RED is binding EU product law. is a consumer IoT cybersecurity baseline, not the harmonised RED cybersecurity standards series.
Use EN 303 645 to strengthen engineering evidence, but use the cited EN 18031 parts and RED conformity rules when making a presumption-of-conformity claim.
can improve a consumer IoT security program, but it does not by itself establish RED conformity. RED Article 3(3)(d), (e), and (f) cybersecurity requirements apply to specified radio-equipment categories from 1 August 2025 through 10 December 2027. Delegated Regulation (EU) 2026/339 repeals the category act from 11 December 2027 and preserves RED surveillance for equipment placed on the market during that period. The standards cited for those requirements are EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024, subject to restrictions. ETSI published EN 303 645 V3.1.3 in September 2024; teams using the older V2.1.1 (2020-06) should identify the edition and assess the change before reusing results.
RED is the legal market-access regime. EN 303 645 is a consumer IoT security baseline that can contribute evidence but does not replace RED or EN 18031.
Binding law for radio equipment, including applicable cybersecurity requirements, conformity assessment, technical documentation, declaration, CE marking, and market surveillance.
A voluntary baseline standard for consumer IoT cybersecurity and data protection; current edition V3.1.3 (2024-09).
| Dimension | EU RED | ETSI EN 303 645 | Operational implication |
|---|---|---|---|
| Scope | Radio equipment placed on the EU market, with cyber points activated for specified categories. Sources (1)
| Consumer IoT devices and their relevant device, software, service, and data boundary. Sources (1)
| A product can be in both scopes, one scope, or neither; document each test. |
| Legal effect | RED requirements are binding. Harmonised standards can support presumption of conformity within their cited scope. Sources (1)
| EN 303 645 is voluntary unless a separate law, contract, procurement rule, or scheme gives specified provisions another effect. Sources (1)
| An EN 303 645 result is not a RED declaration, CE mark, or authority approval. |
| Requirement set | Network protection, privacy and personal-data safeguards, and fraud protection for the specified Article 3(3) categories. Sources (1)
| Thirteen baseline subjects covering credentials, vulnerability disclosure, updates, secure design, data protection, resilience, deletion, maintenance, and input validation. Sources (1)
| Map control by control; the two structures are not one-to-one. |
| RED standards route | EN 18031-1, -2, and -3 are the cited RED cybersecurity standards, with restrictions. Sources (1)
| EN 303 645 can supply supporting control evidence but is not the cited RED cybersecurity series. Sources (1)
| Check EN 18031 and Decision (EU) 2025/138 before claiming presumption of conformity. |
| Evidence and next step | Keep the RED scope memo, Article 3 matrix, standards position, tests, risk analysis, technical file, declaration, and conformity-route evidence. Sources (1)
| Keep provision-by-provision applicability, implementation, test, architecture, service-boundary, and residual-risk evidence for the named edition. Sources (1)
| Create a bridge table and close every RED gap not covered by the EN 303 645 assessment. |
Radio equipment placed on the EU market, with cyber points activated for specified categories.
Sources (1)
Articles 1-3 establish RED scope.
Consumer IoT devices and their relevant device, software, service, and data boundary.
Sources (1)
Clause 1 states the consumer IoT baseline scope and limitations.
A product can be in both scopes, one scope, or neither; document each test.
RED requirements are binding. Harmonised standards can support presumption of conformity within their cited scope.
Sources (1)
Articles 16-19 cover presumption, conformity, declaration, and CE marking.
EN 303 645 is voluntary unless a separate law, contract, procurement rule, or scheme gives specified provisions another effect.
Sources (1)
ETSI explains that harmonised standards take effect through Official Journal citation and that ETSI does not certify products.
An EN 303 645 result is not a RED declaration, CE mark, or authority approval.
Network protection, privacy and personal-data safeguards, and fraud protection for the specified Article 3(3) categories.
Sources (1)
Article 1 activates the RED cybersecurity requirements.
Thirteen baseline subjects covering credentials, vulnerability disclosure, updates, secure design, data protection, resilience, deletion, maintenance, and input validation.
Sources (1)
Clauses 5 and 6 contain the baseline provisions.
Map control by control; the two structures are not one-to-one.
EN 18031-1, -2, and -3 are the cited RED cybersecurity standards, with restrictions.
Sources (1)
Official EN 18031 citation and restriction source.
EN 303 645 can supply supporting control evidence but is not the cited RED cybersecurity series.
Sources (1)
The standard describes a consumer IoT baseline rather than a RED legal route.
Check EN 18031 and Decision (EU) 2025/138 before claiming presumption of conformity.
Keep the RED scope memo, Article 3 matrix, standards position, tests, risk analysis, technical file, declaration, and conformity-route evidence.
Sources (1)
Annex V states the RED technical-documentation content.
Keep provision-by-provision applicability, implementation, test, architecture, service-boundary, and residual-risk evidence for the named edition.
Sources (1)
The standard provides the provisions and explanatory material used for the assessment.
Create a bridge table and close every RED gap not covered by the EN 303 645 assessment.
Sources (2)
Official RED cybersecurity standards citation source.
Current consumer IoT baseline standard.
