EU RED delegated regulation 2022/30: the cybersecurity requirements and how to meet them

Article 3(3) of the RED lists nine essential requirements that apply only to "radio equipment within certain categories or classes" that the Commission specifies by delegated act. Delegated Regulation (EU) 2022/30 is that act for three of them:

Without a delegated act, these three requirements sit dormant; 2022/30 is what makes them enforceable, and only for the equipment categories it names.

Scope is decided category by category, not product by product in general — Article 1 of 2022/30 sets three separate triggers:

A childcare device, toy or wearable that processes personal data falls under point (e) even without an internet connection — a Bluetooth-only baby monitor or fitness band can be in scope for (e) while being out of scope for (d) and (f). An internet-connected smart plug with no payment function and no personal-data processing is in scope only for (d).

Exclusions (Article 2 of 2022/30): radio equipment covered by the Medical Devices Regulation (EU) 2017/745 or the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 is excluded from all three points. Radio equipment covered by the civil aviation rules in Regulation (EU) 2018/1139, the vehicle type-approval rules in Regulation (EU) 2019/2144, or the electronic road-tolling rules in Directive (EU) 2019/520, is excluded from points (e) and (f) only — it can still need point (d).

Conditionally, not automatically. RED Article 16 states that radio equipment conforming to a harmonised standard "the references of which have been published in the Official Journal" is presumed to meet the essential requirements that standard covers. Implementing Decision (EU) 2025/138 cited EN 18031-1 (network protection, for 3(3)(d)), EN 18031-2 (personal data and privacy, for 3(3)(e)) and EN 18031-3 (fraud protection, for 3(3)(f)) from 28 January 2025 — but the citation came with restrictions attached. Two matter to most firmware teams: applying the standard gives no presumption if a user is allowed not to set and use any password, and for childcare, toy and wearable products under EN 18031-2, no presumption if parental or guardian access control is not ensured.

If a restriction applies to your product's design, applying EN 18031 does not give you presumption of conformity for that requirement, and self-assessment is not available — see the next section. The full restriction list and the clause numbers it attaches to are in EN 18031 explained for firmware teams; this guide focuses on the compliance-route consequence, not the standard's internal clause structure.

RED Article 17 sets out three conformity assessment procedures a manufacturer can use to show compliance with Article 3:

• Annex II — internal production control. The manufacturer self-assesses, draws up the technical documentation, and signs the EU declaration of conformity alone. No notified body.
• Annex III — EU-type examination plus conformity to type. A notified body examines the technical design (Module B), and the manufacturer then has to manufacture every unit to match that approved type under internal production control (Module C).
• Annex IV — full quality assurance. A notified body audits the manufacturer's quality management system rather than a product sample.

Article 17(3) and (4) decide which routes are actually open to you: where the manufacturer has applied the cited harmonised standard in full, any of the three routes is available, including self-assessment under Annex II. Where the standard has not been applied, has been applied only in part, does not exist, or a published restriction removes presumption for the relevant requirement, Article 17(4) narrows the choice to Annex III or Annex IV only — third-party involvement through a notified body becomes mandatory. A notified body for RED is found through the European Commission's NANDO database.

This two-tier structure — self-assess if the cited standard genuinely covers your design, go to a notified body if it does not — is the same shape as the CRA's conformity assessment routes, though the two regulations use different annex numbers and a manufacturer should not assume a RED self-assessment carries over once the Cyber Resilience Act takes over radio equipment cybersecurity in December 2027.

Once a conformity assessment procedure has demonstrated compliance, Article 10(3) requires the manufacturer to draw up an EU declaration of conformity and affix the CE marking before placing the product on the market.

• EU declaration of conformity (Article 18, model in Annex VI): identifies the radio equipment; names and addresses the manufacturer or authorised representative; states that the declaration is issued under the manufacturer's sole responsibility; references the harmonised standards or technical specifications relied on; and, where a notified body was involved, names it and gives the EU-type examination certificate number.
• Technical documentation (Article 21, contents in Annex V): a general description of the equipment, including photographs, "versions of software or firmware affecting compliance with essential requirements," and user instructions; design and manufacturing drawings; a list of the harmonised standards applied in full or in part, with the parts applied where only partly used; a copy of the EU declaration of conformity; the EU-type examination certificate where Annex III was used; and test reports.
• CE marking (Articles 19-20): affixed visibly, legibly and indelibly to the equipment or its data plate and to the packaging, followed by the notified body's identification number where Annex IV was used.

Manufacturers have to keep the technical documentation and declaration of conformity for 10 years after the equipment is placed on the market (Article 10(4)).

Similar paperwork also exists under the Cyber Resilience Act once it applies; see CRA declaration of conformity and technical documentation, explained for how that later regime's version compares.

Annex V's technical documentation requirement explicitly calls out "versions of software or firmware affecting compliance with essential requirements" and a list of the harmonised standards actually applied. A software bill of materials and an engineer-reviewed firmware vulnerability scan are practical evidence for both: the SBOM identifies the firmware and third-party component versions shipped, and a vulnerability scan documents which known issues were checked and addressed before the equipment went on the market — useful if a market surveillance authority later asks the manufacturer or importer to demonstrate how it ensured the essential requirements were met (Article 21(4)).

Automated, engineer-reviewed firmware and SBOM analysis can produce this evidence in days rather than the weeks manual component inventory work takes, which matters most when a notified body's own schedule is already part of the critical path. It is worth being precise about what this evidence does and does not do, though: it does not decide which conformity assessment route Article 17 makes available to a product, and it does not create presumption of conformity under Article 16 — only a harmonised standard cited in the Official Journal does that. A scan report is technical-documentation evidence a human still has to review and a manufacturer still has to stand behind; it is not itself a conformity assessment, and it cannot substitute for a notified body's Annex III or Annex IV involvement where one is required. See firmware SBOM without source code for how to build one from a binary image.

RED's cybersecurity requirements are EU-specific and apply only to radio equipment as the RED and 2022/30 define it. Manufacturers selling the same product line into other markets, or building to a broader voluntary baseline first, typically also meet:

• ETSI EN 303 645, a voluntary consumer IoT baseline with no RED citation of its own, but one that several of its 13 provisions overlap in substance with RED's network-protection and password-handling expectations.
• UK PSTI and the US Cyber Trust Mark, two other connected-device regimes with their own separate legal basis, scope and enforcement — meeting RED's Article 3(3) requirements does not automatically satisfy either of them.

Within the EU itself, radio equipment cybersecurity does not stay with the RED indefinitely: Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027, when the Cyber Resilience Act becomes the governing regime for the same products, with its own essential requirements in Annex I and its own SBOM and vulnerability-handling duties. Radio equipment placed on the market between 1 August 2025 and 10 December 2027 remains subject to RED market surveillance in the meantime.