RED Directive, frequently asked questions

Q: My product only sends data via Wi-Fi, does RED apply?

Yes. Any electrical or electronic product that intentionally emits or receives radio waves for radio communication is radio equipment (Article 2(1)(1)), whatever the protocol and even if the radio is only used for telemetry or updates. Articles 3(1)(a), 3(1)(b) and 3(2) apply, and, because the product can communicate itself over the internet, Article 3(3)(d) under Delegated Regulation (EU) 2022/30 too.

Q: What happens if I change antenna after certification?

The equipment is assessed as a whole with its antenna, and Article 17(1) requires every possible configuration to be covered, so a new antenna is a design change that Article 10(5) requires to be taken into account. A different gain changes the radiated power that Article 3(2) standards limit in e.i.r.p. or e.r.p., and can change RF exposure under Article 3(1)(a). The impact analysis decides which tests are repeated, and the file, the instructions (Article 10(8)) and, where listed, Annex VI point 8 of the DoC are updated.

Q: My product uses a radio module certified only in the US, can I sell it in Europe?

Not on the strength of the FCC grant, which has no legal effect under the RED. Presumption of conformity comes from the harmonised standards cited in the Official Journal (Article 16), such as EN 300 328 at 2.4 GHz, and the product needs its own conformity assessment, technical file, EU declaration of conformity and CE marking. The same module hardware can be used if it is assessed against the RED requirements.

Q: How does RED work for a multi-radio product?

Each radio is assessed for Article 3(2) against the cited standard for its band, and Article 17(1) requires the assessment to cover "all possible configurations", including radios operating together where the design allows it. If one radio needs a notified body, the RED Guide says the 3(2) EU-type examination certificate "should cover all radio parts". The product has one EU declaration of conformity listing every standard applied, and Article 18(3) requires a single DoC for all Union acts that apply.

Hugues Orgitello updated 7 Oct 2026 13 min read

The questions that come up in RED projects, answered from the texts: Directive 2014/53/EU, the Commission RED Guide, Delegated Regulations (EU) 2022/30 and 2026/339, the EN 18031 citation in Decision (EU) 2025/138 and, where it now overlaps, the Cyber Resilience Act. Every answer below gives the article it rests on, as of 7 October 2026. The detail sits on the other pillar pages: scope, standards, tests, procedure and technical file.

Dates that change the answers

Date	Act	Effect
13 June 2016	Directive 2014/53/EU	RED applies
29 April 2024	UK SI 2023/1007 (PSTI)	Security requirements for consumer connectable products in the UK
1 October 2024	UK legislation recognising CE marking (gov.uk)	CE or UKCA for radio equipment in Great Britain
28 December 2024	Directive (EU) 2022/2380	Article 3(4) common charger for the Annex Ia categories; laptops from 28 April 2026
1 August 2025	Delegated Regulation (EU) 2022/30, as amended by 2023/2444	Article 3(3)(d), (e) and (f) apply to the categories it names
11 September 2026	Regulation (EU) 2024/2847, Article 14	CRA reporting of actively exploited vulnerabilities and severe incidents
11 June 2027	Implementing Decision (EU) 2025/2499	EN 300 220-2 V3.1.1 loses its citation
11 December 2027	Delegated Regulation (EU) 2026/339; Regulation (EU) 2024/2847	2022/30 repealed; the CRA applies in full

Scope and applicability

What's the difference between RED and EMC?

The EMC Directive 2014/30/EU covers equipment liable to cause or suffer electromagnetic disturbance, but its Article 2(2)(a) excludes equipment covered by the radio equipment rules. For a product that intentionally emits or receives radio waves, the RED applies, and its Article 3(1)(b) brings the EMC requirements back in. There is no separate EMC Directive assessment or declaration for that product. In the same way, Article 1(4) of the RED excludes the Low Voltage Directive except through Article 3(1)(a), which applies its safety objectives with no voltage limit.

My product only sends data via Wi-Fi, does RED apply?

Yes. Any electrical or electronic product that intentionally emits or receives radio waves for radio communication is radio equipment (Article 2(1)(1)), whatever the protocol and even if the radio is only used for telemetry or OTA updates. Articles 3(1)(a), 3(1)(b) and 3(2) apply, and, because the product can communicate itself over the internet, Article 3(3)(d) under Delegated Regulation (EU) 2022/30 too, until 11 December 2027.

