RED Directive 2014/53/EU, overview
Pillar: European Union
The RED Directive 2014/53/EU frames all radio equipment placed on the European market. Adopted in 2014, enriched by Delegated Regulation 2022/30 which activates cybersecurity since 1 August 2025, it is the most impactful directive for modern IoT products, and the most often overlooked in compliance analyses.
Scope and logic
Section titled “Scope and logic”The RED directive applies to any equipment that intentionally transmits and/or receives radio waves for communication or radio determination. This criterion covers a far wider range than many project teams imagine:
- Intentional transmitters: Wi-Fi, Bluetooth/BLE, ZigBee, Thread, Z-Wave, LoRa, Sigfox, cellular 2G/3G/4G/5G, active NFC, UWB, remote controls, RFID, MOCN, wireless microphones, radio medical devices.
- Intentional receivers only: GNSS receivers (GPS, Galileo, GLONASS), FM/DAB/DAB+ receivers, TV receivers.
- Combined transceivers: all bidirectional communication equipment.
Out of scope:
- equipment neither intentionally transmitting nor receiving radio waves (Ethernet cable, wired sensor);
- military and defence equipment (Article 346 TFEU);
- experimental and R&D equipment not commercialised;
- evaluation kits strictly intended for integrator manufacturers (under certain conditions).
Four articles, four families of requirements
Section titled “Four articles, four families of requirements”RED's regulatory architecture organises around four articles of essential requirements. Not all apply systematically, applicability depends on product type and, for article 3.3, on the delegated regulation that activates it.
| Article | Subject | Main harmonised standards |
|---|---|---|
| 3.1(a) | User health and safety | EN 50360 / 50566 / 62209 (SAR), EN 62311 (EMF) |
| 3.1(b) | Electromagnetic compatibility | EN 301 489-1 + -X (by radio type) |
| 3.2 | Efficient use of spectrum | Band-specific standard (EN 300 328, EN 301 893, EN 300 220...) |
| 3.3(a) | Interoperability between equipments | Network specifications (3GPP, IEEE) |
| 3.3(b) | Network protection | Not yet activated |
| 3.3(c) | Proper use of spectrum | Not yet activated |
| 3.3(d) | Protection of network functions | EN 18031-1 (since 2025) |
| 3.3(e) | Personal data protection | EN 18031-2 (since 2025) |
| 3.3(f) | Protection against fraud | EN 18031-3 (since 2025) |
| 3.3(g–i) | Other (accessibility, e-call, etc.) | Specific cases |
Article 3.2 is most visible to engineers: it defines maximum transmit powers, spectral masks, mandatory protocols (DFS, TPC, LBT). Article 3.3 is the most recent and least mastered: its cybersecurity activation in August 2025 transformed the European IoT product landscape.
Cybersecurity since 1 August 2025
Section titled “Cybersecurity since 1 August 2025”Delegated Regulation (EU) 2022/30 activated three sub-articles of article 3.3 for connected radio products:
- 3.3(d), the equipment must not degrade the network it connects to, nor act as an attack relay (DDoS via compromised IoT, etc.).
- 3.3(e), the equipment must protect user personal data (encryption of sensitive communications, access control, secret management).
- 3.3(f), the equipment must prevent fraud (authentication of payments and transactions, financial data integrity).
Harmonised standards EN 18031-1, EN 18031-2 and EN 18031-3 were published in 2024 to cover each sub-article respectively. They introduce an assurance-level evaluation methodology (basic, substantial, high) reminiscent of Common Criteria schemes, adapted to consumer IoT constraints.
Affected products: nearly all connected radio products in the broad sense: Wi-Fi, BLE, cellular, LPWAN. A few notable exceptions: pure broadcasting equipment, certain professional equipment, toys not intended for under-14s.
For more, see RED Tests which details the EN 18031 evaluation methodology.
Conformity assessment modules
Section titled “Conformity assessment modules”RED offers more modules than the EMC or LVD directives. The choice depends on the application of harmonised standards:
| Module | When to use? | Third party required? |
|---|---|---|
| Module A | Harmonised standards 3.1(a), 3.1(b), 3.2 fully applied | No |
| Module A1 | A standard partially applied: NB assesses only the affected tests | NB for specific tests |
| Module B + C | Harmonised standards not applicable or not fully applied | NB for type examination |
| Module H | Manufacturer with audited ISO 9001-like quality system | NB for quality audit |
For a standard Wi-Fi/BLE product applying harmonised standards EN 300 328 + EN 301 489-17 + EN 62368-1, Module A is the standard route. RED 3.3 cybersecurity is evaluated in parallel per EN 18031, without necessarily requiring a Notified Body if the standards are applied.
RED technical file structure
Section titled “RED technical file structure”Annex V of RED 2014/53/EU lists the mandatory elements of the technical file:
- General description of the equipment
- Design and manufacturing drawings
- Description and explanations of drawings
- List of harmonised standards applied (in whole or in part)
- Justification where harmonised standards not applied
- Design calculation and examination results
- Test reports (internal and external)
- Signed copy of EU Declaration of Conformity
- Description of accessories, components and software enabling the equipment to operate: RED-specific
- For SDRs (software-defined radios): description of authorised hardware-software combinations
See Technical file for detailed expected contents.
Further reading
Section titled “Further reading”- Detailed scope: covered products, exclusions, SDR, modules
- RED harmonised standards: EN 300 328, EN 301 489, EN 18031, etc.
- Step-by-step procedure: modules, Notified Bodies, schedule
- Required tests: articles 3.1, 3.2, 3.3 in detail
- Technical file: Annex V and SDR
- FAQ: 20+ concrete questions
- Common pitfalls: substituted antennas, OTA radio, RED 3.3 missed
- General CE procedure: overall regulatory framework
Sources & references
- Directive 2014/53/EU, official text , EUR-Lex eur-lex.europa.eu/eli/dir/2014/53/oj
- Delegated Regulation (EU) 2022/30: RED 3.3 cybersecurity , EUR-Lex eur-lex.europa.eu/eli/reg_del/2022/30/oj
- ETSI: RED harmonised standards , ETSI www.etsi.org/standards