{"id":26758,"date":"2025-07-23T08:14:19","date_gmt":"2025-07-23T07:14:19","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=26758"},"modified":"2025-07-23T12:48:51","modified_gmt":"2025-07-23T11:48:51","slug":"radio-equipment-directive-a-first-step-toward-securing-european-connected-products","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2025\/07\/radio-equipment-directive-a-first-step-toward-securing-european-connected-products\/","title":{"rendered":"\u200b\u200bRadio Equipment Directive: A first step toward securing European connected products\u200b"},"content":{"rendered":"\n

The internet of Things (IoT)<\/span><\/b> is a rapidly growing sector, with increasing adoption across a wide range of domains. From production plants (industry 4.0) to homes (smart home systems) and even the devices we wear (such as smartphones and smartwatches), connected objects are becoming omnipresent in our daily lives.<\/span>\u00a0<\/span><\/p>\n

The Radio Equipment Directive (RED) establishes a European framework for <\/span>regulating all equipment that communicates via radio waves. <\/span><\/b>This includes any device using technologies such as Wi-Fi, Bluetooth, LoRaWAN, or cellular networks like 4G and 5G.<\/span>\u00a0<\/span><\/p>\n

In this context, <\/span>August 1<\/span><\/b>st<\/span><\/b> 2025, marks a key milestone:<\/span><\/b> from that date onward, the RED\u2019s cybersecurity requirements will become mandatory! Economic operators (including manufacturers, importers and distributors) who fail to comply with these obligations may face sanctions ranging from the withdrawal of their products from the EU market to significant administrative fines, depending on the applicable legislation in each member state.<\/span>\u00a0<\/span><\/p>\n

This article aims to break down the directive and highlight the key takeaways. If you are behind in your compliance efforts, you will also find guidance here on how to get started!<\/span><\/b>\u00a0<\/span><\/p>\n

RED explained: What you need to know<\/span>\u00a0<\/span><\/h1>\n

Adopted in June 2014,<\/span><\/b> the RED (2014\/53\/EU) aims to standardize the marketing of radio equipment within the EU. Its primary objective is to ensure that devices that transmit or receive radio waves (such as smartphones and Wi-Fi routers) comply with health, safety, electromagnetic compatibility, and efficient use of the radio spectrum requirements.<\/span>\u00a0<\/span><\/p>\n

However, <\/span>it was not until 2022 that cybersecurity was integrated into the RED<\/span><\/b>, nearly eight years after its creation. The introduction of delegated act 2022\/30 marked a new phase by adding specific requirements aimed at enhancing the resilience of radio equipment against digital threats.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Scope of application of RED\u00a0<\/h1>\n

Definition of radio equipment<\/span>\u00a0<\/span><\/h2>\n

According to Article 2.11 of the RED, radio equipment is defined as:<\/span>\u00a0<\/span><\/p>\n

\u201cAn electrical or electronic product that intentionally emits and\/or receives radio waves for the purpose of radio communication and\/or radio navigation\u201d<\/span>\u00a0<\/span><\/p>\n

Specifically, this includes any device that uses wireless communication protocols such as Wi-Fi, Bluetooth, Zigbee, LTE, 5G, NFC, or LoRa to transmit or receive data via the radio spectrum.<\/span>\u00a0<\/span><\/p>\n

These technologies form the basis of many everyday devices, particularly in the fields of home automation and the Internet of Things (IoT). The RED directive therefore covers a very wide range of products.<\/span>\u00a0<\/span><\/p>\n

Sectors excluded from the scope<\/span>\u00a0<\/span><\/h2>\n

The RED directive does not apply to all radio equipment. Some categories are explicitly excluded from its scope, particularly for reasons of sovereignty, specific regulatory frameworks, or usage contexts.<\/span>\u00a0<\/span><\/p>\n

Sectors subject to their own regulations:<\/span><\/b>\u00a0<\/span><\/p>\n