Is a GPS-only receiver covered by RED?

Yes. The definition says "emits and/or receives", so a receive-only product is radio equipment, and Article 3(2) applies to receivers too: recital 10 asks for "a level of performance that allows it to operate as intended and protects it against the risk of harmful interference". The cited standards are EN 303 413 for GNSS receivers and EN 301 489-19 for their EMC. Article 3(3) applies only if the receiver falls in a category of Delegated Regulation (EU) 2022/30: a stand-alone receiver that cannot communicate over the internet is outside point (d), but a wearable tracker that processes location data falls under point (e) even without an internet link (Article 1(2)(d) of 2022/30).

Does RED apply to marine products?

Not to marine equipment within the marine equipment directive (Annex I point 2 of the RED names Directive 96/98/EC, now replaced by Directive 2014/90/EU), which carries the wheel mark under that directive. Marine radios for vessels with no carriage requirement under the IMO conventions, and Autonomous Maritime Radio Devices, stay under the RED (RED Guide, sections 1.7.3.3 and 1.7.3.4). Radio equipment can also comply with both and then carries both markings.

My product is only for professional use, does RED apply?

Yes. The RED has no exclusion for professional or operator-only equipment: only Article 1(3) (equipment used exclusively for public security, defence or State security) and the four points of Annex I exclude anything. Delegated Regulation (EU) 2022/30 does not distinguish consumer and professional equipment either for internet-connected radio equipment. The five exclusions are detailed on RED scope.

Radio modules and antennas

Does my CE-marked Wi-Fi module exempt the final product from RED?

No. When a module is incorporated and permanently affixed in a host product, the RED applies to the combination as a whole and the host manufacturer is responsible for it (RED Guide, section 1.7.4.1). The host manufacturer may reuse the module assessment, which must be included in the technical file, but the RED Guide warns that a reused assessment "may not be sufficient". An antenna, power supply or enclosure outside the module instructions is the usual reason. The module manufacturer, for its part, must assess the risks identifiable before integration and supply instructions that keep the module compliant (section 1.7.4.11).

What happens if I change antenna after certification?

The equipment is assessed as a whole with its antenna (RED Guide, section 1.7.4.6), and Article 17(1) requires every possible configuration to be covered, so a new antenna is a design change that Article 10(5) requires to be "adequately taken into account". A different gain changes the radiated power that Article 3(2) standards limit in e.i.r.p. or e.r.p., and can change RF exposure under Article 3(1)(a). EN 301 489-1 does not measure radiated emissions of the radio; those belong to the Article 3(2) standard (see RED tests). The impact analysis decides which tests are repeated, and the file, the instructions (Article 10(8)) and, where listed, Annex VI point 8 of the DoC are updated.

My product uses a radio module certified only in the US, can I sell it in Europe?

Not on the strength of the FCC grant, which has no legal effect under the RED. Presumption of conformity comes from the harmonised standards cited in the Official Journal (Article 16), such as EN 300 328 for 2.4 GHz Wi-Fi and BLE or EN 301 893 at 5 GHz, and the product needs its own conformity assessment, technical file, EU declaration of conformity and CE marking. The same module hardware can be used if it is assessed against the RED requirements.

How does RED work for a multi-radio product?

Each radio is assessed for Article 3(2) against the cited harmonised standard for its band, and Article 17(1) requires the assessment to cover "all possible configurations", including radios operating together where the design allows it. If one radio needs a notified body, the RED Guide says the 3(2) EU-type examination certificate "should cover all radio parts". The product has one EU declaration of conformity listing every standard applied, and Article 18(3) requires a single DoC for all Union acts that apply.

3(3) cybersecurity (August 2025 to December 2027)

What changed for cybersecurity on 1 August 2025?

Delegated Regulation (EU) 2022/30, whose application date Delegated Regulation (EU) 2023/2444 moved to 1 August 2025, made Article 3(3)(d), (e) and (f) apply to the categories it names (next question). The CEN-CENELEC standards EN 18031-1/2/3:2024 were cited with restrictions by Implementing Decision (EU) 2025/138. Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027, when the Cyber Resilience Act applies.

