Testing laboratory and consultancy · Granges-Paccot

Book a call

Radio Equipment Directive 2014/53/EU · EN 18031 · Cyber Resilience Act

CE marking of connected products and IoT

Sensors, gateways, wearables, smart home devices: as soon as a product communicates by radio, the Radio Equipment Directive (RED) applies. It covers safety, EMC, use of the spectrum and, for internet-connected products, cybersecurity. Säfeli brings radio testing, cybersecurity and the technical file together in a single project, up to the EU declaration of conformity that you sign.

Book a 30-minute callSee our services
Directive 2014/53/EU
RED
RED cybersecurity mandatory
01.08.2025
Harmonised standards since 2025
EN 18031
Cyber Resilience Act applies
11.12.2027

Who it is for

You develop products that communicate

  • Hardware start-ups

    A first connected product: RED certification plan from the prototype stage, choice of radio module, realistic budget and schedule.

  • Smart home and buildings

    Thermostats, sensors, locks, cameras: cybersecurity, personal data, updates and installation.

  • Wearables and wellbeing

    Watches, trackers, body sensors: exposure to fields close to the body, personal data.

  • Industrial IoT

    Gateways, LoRa or cellular modules, connected sensors: sub-GHz bands, industrial environments.

Our services

RED compliance for your product, step by step

Radio, cybersecurity, safety and EMC: one point of contact, one certification plan, one technical file.

Engineer examining the circuit board of a connected device and its radio module under a magnifier
RED analysis

RED analysis and certification plan

Which Article 3 requirements apply, which standards for each radio technology, is the certified module enough? We set the test and documentation plan from the prototype stage, so you avoid a new board or a new enclosure.

What you receive

  • Applicable RED requirements, article by article
  • Standards for each radio technology
  • Test plan, budget and schedule

References

  • Directive 2014/53/EU, Art. 3
  • Delegated Regulation (EU) 2022/30
Connected device in a shielded box, linked by coaxial cable to a spectrum analyser
Radio

Radio testing and exposure to fields

Transmitted power, spectrum occupancy, spurious emissions, receiver performance: we carry out the tests to the harmonised standard for each technology, for example EN 300 328 for Wi-Fi and Bluetooth, and assess exposure to fields.

What you receive

  • Radio test reports
  • Assessment of exposure to fields
  • Justification of the radio module integration

References

  • EN 300 328 V2.2.2
  • EN 300 220-2 V3.1.1
  • EN 62479:2010
Opened connected camera linked to a computer through a serial adapter for a security test
Cybersecurity

RED cybersecurity and EN 18031

Protection of the network, of personal data and from fraud: we assess your product against EN 18031, test its interfaces (radio, debug ports, app, cloud) and prepare documentation you can reuse for the Cyber Resilience Act.

What you receive

  • Analysis of assets and interfaces
  • EN 18031 assessment and testing
  • Cybersecurity documentation reusable for the CRA

References

  • EN 18031-1:2024
  • EN 18031-2:2024
  • EN 18031-3:2024
Electrostatic discharge test with an ESD gun on a connected thermostat
Safety and EMC

Safety, EMC and technical file

Electrical safety, EMC of the radio part and of the host product, electrostatic discharge, immunity and emissions: we bring all the reports together in the RED technical file and prepare the instructions and the EU declaration of conformity.

What you receive

  • Safety and EMC reports
  • RED technical file
  • Instructions and EU declaration of conformity

References

  • EN IEC 62368-1:2024/A11:2024
  • EN 301 489 series
  • EN 55035:2017/A11:2020

Also

Radio Equipment Directive

What the Radio Equipment Directive covers

The RED applies to any product that intentionally emits or receives radio waves to communicate. It takes over safety and EMC, adds efficient use of the spectrum and, since 1 August 2025, the cybersecurity of internet-connected equipment.

  1. 01.08.2025RED cybersecurity: Article 3.3(d), (e) and (f)
  2. 11.09.2026Cyber Resilience Act: vulnerability reporting
  3. 11.12.2027Cyber Resilience Act: full application

  • Art. 3.1(a) Safety

    Health and safety of persons, including the objectives of the Low Voltage Directive but with no voltage limit: a battery-powered sensor is covered.

    Directive 2014/53/EU, Art. 3(1)(a)

  • Art. 3.1(b) EMC

    An adequate level of electromagnetic compatibility as set out in Directive 2014/30/EU, for the radio part as well as the rest of the product.

    Directive 2014/53/EU, Art. 3(1)(b)

  • Art. 3.2 Radio spectrum

    Efficient use of the spectrum to avoid harmful interference: this is what the radio tests cover.

    Directive 2014/53/EU, Art. 3(2)

  • Art. 3.3(d) Network protection

    Any radio equipment that can communicate over the internet, directly or via other equipment, must not harm the network.

