--- title: "RED vs Cyber Resilience Act: radio equipment cyber scope" canonical_url: "https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-cyber-resilience-act" source_url: "https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-cyber-resilience-act" author: "Sorena AI" description: "Compare RED cybersecurity duties with Cyber Resilience Act planning for connected radio equipment, using official source RED scope, evidence, dates, and caveats." published_at: "2026-05-09" updated_at: "2026-07-16" keywords: - "RED vs Cyber Resilience Act" - "RED cybersecurity" - "Radio Equipment Directive Article 3(3)" - "Delegated Regulation 2022/30" - "connected radio equipment" - "EU cyber product compliance" - "EU Radio Equipment Directive" - "Article 3(3)" - "Cyber Resilience Act comparison" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # RED vs Cyber Resilience Act: radio equipment cyber scope Compare RED cybersecurity duties with Cyber Resilience Act planning for connected radio equipment, using official source RED scope, evidence, dates, and caveats. *RED cyber comparison* *EU radio equipment* ## RED vs Cyber Resilience Act for connected radio equipment This comparison is relevant when a connected wireless product may need both RED conformity work and separate Cyber Resilience Act planning. The RED side is grounded in Directive 2014/53/EU and Delegated Regulation (EU) 2022/30. Use the dedicated CRA artifact for current CRA scope, dates, and obligations rather than inferring them from RED material. For connected radio equipment, RED and the Cyber Resilience Act can point product teams at similar cybersecurity evidence through different legal workstreams. This page explains the RED boundary and evidence-reuse questions; it does not replace a current CRA applicability and transition review. ## RED vs Cyber Resilience Act for connected radio equipment A RED-cited-source comparison for teams deciding what must be done now for connected radio equipment and what must be reserved for a separate Cyber Resilience Act source review. - **RED**: RED is the conformity workstream for radio equipment: classify the radio product, select applicable Article 3 requirements, complete conformity assessment, keep technical documentation, and support CE marking. - **Cyber Resilience Act**: The Cyber Resilience Act is treated here only as a separate cybersecurity workstream referenced by Commission context; do not infer detailed CRA scope, dates, or evidence duties from these RED-focused sources. | Dimension | RED | Cyber Resilience Act | Operational implication | Sources | | --- | --- | --- | --- | --- | | Legal scope | RED applies to radio equipment: electrical or electronic products that intentionally emit or receive radio waves for radio communication or radiodetermination. | CRA scope is not determined from these RED-focused sources. Treat it as a separate product-cybersecurity scoping question, not as a substitute for RED. | For a connected wireless product, write two scope conclusions: one official source RED conclusion and one CRA template default that cites a CRA-specific source review before release claims are made. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. | | Who owns the work | RED assigns duties across manufacturers, authorised representatives, importers, and distributors; manufacturers own design compliance, technical documentation, conformity assessment, EU DoC, and CE marking. | Do not copy RED actor assignments into the CRA column without CRA legal support; create a separate CRA owner until the CRA role analysis is completed. | Use product regulatory or quality ownership for RED conformity, and track CRA responsibility as a separate legal and security-governance action item. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. | | Cyber trigger | RED cybersecurity duties under Delegated Regulation 2022/30 are triggered by defined radio-equipment categories, including internet-connected radio equipment, certain equipment processing personal, traffic, or location data, and internet-connected equipment enabling transfers of money or value. | The CRA trigger is intentionally left narrow here: confirm it from CRA-specific sources before using CRA labels in product requirements, customer assurances, or release gates. | Ask RED-specific intake questions first: does the product connect to the internet, process relevant data, or enable value transfer, and is it radio equipment? | [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. | | Core compliance duties | RED work converts the Article 3 requirements into design controls, conformity assessment, technical documentation, EU declaration of conformity, CE marking, instructions, and market-surveillance support. | CRA implementation details are blocked in this RED-only cited sources; record CRA tasks as assumptions until supported by CRA-specific law or guidance. | Do not describe a product as CRA-ready because RED cybersecurity controls exist. Reuse the control evidence only after mapping each document to both legal bases. