Which products are covered by RED?

Any equipment intentionally transmitting or receiving radio waves for communication or radio determination: Wi-Fi, BLE, ZigBee, LoRa, Sigfox, cellular, NFC, UWB, GNSS receivers only, remote controls, wireless microphones, etc.

Does RED replace EMC?

No. RED encompasses radio EMC (article 3.1(b)) for radio equipment, but the EMC Directive 2014/30/EU remains applicable for non-radio equipment. A radio product falls under RED, not directly under EMC.

What does article 3.3 add since August 2025?

Article 3.3 activates cybersecurity requirements for connected radio products, personal data protection (3.3(e)), fraud protection (3.3(f)), network functionality protection (3.3(d)). Standards EN 18031-1/2/3 cover these requirements.

Does my already-certified Wi-Fi module cover my final product?

No. The module certificate covers the module in isolation; the final product must be reassessed in its integration configuration. Radio tests can be partially reused if integration conditions are identical, rare in practice.

Does RED apply to receivers only (no transmission)?

Yes. Pure receivers (GPS, FM, DAB) are covered by RED. Article 3.2 (efficient use of spectrum) requirements apply only partially, but articles 3.1(a) safety, 3.1(b) EMC and 3.3 cybersecurity still apply.

RED Directive 2014/53/EU, overview

Hugues Orgitello updated 7 Oct 2026 5 min read

The RED Directive 2014/53/EU frames all radio equipment placed on the European market. Adopted in 2014, enriched by Delegated Regulation 2022/30 which activates cybersecurity since 1 August 2025, it is the most impactful directive for modern IoT products, and the most often overlooked in compliance analyses.

Scope and logic

The RED directive applies to any equipment that intentionally transmits and/or receives radio waves for communication or radio determination. This criterion covers a far wider range than many project teams imagine:

Intentional transmitters: Wi-Fi, Bluetooth/BLE, ZigBee, Thread, Z-Wave, LoRa, Sigfox, cellular 2G/3G/4G/5G, active NFC, UWB, remote controls, RFID, wireless microphones, radio medical devices.
Intentional receivers only: GNSS receivers (GPS, Galileo, GLONASS), FM/DAB/DAB+ receivers, TV receivers.
Combined transceivers: all bidirectional communication equipment.

Out of scope:

equipment neither intentionally transmitting nor receiving radio waves (Ethernet cable, wired sensor);
radio equipment used exclusively for public security, defence, State security or State criminal law activities (Article 1(3)); dual-use equipment stays in scope;
the four Annex I cases: radio amateur equipment not made available on the market, marine equipment, airborne products, and custom-built evaluation kits destined for professionals to be used solely at research and development facilities (Annex I point 4). Generic evaluation boards sold to R&D departments are in scope (see RED scope).

Four articles, four families of requirements

RED's regulatory architecture organises around four articles of essential requirements. Not all apply systematically, applicability depends on product type and, for article 3.3, on the delegated regulation that activates it.

Article	Subject	Main harmonised standards
3.1(a)	User health and safety	EN 50360, EN 50566 (SAR), EN 50385, EN 50401 (base stations); EN 62209 and EN 62311 are not RED-cited
3.1(b)	Electromagnetic compatibility	EN 301 489 specific parts by radio type (for example EN 301 489-17); EN 301 489-1 is not cited on its own
3.2	Efficient use of spectrum	Band-specific standard (EN 300 328, EN 301 893, EN 300 220...)
3.3(a)	Interworking with accessories	Not activated (no delegated act)
3.3(b)	Interworking via networks with other radio equipment	Not activated (no delegated act)
3.3(c)	Connection to interfaces of the appropriate type	Not activated (no delegated act)
3.3(d)	Protection of network functions	EN 18031-1 (since 2025)
3.3(e)	Personal data protection	EN 18031-2 (since 2025)
3.3(f)	Protection against fraud	EN 18031-3 (since 2025)
3.3(g–i)	Other (accessibility, e-call, etc.)	Specific cases

Article 3.2 is most visible to engineers: it defines maximum transmit powers, spectral masks, mandatory protocols (DFS, TPC, LBT). Article 3.3 is the most recent and least mastered: its cybersecurity activation in August 2025 transformed the European IoT product landscape.

