
personal data, as defined in Article 4(1)
2
Section 2
What exclusions should be checked before scoping a product in?
The delegated act includes targeted exclusions, so a product-category decision should not stop at the first apparent match. Radio equipment to which the Medical Devices Regulation or In Vitro Diagnostic Medical Devices Regulation applies is excluded from all three requirements activated by Delegated Regulation (EU) 2022/30. The product must actually fall under the cited sector regulation; health-related marketing or use near a patient is not enough.
For Article 3(3)(e) and (f), the delegated act also excludes radio equipment to which the civil aviation safety regulation, motor-vehicle general safety type-approval regulation, or electronic road toll systems directive applies. Those sector exclusions do not remove Article 3(3)(d), and none erases RED generally; they narrow only the delegated act points named in Article 2.
Check Regulation (EU) 2017/745 and Regulation (EU) 2017/746 before applying Article 3(3)(d), (e), or (f) under this delegated act.
For Article 3(3)(e) and (f), also check Regulation (EU) 2018/1139, Regulation (EU) 2019/2144, and Directive (EU) 2019/520.
Record the exclusion analysis at product-family and variant level, because software, connectivity, payment, sensor, or market-positioning changes can alter the conclusion.
Do not use common-charger scope, CE-marking status, or generic IoT labels as substitutes for the delegated act category test.
Primary source for the delegated act exclusions for medical devices, in vitro diagnostic medical devices, civil aviation, motor vehicles, and electronic toll systems.
Primary RED source for the broader radio equipment framework into which the delegated act is inserted.
radio equipment
3
Section 3
When do the cybersecurity category requirements apply?
Delegated Regulation (EU) 2023/2444 moved the application date to 1 August 2025. Delegated Regulation (EU) 2026/339 now repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027, the date on which the Cyber Resilience Act applies in full.
For equipment placed on the Union market from 1 August 2025 through 10 December 2027, keep the RED Article 3(3)(d), (e), and (f) category decision and conformity evidence. The 2026 repeal expressly preserves market surveillance and control of compliance for equipment placed on the market during that period. Products placed on the market from 11 December 2027 need a fresh regime analysis rather than an assumption that the old RED category record alone covers the Cyber Resilience Act.
Use 1 August 2025 for the Delegated Regulation (EU) 2022/30 cybersecurity category application date.
Use 10 December 2027 as the last day before the delegated act's repeal takes effect; preserve evidence for equipment placed on the market during the RED cybersecurity period.
Keep the category decision, standards strategy, conformity assessment route, security test evidence, and EU declaration update aligned to that date.
Distinguish individual units placed on the market before 1 August 2025 from units first placed on the market on or after that date; continued availability of a product family does not answer when a particular unit was placed on the market.
Recheck the category decision when harmonised standards, product functions, payment flows, data processing, intended use, or exclusion status changes.
Binding repeal from 11 December 2027 and preservation of RED market surveillance for covered equipment placed on the market between 1 August 2025 and 10 December 2027.
repealed with effect from 11 December 2027
4
Section 4
What evidence should a product-category review retain?
The evidence should let a reviewer repeat the category decision without reconstructing the product history. For each product family and market variant, keep the radio-equipment basis, network diagram, protocol and internet-communication analysis, data and sensor inventory, intended-use claims, childcare or toy classification, wearable design assessment, payment-transfer flow, exclusions checked, market-placement date, applicable Article 3(3) points, standards position, and conformity assessment route.
This page is a scope artifact, not a full security-control catalogue. The product file still needs the security design, test reports, standards mapping, supplier inputs, software-version evidence, EU declaration of conformity, and notified-body documentation where the chosen RED conformity assessment route requires it. EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 are OJEU-cited for the three cybersecurity requirements, but Commission Implementing Decision (EU) 2025/138 attaches restrictions. A standards matrix must capture those notices instead of treating an EN 18031 report as unrestricted presumption of conformity.
Keep a dated category matrix that separately answers Article 3(3)(d), (e), and (f), rather than one combined yes/no cybersecurity label.
Attach product specifications showing radio function, direct and indirect internet paths, sensors, microphones, cameras, location features, cloud paths, payment flows, and intended user group.
Keep the exclusion check with citations to the sector legislation considered and the reason it did or did not apply.
Tie the result to release gates for design, firmware, app, cloud service, packaging claims, instructions, supplier declarations, standards updates, and conformity assessment.
Reopen the record after material firmware, hardware, data-processing, payment, accessory, intended-use, supplier, market, or legal-source changes.
Publishes EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 with restrictions that limit presumption of conformity for specified guidance, password, parental-control, and secure-update cases.
with restrictions
Recommended next step
Turn RED cybersecurity scope into release evidence
This RED category guide helps align product, regulatory, security, quality, legal, and supplier teams around Article 3(3)(d), (e), and (f) scope, exclusions, application timing, standards strategy, and retained evidence.
Primary delegated act defining which categories and classes of radio equipment are covered by RED Article 3(3)(d), (e), and (f).
Primary source defining the radio equipment categories covered by Article 3(3)(d), (e), and (f).
Primary source for the delegated act exclusions for medical devices, in vitro diagnostic medical devices, civil aviation, motor vehicles, and electronic toll systems.
Show 1 more
Primary source for the product-category matrix and Article 3(3)(d), (e), and (f) scoping questions.
Repeals Delegated Regulation (EU) 2022/30 from 11 December 2027 and preserves surveillance of covered equipment placed on the market during the preceding RED cybersecurity period.
Binding repeal from 11 December 2027 and preservation of RED market surveillance for covered equipment placed on the market between 1 August 2025 and 10 December 2027.
OJEU source for the three EN 18031:2024 cybersecurity standards and the restrictions on their presumption of conformity.
Publishes EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 with restrictions that limit presumption of conformity for specified guidance, password, parental-control, and secure-update cases.