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. | | Evidence and records | RED evidence should include the radio scope memo, Article 3 matrix, cybersecurity category decision, standards or specifications, test reports, risk analysis, notified-body evidence where needed, EU DoC, CE marking basis, and technical documentation. | CRA evidence should be labeled provisional on this page: keep candidate cybersecurity artifacts, but do not assert they meet CRA documentation requirements without a CRA source. | Maintain one evidence index with source tags so RED evidence, shared engineering controls, and unresolved CRA evidence are not blurred together. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. | | Application dates and clocks | For RED cybersecurity under Delegated Regulation 2022/30 as amended, the official source application date is 1 August 2025. RED technical documentation and EU DoC retention duties are tied to placing radio equipment on the market. | CRA dates are not sourced in these RED-focused sources. Keep them out of this comparison unless a CRA-specific source is added to the record. | Use the RED cyber date for RED release readiness, and keep a separate CRA calendar that is not inferred from RED or Commission announcement text. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. | | Assurance and enforcement route | RED assurance runs through the applicable conformity assessment route, possible notified-body involvement, CE marking, technical documentation, and national market-surveillance authority review. | CRA enforcement and reporting routes are outside these RED-focused sources and should be documented only after CRA-specific sourcing. | Keep escalation playbooks separate: RED non-conformity, corrective action, authority response, and CE marking issues should not be mixed with unsourced CRA incident or vulnerability workflows. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. | | Overlap and reuse | RED cybersecurity work can generate reusable artifacts such as threat models, vulnerability assumptions, software-update notes, test evidence, and supplier security inputs when they are tied back to Article 3(3)(d), (e), or (f). | CRA reuse is only a candidate until CRA scope and evidence requirements are separately verified. | Reuse controls, not conclusions: shared security engineering may reduce duplicate work, but it does not merge legal scope, dates, economic-operator roles, or declarations. | [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. | | Practical decision rule | Proceed under RED when the product is radio equipment and market placement depends on Article 3 requirements, conformity assessment, technical documentation, EU DoC, or CE marking. | Open a CRA follow-up when the connected radio product also appears to be a digital product, but mark the CRA conclusion pending until a CRA-specific review supports it. | The defensible output is: RED applies, RED does not apply, CRA review needed, or both workstreams apply with separately cited evidence. | [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation.
[Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection.
[Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities.
[European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates.
[Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. | Sources for Legal scope - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" Sources for Legal scope - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Legal scope - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Who owns the work - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Who owns the work - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Who owns the work - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Cyber trigger - RED: - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" Sources for Cyber trigger - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Cyber trigger - operational implication: - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Core compliance duties - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Core compliance duties - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Core compliance duties - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Evidence and records - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Evidence and records - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Evidence and records - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Application dates and clocks - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." Sources for Application dates and clocks - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Application dates and clocks - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Assurance and enforcement route - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Assurance and enforcement route - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Assurance and