The Radio Equipment Directive cybersecurity Delegated Act (RED DA) and the Cyber Resilience Act (CRA) both address digital product security, but differ in scope and focus.
The RED DA activates three essential requirements of the Radio Equipment Directive for specified categories of radio equipment:
- Article 3(3)(d): network protection for radio equipment that communicates over the internet, directly or through other equipment.
- Article 3(3)(e): personal data and privacy for equipment capable of processing the relevant data. This includes internet-connected equipment, radio equipment intended exclusively for childcare, radio toys, and wearables; the latter three categories do not need an internet connection to be in scope.
- Article 3(3)(f): protection from fraud for internet-connected radio equipment that enables transfers of money, monetary value, or virtual currency.
The RED DA also sets out exclusions for equipment covered by certain sector-specific legislation.
The CRA has a broader product scope: hardware and software made available on the market in the course of a commercial activity, where the intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network. An internet connection is not required, but a programmable component alone does not automatically put a product in scope. Article 2 sets out exclusions.
The CRA also includes remote data processing solutions developed by the manufacturer, or under its responsibility, whose absence would prevent the product from performing one of its functions. Its focus is both product security and the processes needed to manage cybersecurity risks and vulnerabilities throughout the support period.
Assets
The EN 18031 series supporting the RED DA groups assets into categories reflecting the requirements activated by Article 3(3)(d), (e), and (f):
- Security assets
- Network assets
- Privacy assets
- Financial assets
The CRA takes a broader risk-based approach. Article 13 requires a documented cybersecurity risk assessment that considers the product’s intended purpose, reasonably foreseeable use, conditions of use, and assets to be protected. That assessment determines how the applicable essential cybersecurity requirements are implemented and must be updated as appropriate during the support period.
Processes
The RED DA activates product requirements, but it operates within the Radio Equipment Directive’s existing manufacturer obligations. These already include technical documentation, conformity assessment, procedures to keep series production compliant, and corrective action for non-compliant equipment. It would therefore be misleading to say that RED compliance has no process requirements.
The CRA adds explicit cybersecurity risk-management and vulnerability-handling obligations, including coordinated vulnerability disclosure, security updates, and reporting. Vulnerability handling continues throughout a defined support period reflecting expected use. Under Article 13(8), that period must generally be at least five years; if the product is expected to be used for less than five years, it must cover that expected use time.
Product assessment and compliance
Under the RED, manufacturers can use internal production control for the relevant Article 3(3) requirements when they fully apply applicable harmonized standards cited in the Official Journal. The EN 18031 series was cited with restrictions, so using the standards does not automatically provide presumption of conformity in every case. Where the conditions for internal production control are not met, Article 17 requires EU-type examination followed by conformity to type, or full quality assurance.
The CRA assessment route depends on the product’s classification and the conditions in Article 32. Some routes require a notified body, which is a designated conformity assessment body—not simply any accredited test laboratory. See the overview’s conformity-assessment section for the available routes and exceptions.
Existing RED DA assessments can provide useful evidence, but they do not establish CRA compliance on their own. Manufacturers need to address the applicable CRA product requirements, process obligations, and conformity-assessment procedure.
The timeline
The RED DA cybersecurity requirements have applied since August 1, 2025. Delegated Regulation (EU) 2026/339 repeals the RED DA with effect from December 11, 2027, when the main CRA requirements apply. The Radio Equipment Directive itself is not repealed.
The repeal preserves market surveillance of the RED DA requirements for equipment placed on the market between August 1, 2025, and December 10, 2027. CRA Article 14 reporting obligations have already applied since September 11, 2026, including to earlier products in scope. Other CRA requirements generally apply to products placed on the market before December 11, 2027, only if substantially modified from that date.