RED applies to radio equipment placed on the EU market. Delegated Regulation (EU) 2022/30 activates network-protection, privacy and personal-data, and fraud-protection requirements for specified categories. The manufacturer must decide which points apply to the finished radio equipment, complete the proper conformity assessment, prepare technical documentation, issue the EU declaration, and affix CE marking.
applies a baseline set of cybersecurity provisions to consumer IoT devices. Examples named by the standard include connected children's toys and baby monitors, safety products such as smoke detectors and door locks, smart cameras and televisions, speakers, home assistants, connected appliances, alarms, hubs, wearables, and trackers. A specific product can still sit outside the standard's consumer IoT boundary or need additional sector-specific controls.
The current V3.1.3 standard is outcome-focused and is intended to be complemented by more specific, testable requirements. It does not focus on prolonged or sophisticated attacks or attacks requiring sustained physical access. Its product and service boundary therefore needs to be stated rather than assumed.
Sources (3)
Binding source for RED scope, conformity assessment, technical documentation, declaration, and CE marking.
Binding source for the equipment categories subject to RED Article 3(3)(d), (e), and (f).
Current ETSI standard stating the consumer IoT baseline scope, limitations, terminology, provisions, and data-protection provisions.
EN 303 645 V3.1.3 groups its baseline provisions around thirteen subjects: no universal default passwords; a way to manage vulnerability reports; software updates; secure storage of sensitive security parameters; secure communications; a reduced exposed attack surface; software integrity; protection of personal data; resilience to outages; examination of system telemetry; deletion of user data; easier installation and maintenance; and validation of input data.
The modal verb matters. A provision using 'shall' is mandatory for a claim against the standard when it applies; a provision using 'should' is a recommendation, and the assessment should record whether it is followed and why. Explanatory text, examples, and notes help interpret the provision but do not create a RED presumption-of-conformity claim.
For each provision, the assessment should state whether it applies, how it is met, what evidence supports the answer, and which device, software, mobile app, cloud service, or communication path was included. An unchecked checklist or supplier declaration is not enough to show that the tested boundary matches the finished radio product.
Sources (2)
Clauses 5 and 6 contain the consumer IoT cybersecurity and data-protection provisions and their explanatory text.
ETSI identifies V3.1.3 (2024-09) as the 2024 edition and describes its outcome-focused consumer IoT baseline.
Map the finished product from RED Article 3(3) through the applicable EN 18031 part to reusable EN 303 645 evidence and unresolved gaps.
Commission Implementing Decision (EU) 2025/138 cites the EN 18031 series for the RED cybersecurity requirements. EN 18031-1 addresses internet-connected radio equipment under Article 3(3)(d), EN 18031-2 addresses data-processing categories under Article 3(3)(e), and EN 18031-3 addresses internet-connected radio equipment processing virtual money or monetary value under Article 3(3)(f). The decision attaches restrictions, including limits involving passwords and parental or guardian access control.
EN 303 645 evidence can still be reused where the same control and system boundary support an EN 18031 requirement or another part of the RED technical case. The bridge must identify the RED point, EN 18031 clause, EN 303 645 provision, evidence item, product version, restriction, and remaining gap. If the applicable harmonised standard is not applied, is only partly applied, or does not cover the requirement because of a restriction, reassess the RED conformity route rather than claiming automatic presumption of conformity.
Sources (4)
The decision cites EN 18031-1, -2, and -3 and states restrictions on their presumption of conformity.
Article 17 links use of harmonised standards to the available RED conformity-assessment procedures.
The delegated act sets 1 August 2025 as the application date for the RED cybersecurity requirements.
Repeals the RED cybersecurity category act from 11 December 2027 and preserves surveillance for covered equipment placed on the market through 10 December 2027.
Understand which RED dates changed market-access rules, including 2016 application, the 2017 transition cutoff, common-charger dates, and cybersecurity requirements from 1 August 2025.
Decide whether Directive 2014/53/EU applies to a connected product, which RED requirements are triggered, and what evidence belongs in the technical file.
Check RED common-charger device categories, application dates, USB-C and USB Power Delivery specifications, charger unbundling, consumer pictograms, labels, and release evidence.
Build a Radio Equipment Directive compliance file with Article 3 requirement mapping, harmonised-standard checks, conformity assessment evidence, EU declarations, CE marking, and RED source links.
Classify products under RED Delegated Regulation (EU) 2022/30, including exclusions, EN 18031 evidence, and the 1 August 2025 to 10 December 2027 transition.
Answers to common EU RED questions on radio equipment scope, Article 3 requirements, cybersecurity, USB-C common charger rules, CE marking, and technical-file evidence.
Decide whether a product is radio equipment under Directive 2014/53/EU, with RED scope tests, exclusions, examples, and evidence records.
Map Radio Equipment Directive requirements for radio products: Article 3 safety, EMC, spectrum, selected Article 3(3) duties, common charger rules, conformity assessment, CE marking, EU declaration, and technical documentation.
Classify products under the EU Radio Equipment Directive with cited tests for radio equipment scope, exclusions, Article 3 requirement buckets, cybersecurity, common charging, and evidence records.