enforcement route - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Overlap and reuse - RED: - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Overlap and reuse - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Overlap and reuse - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Practical decision rule - RED: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." Sources for Practical decision rule - Cyber Resilience Act: - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" Sources for Practical decision rule - operational implication: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" ### How should teams decide between RED work and CRA follow-up? - Classify the product under RED first: radio function, intended use, connectivity, data processing, value-transfer features, and EU economic-operator role. - Use RED sources for RED obligations only, especially Article 3(3)(d), (e), and (f), conformity assessment, technical documentation, EU DoC, and CE marking. - Create a separate CRA review item whenever CRA scope, dates, reporting, vulnerability handling, or documentation requirements would affect release or customer claims. Sources for the practical decision rule: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" ## Where RED and the Cyber Resilience Act overlap for radio products RED starts from the product being radio equipment: equipment that intentionally emits or receives radio waves for radio communication or radiodetermination. For connected products, the RED cybersecurity delegated act activates Article 3(3)(d), (e), and (f) for defined categories such as internet-connected radio equipment, equipment processing personal, traffic, or location data, and internet-connected equipment enabling transfers of money, monetary value, or virtual currency. Do not treat RED evidence as automatically satisfying the Cyber Resilience Act. Reuse a threat model, vulnerability record, test report, or supplier artifact only after mapping it to the separate requirement, product boundary, operator, date, and conformity route under each regime. - Start with a RED scope memo: radio function, EU role, intended use, internet connectivity, data processing, and payment or value-transfer features. - Map Article 3(3)(d), (e), and (f) separately before deciding whether one test plan or threat model can support more than one duty. - Keep separate RED and CRA conclusions, sources, owners, dates, and residual gaps even when they point to the same engineering control. Sources for this answer: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. ## Evidence to keep separate before reusing controls RED evidence should show the Article 3 requirements selected for the product, the conformity assessment route, the harmonised standards or other technical specifications used, the test and risk evidence, the EU declaration of conformity, CE marking basis, and the technical documentation retained for market surveillance. Cybersecurity evidence can often be operationally useful across laws, but the evidence index should say exactly which document supports RED Article 3(3)(d), (e), or (f), and which document is only a candidate for later CRA mapping. - Keep the RED Article 3 matrix, standards list, test reports, threat model, software and update assumptions, EU DoC, and technical file together. - Tag shared artifacts by legal source instead of naming them generically as product cybersecurity evidence. - Reopen the mapping when connectivity, data processing, payment features, software updates, harmonised standards, or the CRA source review changes. Sources for this answer: - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. *Recommended next step* *Placement: after implementation section* ## Turn RED cyber scope into an evidence map This comparison helps separate RED cybersecurity obligations from CRA planning assumptions, then keep product scope, source citations, owners, and reusable evidence in one reviewable record. - [Open Research Copilot](/solutions/research-copilot.md): Answer RED scope, Article 3(3), timing, and evidence questions with cited outputs. - [Talk through implementation](/contact.md): Review RED cyber scope, CRA assumptions, reusable controls, and next actions. ## Implementation workflow for RED versus CRA planning Run the RED and CRA applicability decisions as separate workstreams for the same connected product. RED market access depends on the radio-equipment requirement and conformity route; the CRA conclusion must be supported by its own current legal sources. The practical output is not a single yes/no label. It is a two-column record: RED obligations that are ready to implement, CRA assumptions that are unresolved or separately sourced, and a bridge showing which security controls can be reused without overstating compliance. - Classify the product under RED and document whether Delegated Regulation 2022/30 applies. - Use 1 August 2025 as the official source RED cybersecurity application date for the