RED pitfalls: 14 errors and the provisions behind them

Hugues Orgitello updated 7 Oct 2026 14 min read

Most RED errors are not exotic test failures: they are readings of Directive 2014/53/EU that the text does not support. A module treated as a certificate for the host, a receiver treated as exempt, a firmware update nobody assessed, a DoC that cites a standard which is not in the Official Journal list. This page lists fourteen of them in three families (scoping, design and modules, after placing on the market), and ties each one to the article of the directive, the section of the Commission RED Guide or the OJ decision that settles it, as of 7 October 2026. Market surveillance measures taken by national authorities on products presenting a risk are published in the EU Safety Gate.

The fourteen pitfalls at a glance

#	Pitfall	Provision that settles it
1	Treating a connected product as "not radio" or assessing it under the LVD and EMC Directive	Articles 1(4) and 2(1)(1)
2	Testing the radio EMC with generic EMC standards	Decision (EU) 2022/2191 as amended; EN 301 489-1 clause 8.1.1
3	Getting the Article 3(3) perimeter or dates wrong	Delegated Regulations (EU) 2022/30 and 2026/339
4	Treating a receiver as out of scope or exempt from Article 3(2)	Articles 2(1)(1) and 3(2), recitals 10 and 11
5	Assuming a band usable in one Member State is usable everywhere	Articles 7, 10(2) and 10(10); Regulation (EU) 2017/1354
6	Treating evaluation boards or trade fair units as excluded	Annex I point 4; Article 9(2)
7	Relying on the module CE marking for the host product	RED Guide, sections 1.7.4.1 and 2.8; Article 17(1)
8	Changing the radio parameters of a module	RED Guide, section 1.7.4.2; Article 14
9	Using an antenna, ground plane or enclosure outside the assessed configuration	Article 17(1); Article 10(8); Annex VI point 8
10	Self-declaring 3(2) or 3(3) when module A is closed	Article 17(3) and (4); Decision (EU) 2025/138
11	Changing components in series production without assessment	Article 10(5); Annex III point 7
12	Shipping firmware updates without a compliance check or record	RED Guide, section 1.5; Annex V(a)(ii); Article 10(4)
13	Expecting the RED to organise vulnerability handling	Article 10(11); CRA Article 14
14	Drawing up a DoC that does not match the assessment	Articles 18 and 20(3); Annex VI

Family 1: Scoping errors

1: Treating a connected product as "not radio"

Article 2(1)(1) defines radio equipment as an electrical or electronic product that "intentionally emits and/or receives radio waves for the purpose of radio communication and/or radiodetermination", including one that must be completed with an accessory such as an antenna. A sensor whose Wi-Fi or BLE link only carries OTA updates meets that definition. The error usually shows in the file: a DoC under the Low Voltage and EMC Directives with no RED reference.

Article 1(4) excludes RED equipment from the LVD, whose safety objectives come back through Article 3(1)(a) "with no voltage limit", and the EMC requirements come back through Article 3(1)(b). A radio product has one DoC under the RED, plus the other acts that apply (Article 18(3)).

How to avoid it: list every intentional transmitter and receiver at the requirements stage, third-party modules included, and run the four questions of RED scope.

2: Testing the radio EMC with generic EMC standards

The EMC of radio equipment is presumed through the specific parts of the EN 301 489 series cited in Annex I to Implementing Decision (EU) 2022/2191 as amended, for example EN 301 489-17 V3.3.1 for Wi-Fi and Bluetooth or EN 301 489-3 V2.3.2 for short range devices. EN 301 489-1 is not cited on its own. Radiated emissions of the radio itself are not in EN 301 489-1: clause 8.1.1 says they are "covered by the appropriate standard under article 3.2". A report that applies a generic emission standard to the transmitter, or a DoC that cites EN 301 489-1 alone, does not match the cited references. The levels and notices are on RED tests.

3: Getting the Article 3(3) perimeter or dates wrong

Delegated Regulation (EU) 2022/30 applies Article 3(3)(d), (e) and (f) from 1 August 2025, and only to the categories it names: radio equipment that can communicate itself over the internet, toys, childcare and wearable radio equipment for point (e), and equipment allowing the transfer of money, monetary value or virtual currency for point (f). Devices under Regulations (EU) 2017/745 and 2017/746 are excluded. Two opposite errors follow: applying EN 18031 to equipment the regulation does not cover, and treating a covered product as exempt because the design dates from before 2025.

