RED Cybersecurity: Frequently Asked Questions

Get answers to the most common questions about the new RED cybersecurity requirements, EN 18031, and the August 2025 compliance deadline.

What are the new RED cybersecurity requirements?

The RED now includes Articles 3.3(d) (network security), 3.3(e) (protection of personal data and privacy), and 3.3(f) (protection from fraud), which mandate cybersecurity measures for radio equipment.

When do the new requirements become mandatory?

From 1 August 2025, all radio devices sold in the EU must comply.

Which products are affected?

Any radio equipment that:

• Connects to the internet and
• Processes personal, location, or traffic data or
• Enables financial transactions
• Includes IoT devices, wearables, connected toys, and childcare products

What is EN 18031?

EN 18031 is the harmonised European standard for cybersecurity testing and certification to comply with the RED cybersecurity articles 3.3d, 3.3 e and 3.3f.

Can I do a self-declaration for RED cybersecurity?

Self-assessment is possible if you fully implement EN 18031 or if regulatory restrictions do not apply to you. Otherwise, a Notified Body assessment is required.

What would happen if you marketed a product in the EU that did not comply with the regulations as of 1 August 2025?

Non-compliant products cannot be placed on the EU market and may be subject to withdrawal, fines, or other penalties.

How can Applus+ Laboratories help?

We provide gap analysis, official EN 18031 evaluations, and Notified Body certification services to ensure your products meet all RED cybersecurity requirements.

Where can I get a checklist or more information?

Contact us for our comprehensive RED Cybersecurity Evidence Checklist or explore our Resource Centre for guides, templates, and more.

Still have questions?

Contact our experts for personalised support.