delegated act. - Do not state CRA conformity, deadlines, or reporting duties from RED-only sources; link those conclusions to a separate CRA review. Sources for this answer: - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. ## Primary sources - [Directive 2014/53/EU on radio equipment](https://eur-lex.europa.eu/eli/dir/2014/53/oj?ref=sorena.io) - Binding RED source for radio-equipment scope, essential requirements, economic-operator duties, conformity assessment, EU declaration of conformity, CE marking, and technical documentation. - Quote: "radio equipment" - [Commission Delegated Regulation (EU) 2022/30 on RED cybersecurity](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02022R0030-20231027&ref=sorena.io) - Official source RED cybersecurity source for Article 3(3)(d), (e), and (f) categories, including internet-connected radio equipment, data/privacy safeguards, and fraud protection. - Quote: "internet-connected radio equipment" - [Commission Delegated Regulation (EU) 2023/2444 on RED cybersecurity application date](https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj?ref=sorena.io) - Official source for the RED cybersecurity delegated-act application date of 1 August 2025. - Quote: "It shall apply from 1 August 2025." - [Commission Notice - Blue Guide on EU product rules (2022)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022XC0629%2804%29&ref=sorena.io) - General EU product-law guidance for conformity assessment, CE marking, EU declarations, market surveillance, and economic operator responsibilities. - Quote: "The manufacturer is responsible for the conformity assessment." - [European Commission - cybersecurity of wireless devices and products](https://ec.europa.eu/growth/news/commission-strengthens-cybersecurity-wireless-devices-and-products-2021-10-29_en?ref=sorena.io) - Historical 2021 Commission context showing RED cybersecurity and the then-proposed Cyber Resilience Act as separate initiatives; not a source for current CRA obligations or dates. - Quote: "upcoming Cyber Resilience Act" - [European Commission - Radio Equipment Directive overview](https://single-market-economy.ec.europa.eu/sectors/electrical-and-electronic-engineering-industries-eei/radio-equipment-directive-red_en?ref=sorena.io) - Commission overview for RED policy context and radio-equipment market access framing. - Quote: "Radio Equipment Directive" ## Related Topic Guides - [Are radio kits and evaluation boards covered by the RED? | RED FAQ](/artifacts/eu/radio-equipment-directive/faq/kits.md): RED FAQ for radio kits, construction kits, amateur-radio kits, and custom-built professional R&D evaluation boards under Directive 2014/53/EU. - [EU Radio Equipment Directive Timeline: RED, Cyber and USB-C Dates](/artifacts/eu/radio-equipment-directive/timeline.md): Understand which RED dates changed market-access rules, including 2016 application, the 2017 transition cutoff, common-charger dates, and cybersecurity requirements from 1 August 2025. - [EU RED Applicability Test for Radio Equipment](/artifacts/eu/radio-equipment-directive/applicability-test.md): Decide whether Directive 2014/53/EU applies to a connected product, which RED requirements are triggered, and what evidence belongs in the technical file. - [EU RED Common Charger FAQ: Which devices need USB-C?](/artifacts/eu/radio-equipment-directive/faq/common-charger.md): FAQ on EU RED common charger scope, 28 December 2024 and 28 April 2026 dates, USB-C, USB Power Delivery, charger unbundling, labels, pictograms, and evidence. - [EU RED Common Charger Obligations: USB-C scope, dates, labels](/artifacts/eu/radio-equipment-directive/common-charger-obligations.md): Check RED common-charger device categories, application dates, USB-C and USB Power Delivery specifications, charger unbundling, consumer pictograms, labels, and release evidence. - [EU RED compliance evidence guide](/artifacts/eu/radio-equipment-directive/compliance.md): Build a Radio Equipment Directive compliance file with Article 3 requirement mapping, harmonised-standard checks, conformity assessment evidence, EU declarations, CE marking, and RED source links. - [EU RED Cybersecurity Product Categories: 2022/30 scope](/artifacts/eu/radio-equipment-directive/cybersecurity-delegated-act-product-categories.md): Classify products under RED Delegated Regulation (EU) 2022/30 for Article 3(3)(d), (e), and (f), including exclusions, the 1 August 2025 application date, and release evidence. - [EU RED FAQ: Scope, CE and USB-C](/artifacts/eu/radio-equipment-directive/faq.md): Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence. - [EU RED Radio Equipment Scope: products and exclusions](/artifacts/eu/radio-equipment-directive/radio-equipment-scope.md): Decide whether a product is radio equipment under Directive 2014/53/EU, with RED scope tests, exclusions, examples, and evidence records. - [EU RED Requirements Map: CE and Article 3](/artifacts/eu/radio-equipment-directive/requirements.md): Map Radio Equipment