Which products does Delegated Regulation 2022/30 cover?

Point	Applies to (Article 1 of 2022/30)	Not applied to (Article 2)
3(3)(d) network protection	Radio equipment that can communicate itself over the internet, directly or via any other equipment	Devices under Regulation (EU) 2017/745 (MDR) or 2017/746 (IVDR)
3(3)(e) personal data and privacy	If it can process personal, traffic or location data: internet-connected radio equipment; radio equipment exclusively for childcare; radio toys (Directive 2009/48/EC); radio equipment worn on, strapped to or hung from the body or clothing	MDR and IVDR devices; equipment under Regulation (EU) 2018/1139 (aviation), 2019/2144 (vehicle general safety) or Directive (EU) 2019/520 (road tolling)
3(3)(f) protection from fraud	Internet-connected radio equipment that lets the holder or user transfer money, monetary value or virtual currency	Same as (e)

Does 3.3 cybersecurity require a notified body?

Not by default. EN 18031 decides with decision trees which requirements apply, and each is assessed pass or fail; it defines no assurance levels. Applied in full, with none of the Decision (EU) 2025/138 restrictions applying, it allows module A. A notified body is needed if the user may choose not to set and use any password (clauses 6.2.5.1 and 6.2.5.2), if a toy or childcare product lacks parental or guardian access control (EN 18031-2 clauses 6.1.3 to 6.1.6), whenever EN 18031-3 clause 6.3.2.4 on secure updates is relied on, or if EN 18031 is not applied in full (Article 17(4)). The "rationale" and "guidance" sections of the standards give no presumption.

What happens if a cybersecurity vulnerability is discovered after placing on the market?

The RED itself has no vulnerability reporting duty: the Article 3(3) points are requirements on the equipment when it is placed on the market. If the equipment no longer conforms, Article 10(11) requires corrective measures (bringing it into conformity, withdrawal or recall) and, where it presents a risk, informing the national authorities. Since 11 September 2026, Article 14 of the Cyber Resilience Act also requires manufacturers of products with digital elements in its scope to notify actively exploited vulnerabilities to the CSIRT designated as coordinator and to ENISA: an early warning within 24 hours and a notification within 72 hours of becoming aware. It applies to products placed on the market before 11 December 2027 as well (Article 69(3)).

What happens to RED cybersecurity on 11 December 2027?

Delegated Regulation (EU) 2022/30 is repealed and the Cyber Resilience Act applies in full. Equipment placed on the market from 1 August 2025 to 10 December 2027 stays subject to market surveillance on Article 3(3)(d), (e) and (f) (2026/339, recital 5), so that evidence stays in the file. Products placed before 11 December 2027 fall under the CRA requirements only if substantially modified after that date, except Article 14 reporting, which applies to them all (CRA Article 69(2) and (3)). EU-type examination certificates on cybersecurity issued under other legislation remain valid until 11 June 2028 unless they expire earlier (Article 69(1)). See the repeal note.

Costs, timing, assessment modules

How much does a RED certification cost, and how long does it take?

Neither the directive nor the harmonised standards set fees or durations, and the figures that earlier versions of this page gave had no source, so they were removed. Under module A the cost is that of the tests and the file; under modules B and C or H the notified body quote is added. The certification costs guide lists the fees that regulators and programmes do publish.

Do I need a Notified Body for RED?

Only for Article 3(2) and the activated points of Article 3(3), and only when the cited harmonised standards are not applied in full or do not exist (Article 17(4)), or when a restriction attached to a citation applies. Article 3(1)(a), 3(1)(b) and 3(4) can always be self-declared under module A (Article 17(2)). Under modules B and C the CE marking stands alone; the notified body number follows it only under module H (Article 20(3)). The full table is on RED procedure.

My product uses a band not covered by a harmonised standard, what to do?

Article 3(2) then needs a notified body: EU-type examination (Annex III, modules B and C) or full quality assurance (Annex IV, module H) (Article 17(4)). Under Annex III the body examines the technical documentation and supporting evidence "without examination of a specimen". The equipment must also be operable in at least one Member State without infringing spectrum rules (Article 10(2)), and where Member States restrict putting into service or require an authorisation, the packaging and instructions must say so (Article 10(10), presented as Implementing Regulation (EU) 2017/1354 sets out).

