RED vs ETSI EN 303 645 for connected radio products

RED starts with whether the product is radio equipment placed or made available on the EU market.

ETSI EN 303 645 should be scoped to the consumer IoT product, service, software, and data boundary actually assessed.

A connected consumer product may need both workstreams, but a positive ETSI EN 303 645 control assessment does not prove RED scope or CE readiness.

The RED manufacturer is the primary actor responsible for conformity assessment, technical documentation, EU declaration of conformity, CE marking, and market-surveillance cooperation. Importers and distributors carry secondary RED checks and can become responsible as manufacturers when they substantially modify equipment.

ETSI EN 303 645 work is typically owned by product security, engineering, or supplier-management teams. Their assessment evidence must be linked back to the RED economic operator so it can be cited in the technical file.

Name the RED economic operator in every conformity file and bridge note so security evidence produced by internal or supplier teams cannot become orphaned from the CE compliance decision.

RED Article 3(3)(d) applies to internet-connected radio equipment; Article 3(3)(e) and (f) depend on the listed data-processing, childcare, toy, wearable, and payment-transfer conditions.

ETSI EN 303 645 evidence should be mapped control by control to the device features, data flows, vulnerability process, update model, and product documentation it actually covers.

Do not reuse a generic IoT security checklist; build a RED trigger matrix first, then attach ETSI EN 303 645 evidence to the relevant trigger.

RED core obligations for radio equipment include meeting Article 3 essential requirements, choosing and executing the correct conformity assessment route under Article 17, drawing up technical documentation, issuing the EU declaration of conformity, and affixing CE marking before market placement.

ETSI EN 303 645 core obligations are internal: maintain assessed security controls across the documented IoT system boundary. The standard does not create EU legal duties; teams must bridge each EN 303 645 control to its RED essential-requirement equivalent and document the standards-status position.

Translate RED essential requirements into a numbered matrix before consulting EN 303 645; do not reverse-engineer from EN 303 645 controls to RED compliance because the mapping is not always one-to-one.

RED evidence should include technical documentation, risk analysis, applied standards or other technical specifications, tests, EU DoC, CE basis, and any EU-type examination or quality-assurance records.

ETSI EN 303 645 evidence should remain a security-control evidence set unless the RED file explains how each item supports a specific RED essential requirement.

Keep a bridge table with columns for RED requirement, ETSI control evidence, product boundary, test date, standard status, owner, and residual gap.

RED cybersecurity requirements activated by Delegated Regulation (EU) 2022/30 apply from 1 August 2025 after the amendment made by Delegated Regulation (EU) 2023/2444.

ETSI EN 303 645 evidence should be refreshed when the assessed product, software, service dependency, vulnerability process, or claimed standards status changes.

Plan RED cybersecurity testing, supplier evidence, and conformity-route decisions against the 1 August 2025 application date, not only against internal security-assurance cycles.

RED enforcement is handled by market-surveillance authorities in each Member State under Regulation (EU) 2019/1020. Non-compliant radio equipment can be subject to corrective action, withdrawal, recall, and prohibition orders, and persistent infringement can lead to administrative or criminal penalties under national law.

ETSI EN 303 645 has no direct enforcement authority. Non-compliance with an EN 303 645 control assessment does not itself constitute a RED infringement unless the standard has been cited in the Official Journal and is being relied on for a presumption-of-conformity claim.

Document the enforcement route clearly: which national MSA has jurisdiction, which Article 3 requirements are relevant, and whether OJEU-cited harmonised standards support the conformity claim so the authority response file is accurate from the start.

RED technical documentation can incorporate EN 303 645 test results as supporting evidence where the assessed system boundary matches the radio equipment under review and the tested controls map to specific Article 3(3)(d), (e), or (f) requirements.

ETSI EN 303 645 control records can be reused for RED purposes only after adding a bridge note that identifies the RED essential requirement supported, the OJEU citation status of any related harmonised standard, and any residual gap requiring additional RED-specific testing or documentation.

Keep evidence reuse conditional: document the system-boundary match, the requirement mapping, the standards-status check, and the owner so a future reviewer or authority can independently verify each link without relying on undocumented project context.

Use RED as the controlling workstream whenever the decision affects EU market placement, Article 3 essential requirements, conformity assessment, CE marking, DoC wording, or authority response.

Use ETSI EN 303 645 as supporting evidence when it strengthens the cybersecurity control record and the product boundary matches the RED equipment under review.

The defensible answer is usually not RED or ETSI EN 303 645. It is RED for the legal route, with carefully tagged ETSI EN 303 645 evidence where it actually supports the RED cyber case.