The European Commission has adopted a Delegated Regulation repealing Delegated Regulation (EU) 2022/30, which introduced cybersecurity requirements for certain categories of radio equipment under the Radio Equipment Directive (RED). The repeal will take effect on 11 December 2027, aligning with the date when the Cyber Resilience Act (Regulation (EU) 2024/2847) becomes fully applicable.
Delegated Regulation (EU) 2022/30 had made specific cybersecurity-related requirements mandatory for certain radio equipment categories starting 1 August 2025, including provisions aimed at protecting networks, safeguarding personal data and user privacy, and preventing fraud. These requirements were introduced due to concerns that some connected radio devices could pose cybersecurity risks.
However, the adoption of the Cyber Resilience Act establishes a comprehensive horizontal framework for cybersecurity requirements applicable to products with digital elements across the European Union. The new regulation includes essential cybersecurity provisions that cover the same elements addressed by the RED Delegated Regulation.
To avoid regulatory duplication and ensure legal clarity for manufacturers and market authorities, the European Commission decided to repeal the RED cybersecurity delegated regulation once the Cyber Resilience Act becomes fully applicable.
Until 10 December 2027, radio equipment placed on the EU market will continue to be subject to the cybersecurity requirements established under Delegated Regulation (EU) 2022/30. After that date, such products will fall under the cybersecurity framework established by the Cyber Resilience Act.
This regulatory adjustment aims to streamline the EU cybersecurity framework for connected products while maintaining a high level of protection for networks, users, and digital infrastructure across the European single market.
This regulatory development represents a low-impact compliance update for manufacturers, importers, and distributors of radio equipment in the European Union. The European Commission has adopted a Delegated Regulation repealing Delegated Regulation (EU) 2022/30, which previously introduced cybersecurity requirements for certain categories of radio equipment under the Radio Equipment Directive (RED).
The repeal is intended to avoid regulatory duplication following the adoption of the Cyber Resilience Act (Regulation (EU) 2024/2847), which establishes a comprehensive horizontal framework for cybersecurity requirements applicable to products with digital elements across the EU market.
Although the cybersecurity provisions under the RED Delegated Regulation will remain applicable until 10 December 2027, the regulatory responsibility for cybersecurity requirements will ultimately transition to the Cyber Resilience Act once it becomes fully applicable on 11 December 2027.
- Repeals Delegated Regulation (EU) 2022/30 related to cybersecurity requirements for radio equipment
- Prevents regulatory overlap between the Radio Equipment Directive and the Cyber Resilience Act
- Maintains existing cybersecurity obligations during the transition period until December 2027
- Simplifies the EU regulatory framework for connected and digital products
- Provides legal certainty for manufacturers regarding future cybersecurity compliance requirements
Who?
- Manufacturers of radio equipment and connected wireless devices placed on the EU market
- Importers and distributors of radio and IoT devices within the European Union
- Producers of digital products with radio functionality subject to cybersecurity regulations
- Compliance and regulatory affairs teams responsible for product certification under the Radio Equipment Directive
- Organizations preparing for cybersecurity compliance under the Cyber Resilience Act
Conclusion
This regulatory update is classified as Low Impact, as it does not introduce new technical requirements, certification procedures, or testing obligations for radio equipment in the short term. Instead, it restructures the regulatory framework by transferring cybersecurity requirements from the RED Delegated Regulation to the Cyber Resilience Act, ensuring a unified cybersecurity regime for digital products in the European Union starting in December 2027.
Regulatory Authority
European Commission