The CRA and the Radio Equipment Directive side by side: EN 18031, the overlap and the dates

If your device has a radio, the CRA is not the first EU cybersecurity law you meet. The Radio Equipment Directive (RED, Directive 2014/53/EU) already asks radio equipment to protect networks, personal data and against fraud, and that duty is in force today. This guide sets the two side by side: what each asks, how they overlap, and when one hands over to the other. It is a documentation aid, not legal advice.

The RED's cybersecurity requirements

RED Article 3(3) lists essential requirements that apply only to the categories of radio equipment the Commission names. Three of them are about security:

• (d) radio equipment "does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service";
• (e) it "incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected";
• (f) it "supports certain features ensuring protection from fraud".

Commission Delegated Regulation (EU) 2022/30 switched these on for certain categories of radio equipment, in particular internet-connected radio equipment, from 1 August 2025 (recital 2 of Delegated Regulation (EU) 2026/339; the Commission's RED page says the same).

The EN 18031 standards and their restrictions

Commission Implementing Decision (EU) 2025/138 of 28 January 2025 lists three harmonised standards for those requirements:

• EN 18031-1:2024 for internet-connected radio equipment (Article 3(3)(d));
• EN 18031-2:2024 for radio equipment processing personal data, including internet-connected, childcare, toy and wearable radio equipment (Article 3(3)(e));
• EN 18031-3:2024 for internet-connected radio equipment processing virtual money or monetary value (Article 3(3)(f)).

The listing carries restrictions. Where a restriction applies, the standard gives no presumption of conformity for that part:

• in all three parts, the sections named "rationale" and "guidance" give no presumption, whatever the equipment;
• in all three parts, where the equipment allows the user not to set and use any password;
• in EN 18031-2, for childcare and toy radio equipment, where parental or guardian access controls are not provided as the standard's clauses describe;
• in EN 18031-3, for its secure-update assessment criteria (clause 6.3.2.4).

This matters for the procedure. RED Article 17(4) says that where harmonised standards were not applied, or applied only in part, conformity with Article 3(3) must be shown through EU-type examination or full quality assurance, which means a notified body. Our reading (argument): a device that lets users skip setting a password therefore cannot rely on self-assessment for that requirement.

The handover: 11 December 2027

The CRA (Regulation (EU) 2024/2847) applies in full from 11 December 2027 (Article 71(2), EUR-Lex text checked 8 October 2026). On 16 February 2026 the Commission adopted Delegated Regulation (EU) 2026/339, published in the Official Journal on 29 April 2026. Its Article 1 repeals Delegated Regulation 2022/30 with effect from 11 December 2027, the date the CRA applies. Radio devices placed on the market from that date are assessed for cybersecurity under the CRA, while the RED keeps its radio, safety and EMC requirements.

Devices placed on the market between 1 August 2025 and 10 December 2027 stay under the RED cybersecurity requirements, and market surveillance of them under the RED continues after the repeal (recital 5 of Delegated Regulation 2026/339; the Commission's CRA FAQ, version 1.4 of 4 September 2026 (2.6.1), says the same, not binding). Under CRA Article 69(2) they come under the CRA's other requirements only if substantially modified from 11 December 2027, but Article 14 reporting applies to them anyway (Article 69(3)). Article 69(1) says EU type-examination certificates and approval decisions "issued regarding cybersecurity requirements" under Union harmonisation legislation other than the CRA "shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred to in that legislation". The article names no other law.

That Article 69(1) reaches a certificate issued under the RED cybersecurity act is the Commission's reading, not the article's words (neither document is binding). Its CRA FAQ (7.1) names Delegated Regulation (EU) 2022/30 as an example of such other legislation. Its guidance C(2026) 5252 (section 9.3.2, paragraphs 247 to 254) says such a certificate can be relied on as evidence for the cybersecurity risks it covers, for as long as it stays valid and not beyond 11 June 2028, and that it does not replace the CRA risk assessment.

