Software and firmware changes need a RED impact review when they can change radio behavior, intended use, cybersecurity functions, charging information, user-configurable features, or the assessed equipment and software configuration.
This page helps decide when an update needs a conformity review, technical-file update, declaration update, standards check, or notified-body follow-up before release.
Under the Radio Equipment Directive, software belongs in the compliance record when it affects an essential requirement or allows the radio equipment to operate as intended. Review every release against the configuration that was assessed, documented, declared, and, where applicable, certified. Article 3(3)(i) is not a blanket ban on loading software: it allows the Commission to activate a for specified equipment categories. The Commission states that it paused that initiative in 2021 because of potential overlap with the Cyber Resilience Act and resumed it in 2023 after it was agreed that cybersecurity requirements would transfer from RED to the Cyber Resilience Act.
1
Section 1
When a software update can affect RED conformity
Assess each update as a product change. First determine whether it can alter an Article 3 requirement: health and safety, EMC, efficient spectrum use, an activated Article 3(3) requirement, or the common-charger information and charging-capability rules for covered equipment.
Annex V requires the to identify software or firmware versions that affect compliance with essential requirements. Article 10(5) separately requires series-production procedures to account adequately for changes in product design or characteristics and changes in or other technical specifications. The release record therefore matters even when the supported conclusion is that no retest, declaration change, or notified-body action is needed.
Review updates that change transmitter power, frequency bands, modulation, duty cycle, antenna behavior, receiver parameters, geofencing, or region selection.
For equipment covered by Delegated Regulation (EU) 2022/30 and placed on the Union market from 1 August 2025 through 10 December 2027, review updates that change cybersecurity controls. Preserve this review after the category act is repealed because RED surveillance continues for equipment placed during that interval.
Review updates that add or remove user-installable software, companion-app control, accessories, components, charging behavior, restriction information, or operating modes described in the instructions or declaration.
Record a no-impact decision only when the assessed model, hardware variant, firmware or software version, intended use, standards coverage, and market information remain aligned.
Official status source stating that the Commission paused the Article 3(3)(i) and Article 4 software initiative in 2021 because of potential Cyber Resilience Act overlap and resumed it in 2023 after it was agreed that cybersecurity requirements would transfer from RED to the Cyber Resilience Act.
this initiative was resumed
Recommended next step
Review RED software-change evidence before release
Check whether a firmware, app, OTA, or configuration update changes the Article 3 matrix, standards evidence, technical file, declaration, notified-body record, or release approval for radio equipment.
The update record should let a reviewer connect the software release to the radio equipment type placed on the EU market. Keep the release identifier, affected models, affected hardware variants, changed radio or security functions, standards impact, test impact, impact, notified-body impact, approval owner, and release decision.
Annex V is the anchor for the file: it calls for a general product description, conceptual design and manufacturing materials, software or firmware versions affecting compliance, user and installation information, or other technical specifications, the EU declaration, material where applicable, calculations, examinations, and test reports. Article 21 requires the to be continuously updated. If the release changes any of those records, update the file instead of relying on release notes alone.
Link each software or firmware version that affects RED compliance to the exact model, type designation, hardware revision, region configuration, and release channel.
Add regression evidence for the Article 3 requirements touched by the change rather than retesting unrelated requirements by default.
Update instructions, safety information, restriction information, frequency-band and power information, and software descriptions when the user-facing compliance description changes.
Keep the and EU declaration available for 10 years after the radio equipment has been placed on the market.
Supports horizontal EU product-law context for manufacturer responsibility, technical documentation, declarations of conformity, and CE-marked product controls.
The manufacturer is responsible
3
Section 3
Check standards and notified-body consequences
A software update can reopen the conformity-assessment route if the change affects a requirement that was covered by a harmonised standard, a partly applied standard, a technical specification, an certificate, or a full-quality-assurance approval. RED gives presumption of conformity only for the essential requirements covered by OJEU-published or parts of standards.