Directive requirements for radio products: Article 3 safety, EMC, spectrum, selected Article 3(3) duties, common charger rules, conformity assessment, CE marking, EU declaration, and technical documentation. - [EU RED Scope and Classification](/artifacts/eu/radio-equipment-directive/scope-and-classification.md): Classify products under the EU Radio Equipment Directive with cited tests for radio equipment scope, exclusions, Article 3 requirement buckets, cybersecurity, common charging, and evidence records. - [EU RED Scope Classification Workflow](/artifacts/eu/radio-equipment-directive/red-scope-classification-workflow.md): Classify products under the EU Radio Equipment Directive with a cited workflow for RED scope, exclusions, Article 3 requirements, standards, CE evidence, cybersecurity, and common-charger triggers. - [RED Article 10 labelling, instructions, and restrictions](/artifacts/eu/radio-equipment-directive/article-10-labelling-and-restrictions.md): Apply RED Article 10 to product identifiers, economic-operator contacts, instructions, declaration statements, radio-frequency information, and use restrictions. - [RED Article 3 requirement selection workflow](/artifacts/eu/radio-equipment-directive/article-3-requirement-selection-workflow.md): Select the right RED Article 3 branches for radio equipment: safety, EMC, spectrum, delegated Article 3(3) duties, cybersecurity, common charging, evidence, and conformity assessment. - [RED Article 3 Requirements: Safety, EMC, Spectrum and Cyber](/artifacts/eu/radio-equipment-directive/article-3-1-3-2-and-3-3-requirements.md): Map Radio Equipment Directive Article 3(1), 3(2), and 3(3) requirements to safety, EMC, spectrum, interoperability, emergency, software, and cyber evidence. - [RED Compliance Checklist for Radio Equipment](/artifacts/eu/radio-equipment-directive/checklist.md): Use this RED release checklist for product scope, Article 3 requirements, technical documentation, EU declarations, CE marking, cybersecurity, common charging, and notified-body decisions. - [RED compliance deadlines calendar: 2016, 2024, 2025 and 2026 dates](/artifacts/eu/radio-equipment-directive/deadlines-and-compliance-calendar.md): Calendar the EU Radio Equipment Directive deadlines that affect launches: RED applicability, transition end, common charger dates, cybersecurity requirements, OJEU standards, CE marking, declarations and technical files. - [RED conformity assessment and CE marking](/artifacts/eu/radio-equipment-directive/conformity-assessment-and-ce.md): EU Radio Equipment Directive guide to Article 17 conformity modules, notified-body triggers, technical documentation, EU declarations, and CE marking. - [RED Conformity Assessment Template](/artifacts/eu/radio-equipment-directive/red-conformity-assessment-template.md): Template fields for documenting RED Article 3 requirements, Article 17 route selection, harmonised standards, notified-body evidence, technical documentation, EU declaration, CE marking, cybersecurity, and common-charger checks. - [RED Cyber Compliance Workflow for Article 3(3)(d/e/f)](/artifacts/eu/radio-equipment-directive/cyber-compliance-workflow.md): A cited RED cybersecurity workflow for internet-connected radio equipment, privacy and data safeguards, payment-fraud features, evidence packs, and CE release gates. - [RED Cybersecurity Delegated Act Guide | Article 3(3)(d/e/f)](/artifacts/eu/radio-equipment-directive/red-cybersecurity-delegated-act-guide.md): Practical guide to Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive, covering Article 3(3)(d), (e), and (f) cybersecurity scope, 1 August 2025 application, evidence, standards, and notified-body checkpoints. - [RED Cybersecurity Requirements for Radio Equipment](/artifacts/eu/radio-equipment-directive/cybersecurity-requirements.md): EU RED cybersecurity requirements under Article 3(3)(d), (e), and (f): scope, affected radio equipment, application date, standards, notified bodies, and evidence. - [RED DoC and CE marking file: what to include](/artifacts/eu/radio-equipment-directive/faq/doc-and-ce.md): FAQ answer for Radio Equipment Directive declarations of conformity, CE marking evidence, technical documentation, notified-body records, and related labels. - [RED EMC and LVD Safety Interplay for Radio Equipment](/artifacts/eu/radio-equipment-directive/emc-and-lvd-safety-interplay.md): Explain how EU RED Article 3 applies LVD safety objectives and EMC requirements to radio equipment, with evidence, test-plan, and technical-file guidance. - [RED Harmonised Standards and Test Plans: OJEU evidence guide](/artifacts/eu/radio-equipment-directive/harmonized-standards-and-test-plans.md): Build a Radio Equipment Directive standards matrix and test plan around OJEU-cited harmonised standards, Article 3 requirements, Article 17 route triggers, and Annex V technical-file evidence. - [RED importer obligations FAQ | Directive 2014/53/EU](/artifacts/eu/radio-equipment-directive/faq/importers.md): What importers must