Cybersecurity since 1 August 2025

Delegated Regulation (EU) 2022/30 activated three sub-articles of article 3.3 for connected radio products:

3.3(d), the equipment must not degrade the network it connects to, nor act as an attack relay (DDoS via compromised IoT, etc.).
3.3(e), the equipment must protect user personal data (encryption of sensitive communications, access control, secret management).
3.3(f), the equipment must prevent fraud (authentication of payments and transactions, financial data integrity).

Harmonised standards EN 18031-1, EN 18031-2 and EN 18031-3 were published in 2024 to cover each sub-article respectively. They introduce a decision-tree methodology assessed per security mechanism (conceptual assessment plus functional completeness and sufficiency), concluded pass or fail, adapted to consumer IoT constraints.

Affected products: for 3.3(d), any radio equipment that can communicate over the internet, directly or through other equipment; for 3.3(e), additionally childcare equipment, toys covered by Directive 2009/48/EC and wearables; for 3.3(f), internet-connected equipment handling money, monetary value or virtual currency. Excluded by the delegated regulation: equipment already covered by the medical device regulations (2017/745, 2017/746), civil aviation (2018/1139), motor vehicles (2019/2144) and road toll systems (2019/520).

For more, see RED Tests which details the EN 18031 evaluation methodology.

Conformity assessment modules

RED offers more modules than the EMC or LVD directives. The choice depends on the application of harmonised standards:

Module	When to use?	Third party required?
Module A (Annex II)	Always available for article 3.1 (Article 17(2)); for 3.2 and 3.3, only where cited harmonised standards are applied in full (Article 17(3))	No
Module B + C (Annex III)	For 3.2 or 3.3, cited harmonised standards absent, not applied or only partially applied (Article 17(4), or module H)	NB for EU-type examination
Module H (Annex IV)	Manufacturer with audited ISO 9001-like full quality system	NB for quality audit

For a standard Wi-Fi/BLE product applying the cited harmonised standards EN 300 328 (3.2) and EN 301 489-17 (3.1(b)), Module A is the standard route. Electrical safety is often documented with EN 62368-1, which is cited under the LVD, not in the RED list; for article 3.1 that does not matter, since module A is always available there. RED 3.3 cybersecurity is evaluated in parallel per EN 18031, without a Notified Body if the standards are applied in full and none of the Decision (EU) 2025/138 restrictions applies.

RED technical file structure

Annex V of RED 2014/53/EU lists the mandatory elements of the technical file:

General description of the equipment
Design and manufacturing drawings
Description and explanations of drawings
List of harmonised standards applied (in whole or in part)
Justification where harmonised standards not applied
Design calculation and examination results
Test reports (internal and external)
Signed copy of EU Declaration of Conformity
Description of accessories, components and software enabling the equipment to operate: RED-specific
For SDRs (software-defined radios): description of authorised hardware-software combinations

See Technical file for detailed expected contents.

Frequently asked questions

Which products are covered by RED?: Any equipment intentionally transmitting or receiving radio waves for communication or radio determination: Wi-Fi, BLE, ZigBee, LoRa, Sigfox, cellular, NFC, UWB, GNSS receivers only, remote controls, wireless microphones, etc.
Does RED replace EMC?: No. RED encompasses radio EMC (article 3.1(b)) for radio equipment, but the EMC Directive 2014/30/EU remains applicable for non-radio equipment. A radio product falls under RED, not directly under EMC.
What does article 3.3 add since August 2025?: Article 3.3 activates cybersecurity requirements for connected radio products, personal data protection (3.3(e)), fraud protection (3.3(f)), network functionality protection (3.3(d)). Standards EN 18031-1/2/3 cover these requirements.
Does my already-certified Wi-Fi module cover my final product?: No. The module certificate covers the module in isolation; the final product must be reassessed in its integration configuration. Radio tests can be partially reused if integration conditions are identical, rare in practice.
Does RED apply to receivers only (no transmission)?: Yes. Pure receivers (GPS, FM, DAB) are covered by RED. Article 3.2 (efficient use of spectrum) requirements apply only partially, but articles 3.1(a) safety, 3.1(b) EMC and 3.3 cybersecurity still apply.