So the timeline for a radio device is:

Period	Cybersecurity law	Standards
Until July 2025	No RED cybersecurity requirement applied	—
August 2025 to 10 December 2027	RED Article 3(3)(d), (e), (f) via Delegated Regulation 2022/30	EN 18031-1, -2, -3:2024, with restrictions
From 11 September 2026	CRA Article 14 reporting also applies	—
From 11 December 2027	CRA in full; RED delegated act repealed	No CRA harmonised standard cited in the Official Journal on 8 October 2026

Where they overlap

Recital 3 of Delegated Regulation 2026/339 states that the CRA's essential requirements in Annex I "include all the elements" of RED Article 3(3)(d), (e) and (f). The detailed mapping below is our reading of the two texts (argument).

• Network harm (RED (d)) maps to the CRA's requirement to minimise the negative impact of the product on the availability of services provided by other devices or networks (Annex I, Part I(2)(i)).
• Personal data and privacy (RED (e)) maps to confidentiality of data (Part I(2)(e)) and protection from unauthorised access (Part I(2)(d)). Data minimisation (Part I(2)(g)) is also about personal data, but we do not count EN 18031 work as evidence for it: no EN 18031 mechanism in the public descriptions we found addresses it (see the mechanism table in EN 18031 and the CRA essential requirements), and the Commission's guidance gives data minimisation as an example of a risk a RED certificate may not cover (C(2026) 5252, paragraph 253, not binding).
• Access control and credentials, the subject of the password restriction, map to Part I(2)(d) and secure-by-default configuration (Part I(2)(b)).
• Secure updates, assessed in EN 18031, map to Part I(2)(c) and Part II(7).

Argument: work done to meet EN 18031 is good evidence for those CRA points. It is evidence, not a presumption; until CRA harmonised standards are cited, no standard gives a presumption of conformity under the CRA.

Where they differ

• Scope. The RED requirements reach radio equipment in the categories the delegated act names. The CRA reaches products with digital elements made available on the market that connect to a device or network (Article 2(1)), radio or not, including software sold on its own. Article 2 excludes some products covered by other EU law, such as medical devices and motor vehicles.
• Lifecycle. The RED requirements are about the product as placed on the market. The CRA adds duties for the whole support period: vulnerability handling (Annex I, Part II), security updates, and a support period of at least five years unless the product is expected to be in use for less (Article 13(8)).
• Reporting. The RED has no duty like Article 14 to report exploited vulnerabilities or incidents (our reading). The CRA's Article 14 reporting has applied since 11 September 2026, including to radio devices already on the market (Articles 71(2) and 69(3), EUR-Lex text checked 8 October 2026).
• SBOM. The CRA requires a software bill of materials (Annex I, Part II(1)); the RED does not.
• Assessment routes. Under the CRA, the route depends on the product's category (default, important class I or II, critical) under Article 32, not only on whether standards were applied.

What to do

1. If you sell radio devices today, your RED declaration should already cover Article 3(3)(d), (e) and (f) where your category is in scope, and the standards line should name the EN 18031 parts you applied, with any restriction that applies to you.
2. Close the password gap now. If your device lets users skip a password, either change that or plan for a notified body under the RED. The same design choice also touches the CRA's secure-by-default requirement.
3. Start CRA-only work early: the SBOM, vulnerability handling and the support period. Article 14 readiness is due now: it has applied since 11 September 2026. None of it is covered by the RED.
4. Plan the declaration change (our reading, argument): for units placed on the market until 10 December 2027, the RED declaration covers Article 3(3)(d), (e) and (f); for units placed from 11 December 2027, the declaration names the CRA and drops the RED cybersecurity points. See "The EU declaration of conformity for connected devices".

What is settled and what is not

Settled (evidence): the RED Article 3(3) text; the EN 18031 listing and its restrictions; the repeal of Delegated Regulation 2022/30 with effect from 11 December 2027 and continued RED surveillance of devices placed before then; the CRA's dates and the text of its Article 69 transitional rules.

Not settled (as of 8 October 2026): which harmonised standards the CRA will cite, and whether they will build on EN 18031. We update this guide when they are published.