check before placing radio equipment on the EU market: conformity assessment, spectrum use, technical documentation, EU declaration, CE marking, traceability, instructions, restrictions, storage, corrective action, and authority cooperation. - [RED notified body route selection under Article 17](/artifacts/eu/radio-equipment-directive/notified-body-route-selection.md): Decide when RED radio equipment can use internal production control and when Article 17 requires Annex III EU-type examination or Annex IV full quality assurance. - [RED Notified Body Trigger Workflow: Article 17 evidence guide](/artifacts/eu/radio-equipment-directive/notified-body-trigger-workflow.md): Decide when the EU Radio Equipment Directive needs a notified body by mapping Article 3 requirements, OJEU-cited harmonised standards, Annex III EU-type examination, and Annex IV full quality assurance evidence. - [RED penalties, fines, and enforcement actions](/artifacts/eu/radio-equipment-directive/penalties-and-fines.md): EU Radio Equipment Directive penalties guide covering Article 46, Member State penalty rules, recalls, withdrawals, formal non-compliance, and enforcement evidence. - [RED radio modules FAQ: host product assessment](/artifacts/eu/radio-equipment-directive/faq/radio-modules.md): FAQ on how Directive 2014/53/EU treats RF modules and host products, including module evidence, final-product responsibility, Article 3 assessment, technical documentation, instructions, antennas, software, and DoC records. - [RED SAR and RF Exposure Evidence FAQ](/artifacts/eu/radio-equipment-directive/faq/sar-and-wireless-exposure.md): What SAR and RF exposure evidence to keep under the EU Radio Equipment Directive, including Article 3(1)(a), foreseeable use, frequency, power, antenna, and standards evidence. - [RED software update impact for radio equipment](/artifacts/eu/radio-equipment-directive/software-update-impact.md): Assess when firmware, app, and software updates can affect EU Radio Equipment Directive conformity, technical documentation, DoC, standards, and notified-body evidence. - [RED standards not cited in the OJEU: can you use them?](/artifacts/eu/radio-equipment-directive/faq/standards-not-cited-in-ojeu.md): FAQ answer for Radio Equipment Directive products when a standard is useful but not OJEU-cited, including presumption of conformity, Article 17 route selection, and technical-file evidence. - [RED vs EMC Directive: when radio equipment uses RED instead of EMCD](/artifacts/eu/radio-equipment-directive/red-vs-emc.md): Compare the EU Radio Equipment Directive and EMC Directive for radio products, EMC evidence, CE marking, declarations, technical files, and scope boundaries. - [RED vs ETSI EN 303 645: IoT cyber evidence comparison](/artifacts/eu/radio-equipment-directive/red-vs-etsi-en-303-645.md): Compare EU RED cybersecurity duties with ETSI EN 303 645 evidence reuse for connected radio products, OJEU standards, CE files, and 1 August 2025 planning. - [RED vs LVD: when radio equipment uses RED for electrical safety](/artifacts/eu/radio-equipment-directive/red-vs-lvd.md): Compare the EU Radio Equipment Directive and Low Voltage Directive for radio-product safety, voltage limits, CE marking, technical files, and declarations. - [RED vs Market Surveillance Regulation: radio equipment compliance roles](/artifacts/eu/radio-equipment-directive/red-vs-msr.md): Compare RED product conformity duties with EU Market Surveillance Regulation controls for radio equipment, online sales, responsible operators, customs holds, and evidence. - [RED vs UK PSTI for connected radio products](/artifacts/eu/radio-equipment-directive/red-vs-uk-psti.md): Compare EU RED duties with UK PSTI planning for connected radio products: scope, actors, evidence, cybersecurity overlap, CE marking, and separate UK product-security workstreams. - [When do RED cybersecurity requirements apply to connected radio equipment? | RED FAQ](/artifacts/eu/radio-equipment-directive/faq/cybersecurity-applicability.md): RED FAQ explaining when Article 3(3)(d), (e), and (f) cybersecurity requirements apply to internet-connected, childcare, toy, wearable, and payment-capable radio equipment. - [Which receivers and transmitters are covered by RED? | Directive 2014/53/EU FAQ](/artifacts/eu/radio-equipment-directive/faq/receivers-and-transmitters.md): RED scope FAQ for products that intentionally emit or receive radio waves for radio communication or radiodetermination, including receiver-only products, transmitters, accessory-dependent products, and common exclusions. - [Wi-Fi and Bluetooth Products Under the EU RED](/artifacts/eu/radio-equipment-directive/faq/wi-fi-and-bluetooth-products.md): FAQ for assessing Wi-Fi, Bluetooth, BLE and other short-range wireless products under the EU Radio Equipment Directive, including Article 3, CE, technical file, cybersecurity and notified-body triggers. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/radio-equipment-directive/red-vs-cyber-resilience-act.md