For Article 3(2) and Article 3(3), the notified-body question is especially important. If relevant OJEU-cited are not applied, are applied only in part, or no such standards exist for the requirement being assessed, Article 17 points the manufacturer to Annex III or Annex IV rather than Annex II for those requirements. For Annex III, modifications to the approved type that may affect conformity or certificate validity require additional approval.
Compare the update against the exact standard versions, clauses, restrictions, and test configurations used for the current declaration.
If a standard has lost presumption of conformity for products not yet placed on the market, decide whether the updated product needs a new standard route or notified-body route.
For Annex III certificates, ask whether the update changes the approved type, certificate conditions, software version, radio configuration, or evidence reviewed by the notified body.
For Annex IV quality-system approvals, check whether the update changes a design, production, inspection, testing, or quality-system control covered by the approval.
Supports Article 16 presumption of conformity, Article 17 conformity-assessment routes, and Annex III modification approval for EU-type examination certificates.
Supports release checks against current RED harmonised-standard publications, withdrawals, and restrictions.
Stay up to date with the references of harmonised standards for this directive
4
Section 4
Common mistakes in RED software-change records
Firmware can affect RED conformity even when no physical component changes. It can alter radio parameters, EMC behavior, safety functions, cybersecurity controls, restrictions, charging behavior, instructions, and the evidence used to place the equipment on the Union market.
Not every update requires a new conformity assessment. The impact decision must explain why the existing Article 3 matrix, standards evidence, , , and notified-body records still cover the released configuration, or identify the additional work required before release.
If a released update leaves radio equipment already placed on the market non-conforming, Article 10(11) requires the manufacturer to take the corrective measures needed to bring it into conformity, withdraw it, or recall it if appropriate. Where the equipment presents a risk, the manufacturer must immediately inform the competent national authorities in the Member States where it was made available, with details of the non-compliance, corrective measures, and results.
Do not ship an over-the-air update that changes radio or security behavior without checking the assessed equipment and software configuration.
Do not leave the , instructions, software identifiers, or technical file pointing to an older firmware version when the update affects compliance evidence.
Do not rely on a supplier or lab statement unless it identifies the affected model, software version, requirement, standard, and test or assessment basis.
Do not cite a harmonised standard for presumption of conformity unless the reference is published for RED in the Official Journal and covers the requirement and product configuration being claimed.
After release, keep the decision open until any required field correction, authority notification, withdrawal, or recall is completed and the records the outcome.
Sets 11 December 2027 as the repeal date for Delegated Regulation (EU) 2022/30 while preserving surveillance of covered radio equipment placed on the market through 10 December 2027.
Binding RED source for essential requirements, software-combination provisions, manufacturer duties, conformity assessment, technical documentation, EU declarations, CE marking, and market-surveillance controls.
Supports Article 3 essential requirements, Article 3(3)(i) software-combination language, Article 10 manufacturer duties, and Annex V software or firmware documentation.
Supports Annex V technical-documentation contents, Article 10 instructions and DoC duties, and the 10-year retention rule.
Show 2 more
Supports Article 16 presumption of conformity, Article 17 conformity-assessment routes, and Annex III modification approval for EU-type examination certificates.
Supports Article 10(11) corrective measures, withdrawal, recall, and risk-notification duties, Article 21 continuous updating, and Annex V software or firmware documentation.
Current transition source for the future repeal of the RED cybersecurity delegated act and preserved market-surveillance coverage.
Sets 11 December 2027 as the repeal date for Delegated Regulation (EU) 2022/30 while preserving surveillance of covered radio equipment placed on the market through 10 December 2027.
Horizontal EU product-law source for manufacturer responsibility, technical documentation, declarations of conformity, and CE-marked product controls.
Supports horizontal EU product-law context for manufacturer responsibility, technical documentation, declarations of conformity, and CE-marked product controls.
Official status source stating that the Commission paused the Article 3(3)(i) and Article 4 software initiative in 2021 because of potential Cyber Resilience Act overlap and resumed it in 2023 after it was agreed that cybersecurity requirements would transfer from RED to the Cyber Resilience Act.