    Delegated Regulation (EU) 2022/30, Art. 1(1)

  • Art. 3.3(e) Personal data

    Internet-connected equipment that processes personal data, childcare equipment, radio toys and wearable equipment.

    Delegated Regulation (EU) 2022/30, Art. 1(2)

  • Art. 3.3(f) Protection from fraud

    Internet-connected equipment that enables the transfer of money, monetary value or virtual currency.

    Delegated Regulation (EU) 2022/30, Art. 1(3)

Sources: Directive 2014/53/EU, Art. 3; Delegated Regulation (EU) 2022/30, Art. 1, applicable since 1 August 2025 (Delegated Regulation (EU) 2023/2444); Regulation (EU) 2024/2847, Art. 71.

EN 18031

EN 18031: the points that make a technical file fail

The RED cybersecurity standards have been harmonised since 30 January 2025, with restrictions. Knowing them from the design stage avoids rewriting the software at the end of the project.

  • Three standards, three requirements

    EN 18031-1 covers network protection (3.3(d)), EN 18031-2 personal data (3.3(e)) and EN 18031-3 protection from fraud (3.3(f)).

    EN 18031-1, -2 and -3:2024

  • Optional passwords

    If the user can choose not to set any password, EN 18031-1 and EN 18031-2 do not give a presumption of conformity: another form of demonstration is needed.

    OJEU of 30.01.2025, restrictions (clauses 6.2.5.1 and 6.2.5.2)

  • Parental control

    For toys, childcare equipment and certain wearables, EN 18031-2 gives no presumption if parental access control is not ensured.

    OJEU of 30.01.2025, restriction on EN 18031-2

  • No presumption, type examination

    If the harmonised standards are not applied in full, the Article 3.3 requirements go through an EU-type examination carried out by a third-party body. A well-prepared design avoids it.

    Directive 2014/53/EU, Art. 17(4)

Cyber Resilience Act

After the RED, the Cyber Resilience Act

The CRA applies to all products with digital elements, radio or not: design requirements, vulnerability handling throughout the support period, and reporting of actively exploited vulnerabilities. The cybersecurity part of the RED will be repealed on 11 December 2027: the CRA will then take over, and the work done for EN 18031 provides a solid basis for it.

Sources: Regulation (EU) 2024/2847, Art. 13, 14 and 71; Delegated Regulation (EU) 2026/339

The Cyber Resilience ActCybersecurity of connected products

Standards

Standards for connected products

Each radio technology has its own harmonised standard; EMC, safety, exposure to fields and cybersecurity have theirs. The certification plan sets the combination for your product.

AreaStandardScope
RadioEN 300 328 V2.2.2Wideband transmission systems in the 2.4 GHz band: Wi-Fi, Bluetooth, Zigbee
RadioEN 301 893*5 GHz radio local area networks
RadioEN 300 220-2 V3.1.1Short range devices from 25 MHz to 1000 MHz: LoRa, sub-GHz
RadioEN 301 908-1*IMT cellular networks
CyberEN 18031-1:2024Network protection (Art. 3.3(d)), with restrictions in the OJEU
CyberEN 18031-2:2024Protection of personal data (Art. 3.3(e)), with restrictions in the OJEU
CyberEN 18031-3:2024Protection from fraud (Art. 3.3(f))
CyberETSI EN 303 645 V2.1.1Cybersecurity for consumer IoT, non-harmonised reference
EMCEN 301 489-1 and -17*EMC of radio equipment: common requirements and wideband systems
EMCEN 55035:2017/A11:2020Immunity of multimedia equipment (host product)
SafetyEN IEC 62368-1:2024/A11:2024Safety of audio/video, information and communication technology equipment
FieldsEN 62479:2010Exposure to fields from low-power equipment
FieldsEN IEC 62311:2020Human exposure to electromagnetic fields (0 Hz to 300 GHz)
FieldsEN 50566:2017/A1:2023Exposure from hand-held and body-mounted devices
RoHSEN IEC 63000:2018Technical documentation for the assessment of hazardous substances

* Edition to be checked for your project. Standards remain voluntary; applying a harmonised standard whose reference is published in the Official Journal of the EU gives a presumption of conformity with the requirements it covers, within the limits of the published restrictions. For Article 3(2) and (3), the conformity assessment procedure depends on it (Directive 2014/53/EU, Art. 17).

Radio module

Certified radio module: what it covers and what it does not

Integrating a module that has already been assessed reduces radio testing, but does not remove the need to assess the final product.

  • What the module provides

    The module manufacturer's radio test reports can often be reused, provided the antenna, power and radio software stay within the tested conditions.

  • What still has to be shown

    The final product is still new radio equipment: EMC, safety, exposure to fields, emissions with your power supply and enclosure, and the cybersecurity of the whole product.