The date applies per unit placed on the market, not per design: a unit placed on the market from 1 August 2025 has to meet the points that cover it, whenever the type was first assessed. Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027, when the Cyber Resilience Act applies in full; units placed on the market from 1 August 2025 to 10 December 2027 remain subject to market surveillance on those points (recital 5).

4: Treating a receiver as out of scope

The definition says "emits and/or receives", so GNSS receivers, broadcast receivers and other receive-only products are radio equipment. Article 3(2) applies to all radio equipment, and recital 10 asks receivers for "a level of performance that allows it to operate as intended and protects it against the risk of harmful interference". Receiver standards are cited for this purpose, for example EN 303 413 for GNSS, EN 303 340 for terrestrial TV and the EN 303 345 parts for broadcast sound. Article 3(3) applies to a receiver only if a delegated act covers its category.

5: Assuming a band usable in one Member State is usable everywhere

Spectrum use is not fully harmonised. Article 7 lets Member States add requirements for putting into service and use for spectrum, interference, disturbance or public health reasons. Article 10(2) requires that the equipment can be operated in at least one Member State without infringing spectrum rules, and Article 10(10) requires the packaging to identify the Member States or areas with restrictions or authorisation requirements, completed in the instructions, in the format of Implementing Regulation (EU) 2017/1354. Annex V(i) asks the file to explain both. The pitfall is a product sold EU-wide with no Article 10(10) information because "the band is licence-free in our country".

6: Treating evaluation boards or trade fair units as excluded

Annex I point 4 excludes only "custom-built evaluation kits destined for professionals to be used solely at research and development facilities for such purposes". The RED Guide (section 1.7.3.6) states that generic evaluation boards sold to R&D departments are not exempt. Trade fairs are not an exclusion either: Article 9(2) allows non-compliant equipment to be displayed with "a visible sign" saying it may not be made available or put into service until it complies, and demonstrations need the measures that Member States prescribe against harmful interference.

Family 2: Design and module errors

7: Relying on the module CE marking for the host product

A radio module placed on the market on its own is radio equipment, and its manufacturer must assess the risks identifiable before integration and "provide instructions which, if followed, will ensure that they remain compliant" (RED Guide, section 1.7.4.11). Once the module is incorporated and permanently affixed in a host product, the RED applies to the combination as a whole (section 1.7.4.1).

The host manufacturer "may use assessments performed previously for components or parts", while "remaining responsible for the conformity of the whole product", and "the reused assessment of the components or parts may not be sufficient to demonstrate conformity of the whole radio equipment" (RED Guide, section 2.8). Those assessments go into the technical file. The module marking is not "invalidated" by a deviation: it never covered the host product in the first place. The question is whether the reused evidence, read against Article 17(1) and the host configuration, is enough.

How to avoid it: keep the module DoC, the test reports relied upon and its integration instructions; check the host design against them point by point; plan host tests for whatever the reused evidence does not cover.

8: Changing the radio parameters of a module

Enabling a band, raising the power or changing the modulation of a module goes beyond what its manufacturer assessed. The RED Guide (section 1.7.4.2) treats the operator placing the final product on the market as the manufacturer when "the intended function or performance of the radio equipment is modified; or the compliance is impacted". Article 14 does the same for an importer or distributor that modifies radio equipment already on the market "in such a way that compliance with this Directive may be affected". In both cases the new configuration has to be assessed against the essential requirements it affects, and Article 3(2) is the usual one.

9: Using an antenna, ground plane or enclosure outside the assessed configuration

Article 17(1) requires the assessment to take into account "all intended operating conditions" and, where the equipment can take different configurations, to confirm compliance "in all possible configurations". An antenna with a different gain or pattern, a ground plane smaller than the module instructions require, or a metal enclosure changes the radiated power and spurious emissions measured under Article 3(2), and the exposure assessment under Article 3(1)(a).

Where the equipment is delivered without an antenna, the RED Guide (section 2.8) asks for the technical features of the antennas that may be used to be given to the user and mentioned in the DoC under Annex VI point 8; Article 10(8) asks the instructions to describe the accessories that allow the equipment to operate as intended. A product sold with two interchangeable antennas is assessed with both.

