Sign in

RED cyber delegated act

Delegated Regulation (EU) 2022/30 on cybersecurity of radio equipment — European Commission

Also known as: RED delegated act, Delegated Regulation (EU) 2022/30, Radio Equipment Directive cybersecurity

Official site Official change log Subscribe to RED cyber delegated act (RSS)

Current version
Delegated Regulation (EU) 2022/30 as amended by (EU) 2023/2444
Published 20 July 2023. source
Status
In force
Next deadline
in 397 days
Delegated Regulation (EU) 2022/30 is repealed; the Cyber Resilience Act applies to these products instead source
Who must comply
Manufacturers, importers and distributors of radio equipment that can communicate over the internet, plus some radio toys, childcare and wearable equipment, placed on the EU market from 1 August 2025. source
How it is assessed
The manufacturer can self-assess only when it applies harmonised standards in full; otherwise a notified body is involved. source
Authority
Adopted by the European Commission under the Radio Equipment Directive 2014/53/EU; national market surveillance authorities enforce it under each Member State's law. source source
Enforced by
National market surveillance authorities enforce the Radio Equipment Directive, with penalties set by each Member State. source
Last change

Cybersecurity requirements for internet-connected radio equipment sold in the EU. The first EU rule to make network security a condition of placing a product on the market.

Recent changes

Nothing changed in the last 90 days. Sign in to read further back.

Key dates

Add these dates to your calendar
  1. in 397 days Delegated Regulation (EU) 2022/30 is repealed; the Cyber Resilience Act applies to these products instead
  2. The repealing Delegated Regulation (EU) 2026/339 enters into force
  3. Commission adopts Delegated Regulation (EU) 2026/339 repealing Delegated Regulation (EU) 2022/30 with effect from 11 December 2027
  4. The cybersecurity essential requirements apply to the radio equipment concerned
  5. References of harmonised standards EN 18031-1, -2 and -3:2024 published in the Official Journal with restrictions (Implementing Decision (EU) 2025/138)
Show 1 earlier date
  1. Amending Delegated Regulation (EU) 2023/2444 published and in force

Amendments

  1. Delegated Regulation (EU) 2022/30 as amended by (EU) 2023/2444 AmendmentCurrent text

    Moves the date of application from 1 August 2024 to 1 August 2025 and corrects the Regulation; published and in force on 27 October 2023. source

  2. Delegated Regulation (EU) 2022/30 Major version

    Makes the essential requirements of Article 3(3)(d), (e) and (f) of the Radio Equipment Directive apply to certain radio equipment; published in the Official Journal on 12 January 2022. source

    More
    • It entered into force on 1 February 2022.

Who it applies to

The act switches on the Radio Equipment Directive's network, privacy and fraud requirements for internet-connected and certain other radio equipment.

Network protection
Article 3(3)(d) (no harm to networks) applies to any radio equipment that can communicate over the internet, directly or via other equipment (Article 1(1)). source
Personal data and privacy
Article 3(3)(e) applies to internet-connected equipment, childcare equipment, toys and wearables that can process personal, traffic or location data (Article 1(2)). source
Fraud protection
Article 3(3)(f) applies to internet-connected equipment that lets the user transfer money, monetary value or virtual currency (Article 1(3)). source
Excluded
Equipment under the medical device and in vitro diagnostic regulations is excluded, and some aviation, vehicle and electronic road toll equipment is excluded from points (e) and (f) (Article 2). source
After 2027
The act is repealed from 11 December 2027 so the equipment is not subject to two sets of cybersecurity requirements once the Cyber Resilience Act applies (recitals 3-4). source

How compliance is assessed

The manufacturer can self-assess only when it applies harmonised standards in full; otherwise a notified body is involved.

With harmonised standards
Internal production control (Annex II), EU-type examination (Annex III) or full quality assurance (Annex IV) (Directive 2014/53/EU Article 17(3)). source
Without them
Where harmonised standards are not applied, applied only in part or do not exist, the equipment must go through EU-type examination or full quality assurance (Directive 2014/53/EU Article 17(4)). source
EN 18031 restrictions
EN 18031-1, -2 and -3:2024 were cited with restrictions, for example clauses that let users skip setting a password do not give presumption of conformity. source

Enforcement and penalties

National market surveillance authorities enforce the Radio Equipment Directive, with penalties set by each Member State.

Penalties
Member States lay down penalties for economic operators, which may include criminal penalties for serious infringements (Directive 2014/53/EU Article 46). source
After the repeal
The repeal does not affect market surveillance under the Directive of equipment's compliance with these requirements (Delegated Regulation (EU) 2026/339, recital 5). source

Documents

  1. Law text Delegated Regulation (EU) 2022/30
  2. Law text Delegated Regulation (EU) 2023/2444 - new date of application and corrections
  3. Law text Delegated Regulation (EU) 2026/339 - repeal from 11 December 2027
  4. Standard Implementing Decision (EU) 2025/138 - harmonised standards EN 18031 with restrictions
  5. Law text Directive 2014/53/EU (Radio Equipment Directive)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to RED cyber delegated act (RSS)