  • Who signs

    Whoever places the final product on the market under their own name is the manufacturer: they compile the technical file and sign the EU declaration of conformity, even with a certified module.

    Directive 2014/53/EU, Art. 10

Our approach

CE marking of your connected product in four steps

  1. Discovery call

    Your product, its radio technologies, your markets and your timeline. 30 minutes.

  2. Certification plan

    RED requirements, radio standards, cybersecurity, tests, budget and schedule.

  3. Testing and assessment

    Radio, EMC, safety, exposure to fields, EN 18031, corrections with your teams.

  4. File and declaration

    Technical file, instructions and EU declaration of conformity: you affix the CE marking.

Swiss market

Selling your connected product in Switzerland and the EU

In Switzerland, radio equipment falls under the Swiss Ordinance on Telecommunications Installations (FAV), which takes over the requirements of the Radio Equipment Directive. The same standards and the same technical file serve both markets. We check for you how far the cybersecurity requirements have been taken over into Swiss law, and which obligations are specific to the Swiss market.

Source: FAV, SR 784.101.2, of 25 November 2015 (Fedlex).

Frequently asked questions

Frequently asked questions on CE marking of connected products

Does your product raise a specific question? Ask an engineer directly.

Book a call
Does my connected product have to comply with the Radio Equipment Directive (RED)?

Yes, as soon as it intentionally emits or receives radio waves to communicate: Wi-Fi, Bluetooth, Zigbee, LoRa, cellular, NFC. The RED then replaces the Low Voltage Directive and the EMC Directive for that product, and takes over their objectives.

Sources: Directive 2014/53/EU, Art. 2(1)(1) and Art. 3

Which cybersecurity requirements apply since 1 August 2025?

Points (d), (e) and (f) of Article 3.3 of the RED: network protection for all internet-connected radio equipment, protection of personal data for equipment that processes it (as well as toys, childcare equipment and wearables), and protection from fraud for equipment that enables payments.

Sources: Delegated Regulation (EU) 2022/30, Art. 1; Delegated Regulation (EU) 2023/2444

Is a Bluetooth product paired with a smartphone “connected to the internet”?

Often, yes. The delegated regulation covers radio equipment that can communicate over the internet “directly or via any other equipment”. If your app relays the product’s data to the cloud or sends it updates, the product is in principle covered. We analyse your product’s data flows to decide.

Sources: Delegated Regulation (EU) 2022/30, Art. 1(1)

Is EN 18031 mandatory?

No, but it is the simplest route. EN 18031-1, -2 and -3 have been harmonised since 30 January 2025, with restrictions, notably on optional passwords. If they are not applied in full, the Article 3.3 requirements must go through an EU-type examination carried out by a third-party body.

Sources: OJEU of 30.01.2025; Directive 2014/53/EU, Art. 17(3) and (4)

I use a radio module that is already certified: do I have to repeat the tests?

Not all of them. The module’s radio reports can often be reused if its integration respects the tested conditions (antenna, power, software). The final product, however, must be assessed for EMC, safety, exposure to fields and cybersecurity, and you are the one who signs the EU declaration of conformity.

Sources: Directive 2014/53/EU, Art. 10 and 17

What is the difference between the RED and the Cyber Resilience Act?

The RED cybersecurity requirements cover internet-connected radio equipment and have applied since 1 August 2025. The Cyber Resilience Act covers all products with digital elements, radio or not, and also covers vulnerability handling throughout the support period: reporting from 11 September 2026, the whole regulation from 11 December 2027. On that date, the cybersecurity part of the RED is repealed and the CRA takes over.

Sources: Delegated Regulations (EU) 2022/30 and 2026/339; Regulation (EU) 2024/2847, Art. 14 and 71

What must the instructions for a radio product state?

Instructions and safety information in the users’ language, the frequency bands used and the maximum power transmitted in those bands. The product is accompanied by the EU declaration of conformity or by a simplified declaration giving the internet address of the full version.

Sources: Directive 2014/53/EU, Art. 10(8) and (9)

Which electrical safety standard applies to a connected device?

Usually EN IEC 62368-1 for audio/video, information and communication technology equipment, and EN 60335-1 for connected household appliances. The RED covers safety with no voltage limit: a battery-powered or USB-powered product is also covered. Exposure to fields is assessed with EN 62479 or EN IEC 62311.

Sources: Directive 2014/53/EU, Art. 3(1)(a)

Book a call

Tell us about your connected product

Book a 30-minute slot with an engineer directly. No back-and-forth by email: you choose the time, we prepare the call.

Choose a time slot

Contact details

Address
Säfeli Sàrl
Route d'Englisberg 3
1763 Granges-Paccot
Languages
French, German, English
Book a call