Classify products under the EU Radio Equipment Directive with a cited workflow for RED scope, exclusions, Article 3 requirements, standards, CE evidence, cybersecurity, and common-charger triggers.
Apply RED Article 10 to product identifiers, manufacturer contacts, instructions, declaration statements, radio-frequency information, charging labels, and use restrictions.
Select the right RED Article 3 branches for radio equipment: safety, EMC, spectrum, delegated Article 3(3) duties, cybersecurity, common charging, evidence, and conformity assessment.
Map Radio Equipment Directive Article 3(1), 3(2), and 3(3) requirements to safety, EMC, spectrum, interoperability, emergency, software, and cyber evidence.
Use this RED release checklist for product scope, Article 3 requirements, technical documentation, EU declarations, CE marking, cybersecurity, common charging, and notified-body decisions.
Calendar EU Radio Equipment Directive launch dates through 2027: RED applicability, common charger, cybersecurity, standards, CE marking, declarations and retention.
EU Radio Equipment Directive guide to Article 17 conformity modules, notified-body triggers, technical documentation, EU declarations, and CE marking.
Template fields for documenting RED Article 3 requirements, Article 17 route selection, harmonised standards, notified-body evidence, technical documentation, EU declaration, CE marking, cybersecurity, and common-charger checks.
A cited RED cybersecurity workflow for internet-connected radio equipment, privacy and data safeguards, payment-fraud features, evidence packs, and CE release gates.
Guide to RED Article 3(3)(d), (e), and (f) scope, EN 18031 evidence, the 1 August 2025 application date, and repeal of Delegated Regulation (EU) 2022/30 from 11 December 2027.
EU RED cybersecurity requirements under Article 3(3)(d), (e), and (f): scope, affected radio equipment, application date, standards, notified bodies, and evidence.
Explain how EU RED Article 3 applies LVD safety objectives and EMC requirements to radio equipment, with evidence, test-plan, and technical-file guidance.
Build a Radio Equipment Directive standards matrix and test plan around OJEU-cited harmonised standards, Article 3 requirements, Article 17 route triggers, and Annex V technical-file evidence.
Decide when RED radio equipment can use internal production control and when Article 17 requires Annex III EU-type examination or Annex IV full quality assurance.
Decide when the EU Radio Equipment Directive needs a notified body by mapping Article 3 requirements, OJEU-cited harmonised standards, Annex III EU-type examination, and Annex IV full quality assurance evidence.
EU Radio Equipment Directive penalties guide covering Article 46, Member State penalty rules, recalls, withdrawals, formal non-compliance, and enforcement evidence.
Assess when firmware, app, and software updates can affect EU Radio Equipment Directive conformity, technical documentation, DoC, standards, and notified-body evidence.
Compare EU RED cybersecurity and Cyber Resilience Act duties for connected radio equipment, including scope, dates, evidence, reporting, and conformity routes.
Decide when EU radio equipment uses RED instead of the EMC Directive and how to place EMC tests, declarations, fixed installations, and technical evidence.
Decide when EU radio equipment uses RED safety requirements instead of the Low Voltage Directive, including voltage limits, chargers, evidence, and declarations.
Compare RED product-conformity duties with Regulation (EU) 2019/1020 for responsible operators, online offers, customs controls, authority requests, and corrective action.
Compare EU RED with the UK PSTI consumer connectable product regime, including scope, exclusions, passwords, updates, vulnerability reporting, evidence, and dates.
RED FAQ for radio kits, construction kits, amateur-radio kits, and custom-built professional R&D evaluation boards under Directive 2014/53/EU.
FAQ on EU RED common charger scope, 28 December 2024 and 28 April 2026 dates, USB-C, USB Power Delivery, charger unbundling, labels, pictograms, and evidence.
FAQ answer for Radio Equipment Directive declarations of conformity, CE marking evidence, technical documentation, notified-body records, and related labels.
What importers must check before placing radio equipment on the EU market: conformity assessment, spectrum use, technical documentation, EU declaration, CE marking, traceability, instructions, restrictions, storage, corrective action, and authority cooperation.
FAQ on how Directive 2014/53/EU treats RF modules and host products, including module evidence, final-product responsibility, Article 3 assessment, technical documentation, instructions, antennas, software, and DoC records.
What SAR and RF exposure evidence to keep under the EU Radio Equipment Directive, including Article 3(1)(a), foreseeable use, frequency, power, antenna, and standards evidence.
FAQ answer for Radio Equipment Directive products when a standard is useful but not OJEU-cited, including presumption of conformity, Article 17 route selection, and technical-file evidence.
RED FAQ explaining when Article 3(3)(d), (e), and (f) cybersecurity requirements apply to internet-connected, childcare, toy, wearable, and payment-capable radio equipment.
RED scope FAQ for products that intentionally emit or receive radio waves for radio communication or radiodetermination, including receiver-only products, transmitters, accessory-dependent products, and common exclusions.
FAQ for assessing Wi-Fi, Bluetooth, BLE and other short-range wireless products under the EU Radio Equipment Directive, including Article 3, CE, technical file, cybersecurity and notified-body triggers.