EU Radio Equipment Directive (RED) New Cybersecurity Regulations

The European Commission has introduced new mandatory cybersecurity requirements by adopting Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive (RED) 2014/53/EU. These regulations aim to address the systemic cybersecurity risks posed by the increasing prevalence of Internet of Things (IoT) devices, which could be misused to harm communication networks, infringe on personal privacy, or facilitate financial fraud.

▶ 1. Mandatory Requirements

Delegated Regulation (EU) 2022/30 activates three specific clauses within Article 3(3) of the RED, making them mandatory essential requirements for radio equipment placed on the EU market:

• RED Article 3(3)(d): Protection of Network Integrity and Resilience. This clause aims to ensure that “radio equipment does not harm the network or its functioning, nor misuse network resources, thereby causing an unacceptable degradation of service quality”. Its core purpose is to prevent devices from being exploited to form botnets, launch Distributed Denial of Service (DDoS) attacks, or disrupt critical internet infrastructure. Compliance measures include secure default configurations, access controls, resilience against resource exhaustion, and software and firmware integrity.
• RED Article 3(3)(e): Protection of Personal Data and Privacy. This clause stipulates that “radio equipment shall incorporate safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected”. This integrates GDPR’s “privacy by design” and “privacy by default” principles into the device’s design itself. Requirements include data confidentiality (encryption of data in transit and at rest), data minimization, strong authentication, access controls, and user transparency and control over data.
• RED Article 3(3)(f): Prevention of Monetary and Electronic Fraud. This clause requires that “radio equipment supports certain features ensuring protection against fraud”. It specifically targets the integrity of financial transactions conducted via radio equipment, aiming to prevent the theft of payment credentials or fraudulent transactions. Compliance measures include secure software integrity, strong authentication (e.g., multi-factor authentication), secure communication protocols, and secure storage of credentials.

These three clauses are interrelated, forming a layered security strategy. For instance, weak authentication mechanisms (failing to meet (e) and (f)) could lead to a device being controlled, which could then harm networks (d), expose personal data (e), or facilitate fraud (f). Therefore, manufacturers must adopt a holistic security architecture.

▶ 2. Scope of Application

▶ 3. Harmonized Standards EN18031

To provide a clear path to compliance, the European Commission has mandated European Standardization Organizations CEN and CENELEC to develop specialized technical standards: the EN 18031 series. This series of standards is divided into three parts, corresponding to the three cybersecurity requirements of the RED:

• EN 18031-1:2024: Corresponds to RED Article 3(3)(d) (Network Integrity). It specifies basic cybersecurity requirements for all internet-connected radio equipment, including access control, secure communication, resilience, and network monitoring and traffic control.
• EN 18031-2:2024: Corresponds to RED Article 3(3)(e) (Data Privacy). Its scope is more targeted, applying to connected devices that process personal data, childcare equipment, toys, and wearable devices. It focuses on the technical implementation of “privacy by design,” covering data encryption, strong authentication, access control, and user data management.
• EN 18031-3:2024: Corresponds to RED Article 3(3)(f) (Fraud Protection). This is the most specialized part of the standard, targeting internet-connected devices that support financial transactions. It specifies secure transaction protocols, fraud detection mechanisms, and payment system protection.

▶ 4. Compliance Pathways

The core concept of EN18031 is to simplify the compliance process by achieving a “presumption of conformity” through full application of these standards, allowing manufacturers to conduct conformity assessment via the self-declaration (Module A) route without mandatory third-party Notified Body intervention.

However, if a manufacturer’s product design or implementation triggers any of the following limitations, mandatory engagement of a Notified Body for conformity assessment is required:

• Password Policy Limitation (applicable to EN 18031-1, -2, and -3): If the manufacturer’s implementation “allows users not to set and use any password,” the presumption of conformity is invalidated.
• Parental Control Limitation (applicable to EN 18031-2): For radio equipment within the scope of childcare or toy directives, if the implementation “cannot ensure access control for parents or guardians,” the presumption of conformity is invalidated.
• Security Update Limitation (applicable to EN 18031-3): For devices handling financial transactions, the assessment criteria for secure software update mechanisms do not provide a presumption of conformity. This area requires Notified Body assessment.

Regardless of the chosen compliance pathway, manufacturers bear the ultimate responsibility for product compliance and formally fulfill this through two key documents:

• Cybersecurity Risk Assessment: This is the foundation of any credible conformity assessment. Manufacturers must systematically identify, analyze, and evaluate potential threats and vulnerabilities related to the product, and comprehensively document this process. The assessment must consider all intended operating conditions and possible configurations, aiming to identify ways the product could be misused to harm networks (d), expose personal data (e), or facilitate fraud (f).
• Technical Documentation: This serves as comprehensive evidence demonstrating product conformity with the RED cybersecurity requirements. It must be compiled during the design and development phases and retained for 10 years for market surveillance authorities to inspect. Content includes product description, cybersecurity risk assessment, list of applied standards, description of security solutions, and evidence of compliance (e.g., test reports, penetration test results). If the Notified Body pathway is used, it also includes the EU-type examination certificate.
• EU Declaration of Conformity (DoC): This is a legally binding document in which the manufacturer declares that the product complies with all applicable EU legislation. For the new cybersecurity requirements, the DoC must explicitly state that the product complies with RED Article 3(3)(d), (e), and/or (f), and list the specific standards or technical specifications used to demonstrate compliance. The DoC must be signed by the head of the manufacturing company and provided with the product or via an online link.

▶ 5. Strategic Recommendations

Compliance with the new RED cybersecurity regulations is a mandatory prerequisite for market access in the EU, and the final product manufacturer always bears full responsibility for the compliance of the entire product. This requires product manufacturers to make cybersecurity a core consideration at every stage of the product lifecycle, including the selection of connected devices and subsequent security firmware updates.

Shenzhen WiseWish Technology’s 4G router and gateway products are currently able to meet the requirements of the new RED cybersecurity regulations. At the same time, we continuously improves monitoring processes to detect new cybersecurity risks and promptly provides security firmware updates to product manufacturers.