6 hours ago
Three dates frame everything here. The RED’s cybersecurity rules went live last summer, on 1 August 2025. The Commission then published the act repealing them on 29 April 2026. That repeal takes effect on 11 December 2027, when the Cyber Resilience Act (CRA) takes over.
That sounds like the problem is going away. It isn’t. Under EU RED, anything you place on the market before December 2027 stays under the old rules, and market surveillance authorities can still check it afterwards.
So this guide covers what applies to you right now under the EU RED Directive. You’ll see which products are caught, which standards give you a shortcut, and where the shortcut stops. I’ll also cover what UK manufacturers should do about Great Britain and Northern Ireland.
What Is the Radio Equipment Directive and Who Does It Cover?
The EU RED Directive, Directive 2014/53/EU, sets the rules for putting radio equipment on the EU market. If your product transmits or receives radio waves, it’s almost certainly in scope. That covers Wi-Fi, Bluetooth, Zigbee, cellular and plenty more. Making RED compliance essential for manufacturers placing wireless products on the EU market.
For years the directive said little about cybersecurity. Article 3(3) listed security-related requirements, but they didn’t bind anyone until the Commission flipped the switch in Delegated Regulation (EU) 2022/30, adopted on 29 October 2021. Then the date slipped. The rules of the radio equipment directive were due a year earlier, and they only applied from 1 August 2025.
How Qualysec Helps Before the Notified Body Does
Qualysec isn’t a notified body and can’t issue certificates. What it can do is catch the problems a notified body would flag for the EU RED Directive, while fixing them is still a firmware tweak and not a redesign.
Start with your setup flow
Qualysec checks your device against EN 18031-1, -2 and -3, restrictions included. The usual culprits are a “skip” button on password setup (6.2.5.1 and 6.2.5.2), missing parental access control on childcare gear and toys (ACM-4), and update paths that fall foul of 6.3.2.4. You get a list of the clauses most likely to cost you your presumption of conformity, with the cheapest fixes at the top. It also tells you early whether Module A is realistic or whether you should book a notified body now.
Testing the firmware
Then comes the security testing, and it’s done on the firmware you actually ship. Not the clean lab image. Qualysec goes through the production build, the mobile app, and the cloud back end, including the extra services and factory provisioning step that lab builds tend to leave out. That’s where default credentials, weak update paths, and exposed services usually turn up.
Retest and dated evidence
Once your team has fixed things, Qualysec retests and writes up the results with dates and build numbers. That evidence goes into your technical file, and your notified body starts from a much tidier place.
Source: https://qualysec.com/eu-red-directive/
That sounds like the problem is going away. It isn’t. Under EU RED, anything you place on the market before December 2027 stays under the old rules, and market surveillance authorities can still check it afterwards.
So this guide covers what applies to you right now under the EU RED Directive. You’ll see which products are caught, which standards give you a shortcut, and where the shortcut stops. I’ll also cover what UK manufacturers should do about Great Britain and Northern Ireland.
What Is the Radio Equipment Directive and Who Does It Cover?
The EU RED Directive, Directive 2014/53/EU, sets the rules for putting radio equipment on the EU market. If your product transmits or receives radio waves, it’s almost certainly in scope. That covers Wi-Fi, Bluetooth, Zigbee, cellular and plenty more. Making RED compliance essential for manufacturers placing wireless products on the EU market.
For years the directive said little about cybersecurity. Article 3(3) listed security-related requirements, but they didn’t bind anyone until the Commission flipped the switch in Delegated Regulation (EU) 2022/30, adopted on 29 October 2021. Then the date slipped. The rules of the radio equipment directive were due a year earlier, and they only applied from 1 August 2025.
How Qualysec Helps Before the Notified Body Does
Qualysec isn’t a notified body and can’t issue certificates. What it can do is catch the problems a notified body would flag for the EU RED Directive, while fixing them is still a firmware tweak and not a redesign.
Start with your setup flow
Qualysec checks your device against EN 18031-1, -2 and -3, restrictions included. The usual culprits are a “skip” button on password setup (6.2.5.1 and 6.2.5.2), missing parental access control on childcare gear and toys (ACM-4), and update paths that fall foul of 6.3.2.4. You get a list of the clauses most likely to cost you your presumption of conformity, with the cheapest fixes at the top. It also tells you early whether Module A is realistic or whether you should book a notified body now.
Testing the firmware
Then comes the security testing, and it’s done on the firmware you actually ship. Not the clean lab image. Qualysec goes through the production build, the mobile app, and the cloud back end, including the extra services and factory provisioning step that lab builds tend to leave out. That’s where default credentials, weak update paths, and exposed services usually turn up.
Retest and dated evidence
Once your team has fixed things, Qualysec retests and writes up the results with dates and build numbers. That evidence goes into your technical file, and your notified body starts from a much tidier place.
Source: https://qualysec.com/eu-red-directive/