Working on integrating a radio module into a PCB respecting the manufacturer's conditions for a real product? AESTECHNO can audit your design and certification plan. Get in touch

10: Self-declaring 3(2) or 3(3) when module A is closed

Module A is always available for Article 3(1)(a), 3(1)(b) and 3(4) (Article 17(2)). For Article 3(2) and the activated points of Article 3(3), it is available only where the cited harmonised standards are applied in full (Article 17(3)); otherwise Article 17(4) requires EU-type examination (Annex III) or full quality assurance (Annex IV) with a notified body. Decision (EU) 2025/138 cites EN 18031-1, -2 and -3 with restrictions: no presumption if the user may choose "not to set and use any password" (clauses 6.2.5.1 and 6.2.5.2), none for toys and childcare equipment without parental or guardian access control (EN 18031-2 clauses 6.1.3 to 6.1.6), and none for the secure update criteria of EN 18031-3 clause 6.3.2.4. A self-declared product that falls under one of these restrictions has no presumption of conformity. Details are on RED procedure.

Family 3: Errors after placing on the market

11: Changing components in series production without assessment

Article 10(5) requires procedures "for series production to remain in conformity", and changes in design or characteristics, and in the harmonised standards by reference to which conformity is declared, "shall be adequately taken into account". Substituting a cheaper antenna, a different module revision or a new crystal in production is such a change. Under modules B and C, any modification of the approved type that may affect conformity needs an addition to the EU-type examination certificate (Annex III point 7).

How to avoid it: flag the radio-relevant parts in the bill of materials and route every change through an assessment recorded in the file (see component substitution rules).

12: Shipping firmware updates without a compliance check or record

The RED Guide (section 1.5) treats software updates as maintenance provided they do not modify the product already on the market "in such a way that compliance with the applicable requirements may be affected". It considers a product substantially modified by a software change where the update "modifies the original intended functions, radio interface, type or performance of the product and this was not foreseen in the initial risk assessment", where the nature of the hazard has changed or the level of risk has increased, and the product is made available. A substantially modified product is treated as a new product.

Annex V(a)(ii) requires the file to list the "versions of software or firmware affecting compliance with essential requirements", and Article 21(2) requires the file to be continuously updated. The manufacturer keeps the file and the DoC for 10 years after the equipment is placed on the market (Article 10(4)), counted by the RED Guide from the last unit of the product model. This applies to any radio product, not only to software-defined radio (SDR), for which Article 4 and Article 3(3)(i) still have no delegated act.

How to avoid it: make radio parameters (bands, power, channel access) a release gate, and record for each released version whether it affects compliance and why.

13: Expecting the RED to organise vulnerability handling

The Article 3(3) points are requirements on the equipment when it is placed on the market. The RED has no vulnerability reporting duty: Article 10(11) requires a manufacturer that has reason to believe equipment it placed on the market does not conform to take corrective measures (bring it into conformity, withdraw or recall it) and, where it presents a risk, to inform the national authorities. Vulnerability and incident reporting comes from Article 14 of the Cyber Resilience Act: since 11 September 2026, manufacturers of products with digital elements in its scope notify actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator and to ENISA, including for products placed on the market before 11 December 2027 (Article 69(3)).

14: Drawing up a DoC that does not match the assessment

Annex VI point 6 requires the references of the harmonised standards or other technical specifications "in relation to which conformity is declared", with identification number and version. For equipment covered by Delegated Regulation 2022/30, the parts of EN 18031 actually applied belong there; a DoC that omits them does not show how Article 3(3) was met. Other mismatches recur: EN 301 489-1 cited on its own, EN 62311 or EN 62368-1 presented as RED harmonised standards (they are not in the list and count as other technical specifications), a notified body number after the CE marking under modules B and C (Article 20(3) reserves it for Annex IV), and a single DoC that leaves out other applicable acts (Article 18(3)). The DoC template is on RED technical file.

Dates that change what counts as a pitfall

Date	Act	Effect
13 June 2016	Directive 2014/53/EU	The RED applies
1 August 2025	Delegated Regulation (EU) 2022/30	Article 3(3)(d), (e) and (f) apply to the categories it names (pitfalls 3, 10, 14)
11 September 2026	Regulation (EU) 2024/2847, Article 14	CRA reporting of actively exploited vulnerabilities and severe incidents (pitfall 13)
15 November 2026	Implementing Decision (EU) 2025/893	EN 301 489-52 V1.2.1 (cellular user equipment EMC) loses its citation (pitfalls 2, 14)
11 June 2027	Implementing Decision (EU) 2025/2499	EN 300 220-2 V3.1.1 loses its citation; keeping it means a notified body for 3(2) (pitfalls 10, 11)
11 December 2027	Delegated Regulation (EU) 2026/339; Regulation (EU) 2024/2847	2022/30 repealed and the CRA applies in full (pitfall 3)

