The European Commission has published an updated Guide to the Radio Equipment Directive 2014/53/EU (RED), replacing the earlier versions of May 2017, June 2018 and December 2018.
At 95 pages, the guide brings together the Commission’s current interpretation of the RED, including the cybersecurity requirements now in force, the common charger rules and the coming transition to the Cyber Resilience Act (CRA). While the guide is not legally binding, it reflects the consensus reached between Member States and stakeholders, and is the key reference used by manufacturers, notified bodies and market surveillance authorities.
Cybersecurity: Clarifications and the Transition to the CRA
Since 1 August 2025, internet-connected radio equipment, along with certain wearable and toy radio equipment, must meet the cybersecurity requirements of Article 3(3)(d), (e) and (f) of the RED under Delegated Regulation (EU) 2022/30. The guide clarifies how these terms should be interpreted:
- Internet-connected radio equipment is any radio equipment that can communicate over the internet, either directly or indirectly through other equipment such as a gateway or hub.
- Wearable radio equipment is limited to devices worn on the body that monitor or record sensitive data, such as fitness trackers, smartwatches and smart rings. Handheld devices such as smartphones are not considered wearables.
- Implants are not wearables, but are treated as internet-connected if they can communicate over the internet.
A new section of worked examples shows how to assess whether a product is internet-connected. This includes combined products where a radio module that cannot connect to the internet sits inside a device that can.
Most significantly, the guide confirms that Delegated Regulation (EU) 2022/30 will be repealed from 11 December 2027 by Delegated Regulation (EU) 2026/339. From that date, cybersecurity requirements for radio equipment placed on the EU market will fall under the Cyber Resilience Act (Regulation (EU) 2024/2847) rather than the RED, subject to the CRA’s transitional provisions.
Common Charger Requirements
The guide includes a dedicated info sheet and practical labelling examples for the common charger requirements. Products in scope that are recharged by wired charging must use a USB Type-C receptacle. Devices charging above 5 V, 3 A or 15 W must also support USB Power Delivery.
The requirements apply from:
- 28 December 2024 for mobile phones, tablets, digital cameras, headphones, headsets, earbuds, handheld videogame consoles, portable speakers, e-readers, keyboards, mice and portable navigation systems
- 28 April 2026 for laptops
Manufacturers must also provide:
- a charging label
- a pictogram showing whether a charger is included
Consumers must be offered the option to buy the device without a charger. For online sales, both the label and the pictogram must appear close to the price.
The rules apply to every unit first placed on the EU market after these dates, even for models already on sale. Existing stock placed on the market earlier may still be sold.
Conformity Assessment and Harmonised Standards
The guide restates when a notified body must be involved:
- Self-declaration always available: For health and safety (Article 3.1(a)), EMC (Article 3.1(b)) and the common charger (Article 3.4), manufacturers can always self-declare under Module A.
- Notified body may be required: For radio spectrum use (Article 3.2) and the specific requirements of Article 3.3, including cybersecurity, a notified body is needed in any of these cases:
- harmonised standards are not applied in full
- harmonised standards do not exist
- the standard is cited in the Official Journal with a restriction that affects the product
Other clarifications include:
- Where both exist, the product-specific harmonised standard must be applied ahead of a generic one to gain presumption of conformity.
- When a harmonised standard is revised, manufacturers must reassess compliance against the new state of the art. This means reviewing the risk assessment and documenting the outcome, not necessarily repeating every test.
- Manufacturers who continue using a superseded standard for Article 3.2 or 3.3 after it loses presumption of conformity must involve a notified body.
- A software update is treated as creating a new product if both of the following apply:
- it changes the intended functions, radio interface or performance in a way not foreseen in the original risk assessment
- as a result, it changes the nature of the hazard or increases the level of risk
Practical Clarifications for Manufacturers
The guide also settles several day-to-day questions that commonly lead to non-compliance findings:
- CE marking: A CE mark placed only in the battery compartment, or anywhere a part must be removed to see it, does not meet the visibility requirement. A digital CE mark may only be used in addition to the physical marking.
- Frequency and power information: Instructions must state the frequency bands and maximum output power for EU operation. Using “<” or “less than”, or referring to power classes, is not acceptable. Multimode equipment only needs to list modes used in the EU.
- Traceability: The manufacturer’s name and address on the EU Declaration of Conformity alone does not meet the traceability requirement. It must appear on the product or, where permitted, on its packaging or accompanying documents. Peel-off protective film labels are acceptable.
- Technical documentation: The file should reflect the full history of the product, including all previous Declarations of Conformity, test reports and risk assessments.
- Radio modules and chips: The following are radio equipment in their own right and fall under the RED:
- RF modules
- integrated circuits capable of transmitting or receiving once integrated
- EU economic operator: The minimum authorised representative mandate under the RED is not enough on its own to meet Regulation (EU) 2019/1020. That regulation requires an economic operator established in the EU.
Relationship with Other EU Legislation
The guide reminds manufacturers that RED compliance alone does not guarantee free circulation in the EU, since radio equipment must meet all applicable EU legislation.
Radio equipment under the RED is excluded from the Low Voltage Directive (LVD) and EMC Directive (EMCD). However, the RED applies their essential requirements, with the safety objectives applying without any voltage limit.
The guide also outlines how the RED interacts with:
- RoHS, WEEE, REACH and ecodesign requirements, including Regulation (EU) 2025/2052 for external power supplies and the Common Charger logo
- The Batteries Regulation (EU) 2023/1542, including removability and replaceability requirements
- The General Product Safety Regulation (EU) 2023/988, which covers risks outside the RED’s scope, such as mental health risks from connected products
- The Machinery Regulation (EU) 2023/1230, applicable from 20 January 2027
- The European Accessibility Act, the AI Act and the GDPR
It further references the Commission’s Omnibus IV proposal. This would introduce targeted amendments allowing digital product information under several EU laws, including the RED.
What This Means for Industry
The updated guide does not introduce new legal obligations, but it sets out how authorities and notified bodies will interpret existing ones. Manufacturers should review their technical documentation, labelling and instructions against these clarifications. This is especially important for internet-connected products and devices in scope of the common charger rules.
The RED cybersecurity requirements end on 11 December 2027. Manufacturers of connected radio equipment should therefore start planning for CRA compliance now, rather than treating RED cybersecurity as the long-term pathway.
How C-PRAV Can Support You
C-PRAV supports manufacturers with end-to-end CE marking for radio equipment, including:
- RED gap analysis
- technical documentation review
- testing at our NATA-accredited laboratory in Melbourne, covering EMC, radio, electrical safety and RF exposure
Our cybersecurity team performs EN 18031 testing for RED compliance and helps manufacturers prepare for the EU Cyber Resilience Act. With our new office in France, we now offer local support for clients entering the European market.
Have questions? We’re here to help.