RED FAQ Cybersecurity Applicability

Start with Article 3(3)(d): it applies to any radio equipment that can communicate itself over the internet, whether directly or through another device. That trigger is about the equipment's own capability to exchange data with the internet, not merely whether the product is used near a network.

Then check Article 3(3)(e): it applies to covered equipment if it can process personal data under GDPR or traffic or location data under the ePrivacy Directive. The covered categories are internet-connected radio equipment, radio equipment designed or intended exclusively for childcare, radio equipment covered by the Toy Safety Directive, and wearable radio equipment.

Finally check Article 3(3)(f): it applies to internet-connected radio equipment if the holder or user can use it to transfer money, monetary value, or virtual currency. The application date for these 2022/30 requirements is 1 August 2025.

The first fact is whether the item is radio equipment under RED and can communicate itself over the internet. Delegated Regulation (EU) 2022/30 treats direct and indirect internet communication as relevant, so a device that reaches the internet through a phone, hub, gateway, or other intermediate equipment can still be internet-connected for this assessment.

The second fact is whether the equipment falls into a data-sensitive category. Article 3(3)(e) is not limited to ordinary internet-connected equipment; it also covers radio equipment designed or intended exclusively for childcare, radio equipment covered by the Toy Safety Directive, and wearable radio equipment when the data-processing trigger is met.

The third fact is payment capability. If internet-connected radio equipment enables the holder or user to transfer money, monetary value, or virtual currency, map Article 3(3)(f) separately from the network-protection and privacy/data-protection checks.

Use a short applicability record before choosing standards, tests, or notified-body routes. The record should answer which Article 3(3) point applies and why, rather than saying only that the product is connected or cyber-relevant.

The biggest error is compressing all RED cybersecurity into a single yes/no label. The delegated act applies different Article 3(3) points to different equipment categories, so the record needs to show which point applies and which product fact triggered it.