Modifications and SDR

Does an OTA firmware update trigger a new certification?

The RED Guide (section 1.5) treats a software update as maintenance unless it modifies the intended functions, radio interface, type or performance in a way the initial risk assessment did not foresee, or changes the hazard or raises the risk; then the updated product is treated as a new product. In every case the change is assessed and recorded, the firmware versions affecting compliance are updated in the file (Annex V(a)(ii)), and under modules B and C a modification of the approved type needs an addition to the certificate (Annex III point 7).

How to document an SDR (Software-Defined Radio) product?

No SDR-specific file exists today: Article 4 on combinations of radio equipment and software and Article 3(3)(i) both need a delegated act, and the RED Guide states there is none. What applies:

Annex V(a)(ii): the software or firmware versions affecting compliance
Article 10(8) and Annex VI point 8: accessories and components, including software, that let the equipment operate as intended
Article 17(1): every configuration the user can reach is covered by the assessment

A hardware and firmware matrix is a practical way to show this, not a requirement. See RED technical file.

How long must I retain the RED file?

10 years after the radio equipment has been placed on the market (Article 10(4)), counted by the RED Guide from the last unit of the product model. The file includes the software or firmware versions affecting compliance (Annex V(a)(ii)), and under modules B and C the certificate and its additions. Importers keep a copy of the DoC for 10 years (Article 12(8)). For an SDR product nothing more is required by the text.

Non-EU markets

Does RED apply in the United Kingdom?

Not as EU law. Great Britain applies the Radio Equipment Regulations 2017, and gov.uk states that legislation in force since 1 October 2024 continues recognition of the CE marking, so radio equipment can be placed on the GB market with UKCA or CE. Northern Ireland takes CE, or UKNI and CE. Consumer connectable products in the UK are also subject to the PSTI security regulations (SI 2023/1007: passwords, information on how to report security issues, minimum security update period) since 29 April 2024.

Claims the texts contradict

Claim (several from earlier versions of this page)	What the text says
"Any in-scope radio product, internet-connectable in particular, must meet Article 3(3)(d), (e) and (f)."	Each point has its own categories in Article 1 of 2022/30. Non-connected toys, childcare and wearable equipment that process personal data fall under (e); MDR and IVDR devices are excluded from all three.
"EN 18031-1, -2 and -3 give presumption for 3(3)."	Decision 2025/138 cites them with restrictions; the no-password option, missing parental control and EN 18031-3 clause 6.3.2.4 remove presumption.
"RED 3(3) cybersecurity applies from now on."	Delegated Regulation 2026/339 repeals 2022/30 from 11 December 2027.
"3(3) cybersecurity applies to every receiver."	Only to the categories of 2022/30.
"A RED certification costs €25,000 to €60,000, up to €150,000 for cellular, in 3 to 9 months."	No text sets fees or durations; the figures had no source.
"Module test reports can be reused only if integration conditions are strictly identical."	The host manufacturer is always responsible; reused assessments "may not be sufficient" and go in the file (RED Guide).
"An antenna change mainly triggers radio EMC retesting under 3(1)(b)."	EN 301 489-1 excludes radiated emissions of the radio; the antenna affects the Article 3(2) radiated limits and possibly 3(1)(a) exposure.
"The DoC can be split into separate DoCs per radio."	The DoC is drawn up for the radio equipment, and Article 18(3) requires a single DoC for all Union acts that apply.
"The SDR file must include a matrix of authorised combinations and protection mechanisms."	Article 4 and Article 3(3)(i) have no delegated act.
"Keep every distributed firmware version."	Annex V(a)(ii) asks for the versions affecting compliance.
"RED 3(3) obliges the manufacturer to patch and to report significant vulnerabilities."	The RED has Article 10(11) for non-conformity; vulnerability reporting comes from CRA Article 14, from 11 September 2026.
"An FCC-certified module is enough for Europe."	Presumption comes from standards cited in the Official Journal (Article 16); the FCC grant has no effect under the RED.
"A CE-marked radio needs UKCA in Great Britain."	gov.uk: UKCA or CE in Great Britain; CE, or UKNI and CE, in Northern Ireland.