Claims the texts contradict

Claim (including on an earlier version of this page)	What the text says
"Integrated in a final product, the slightest deviation from the module test conditions invalidates its CE marking."	The host manufacturer is responsible for the whole product and may reuse module assessments, which "may not be sufficient" and go in the file (RED Guide, section 2.8). The module marking never covered the host.
"Under Article 3(1)(b), choose emission Class B for consumer IoT and Class A with a warning for industry."	Radio EMC is presumed through the cited EN 301 489 parts; radiated emissions of the radio belong to the Article 3(2) standard (EN 301 489-1 clause 8.1.1).
"Verify the CEPT ECC Decisions applicable to your bands."	The directive requires operation in at least one Member State (Article 10(2)) and information on restrictions on the packaging and in the instructions (Article 10(10)). ECC Decisions are not RED obligations.
"Products marketed before August 2025 remain valid; any new unit produced after must comply."	The test is placing on the market, unit by unit, not production date.
"An uncorrected vulnerability is a compliance defect under Article 3(3); the RED requires a vulnerability disclosure procedure."	The RED has Article 10(11) for non-conformity; vulnerability reporting comes from CRA Article 14, since 11 September 2026.
"A DoC omitting EN 18031 is incomplete and exposes the product to market withdrawal."	Annex VI point 6 requires the standards actually applied; for 3(3) without EN 18031 in full, Article 17(4) requires a notified body and its certificate under point 7.
"Firmware archives must be kept for 10 years after the last unit for SDR products."	Article 10(4) sets 10 years for the file and the DoC for all radio equipment; Annex V(a)(ii) asks for the versions affecting compliance. No SDR-specific rule is active.
"Target 100 % of the portfolio assessed for 3(3) by end of 2025, and a file update within four weeks of a firmware change."	No text sets these targets; they had no source and were removed.

In summary

1. Scoping (1 to 6): the definition of Article 2(1)(1), the Article 3(3) perimeter of 2022/30, the receiver obligations of Article 3(2), Articles 7, 10(2) and 10(10) on spectrum, and the narrow exclusions of Annex I.
2. Design and modules (7 to 10): the host manufacturer is responsible for the whole product, every configuration is assessed (Article 17(1)), and module A is closed for 3(2) and 3(3) when standards are not applied in full or a restriction applies.
3. After placing on the market (11 to 14): Article 10(5) for production changes, RED Guide section 1.5 for updates, Article 10(4) for retention, Article 10(11) and CRA Article 14 for vulnerabilities, Annex VI for the DoC.

See also

• Component substitution rules by directive: when a BOM swap silently breaks the RED file (pitfalls 7, 9, 11).
• Change management: FCC Class II permissive and RED substantial: formal governance for the post-market modifications listed in family 3.
• Antenna design and impedance matching: integration discipline that prevents pitfalls 9 and 11.
• Product recall and EU Safety Gate response procedure: what happens when these pitfalls surface as a market withdrawal.
• HEMP and IEMI: IEC 61000-4-25 and hardened electronics: immunity edge cases sometimes overlooked alongside RED 3.1(b).
• RED scope, RED procedure, RED tests, RED technical file and RED FAQ: the provisions behind each pitfall, read in full.
• EU declaration of conformity: content and format of the DoC.

Sources & references

1. Directive 2014/53/EU (RED), Articles 1, 2, 3, 7, 9, 10, 14, 17, 18, 20, 21 and Annexes I, III, V, VI, EUR-Lex eur-lex.europa.eu/eli/dir/2014/53/oj
2. Guide to the Radio Equipment Directive 2014/53/EU, sections 1.5, 1.7, 2.8 and 6, European Commission ec.europa.eu/docsroom/documents/33162
3. Delegated Regulation (EU) 2022/30, Article 3(3)(d), (e) and (f), EUR-Lex eur-lex.europa.eu/eli/reg_del/2022/30/oj
4. Delegated Regulation (EU) 2026/339, repeal of 2022/30 from 11 December 2027, EUR-Lex eur-lex.europa.eu/eli/reg_del/2026/339/oj
5. Implementing Decision (EU) 2022/2191, list of RED harmonised standards, EUR-Lex eur-lex.europa.eu/eli/dec_impl/2022/2191/oj
6. Implementing Decision (EU) 2025/138, EN 18031-1, -2 and -3 cited with restrictions, EUR-Lex eur-lex.europa.eu/eli/dec_impl/2025/138/oj
7. Implementing Regulation (EU) 2017/1354, presentation of Article 10(10) information, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2017/1354/oj
8. Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 14 and 69, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
9. Safety Gate alerts, withdrawn radio products, European Commission ec.europa.eu/safety-gate-alerts/screen/webReport