Updates to the RED 2025 Cyber-Security Requirements

Recorded Webinar | February 27, 2025

Presented by Steve Koster, President of Washington Laboratories

The European Union’s Radio Equipment Directive (RED) cybersecurity requirements introduce important changes for manufacturers, integrators, and suppliers placing radio equipment on the EU market. These requirements affect certain internet-connected and data-processing radio equipment and are intended to strengthen network protection, personal data privacy, and fraud prevention.

In this Washington Laboratories webinar, Steve Koster reviews the 2025 RED cybersecurity updates, including how the new requirements may affect product compliance planning, documentation, conformity assessment, and CE marking strategies for connected radio equipment.

What You’ll Learn

  • How RED cybersecurity requirements affect radio equipment placed on the EU market
  • Key considerations for manufacturers, integrators, and radio equipment suppliers
  • How cybersecurity requirements may affect CE marking and conformity assessment planning
  • The role of EN 18031 standards for RED cybersecurity compliance
  • Why cybersecurity planning should be considered alongside EMC, RF, safety, and product documentation requirements

Key Topics Covered

The webinar explains the RED cybersecurity requirements that become mandatory on August 1, 2025, including which products are affected, available conformity assessment pathways, and how manufacturers can prepare technical documentation and compliance programs.

  • Internet-connected radio equipment requirements
  • Protection of personal, traffic, and location data
  • Requirements for products supporting financial transactions
  • EN 18031-1, EN 18031-2, and EN 18031-3 cybersecurity standards
  • Access control and authentication requirements
  • Password management expectations
  • Risk assessment and technical documentation considerations
  • Self-declaration versus Notified Body involvement
  • Future transition from RED cybersecurity requirements to the Cyber Resilience Act (CRA)

The webinar also reviews the harmonized EN 18031 standards and discusses how manufacturers can use them to demonstrate conformity with RED cybersecurity requirements while understanding applicable restrictions and conformity assessment considerations.

August 1, 2025 Compliance Deadline

Beginning August 1, 2025, applicable radio equipment placed on the European Union market must comply with the RED cybersecurity requirements. Manufacturers should evaluate product applicability, technical documentation, risk assessments, and conformity assessment strategies well before market placement deadlines.

Why This Matters for Product Developers

Cybersecurity requirements are becoming increasingly connected to product compliance and market access. Product teams may need to coordinate cybersecurity documentation, software update processes, vulnerability handling, risk assessments, and technical file preparation much earlier in the development cycle.

These requirements should be considered alongside traditional radio equipment compliance activities, including RF testing, EMC testing, product safety evaluations, technical documentation, and EU conformity assessment planning.

Practical Considerations for Manufacturers

One of the recurring themes throughout this webinar is the importance of documentation. Manufacturers should maintain clear risk assessments, security documentation, product configuration records, and compliance justification files to support conformity assessment activities.

As products evolve through software updates, hardware revisions, and feature enhancements, manufacturers should evaluate whether changes affect cybersecurity compliance and update supporting documentation accordingly.

As Steve notes throughout the webinar, successful compliance depends on a strong foundation of technical documentation, risk assessment, and ongoing product lifecycle management.

Looking Ahead: The Cyber Resilience Act

The webinar also discusses the relationship between the RED cybersecurity requirements and the EU Cyber Resilience Act (CRA). While RED cybersecurity requirements apply to certain radio equipment beginning in August 2025, broader CRA requirements are expected to apply to products with digital elements beginning in December 2027.

Manufacturers should monitor both frameworks as cybersecurity obligations continue to evolve across the European market.

Related Cybersecurity & Compliance Resources

Need RED Cybersecurity Compliance Support?

Washington Laboratories supports manufacturers with EMC, RF, wireless, product safety, environmental, and cybersecurity-related compliance activities. Our team can help product developers understand evolving requirements and prepare for EU market access obligations. Conatct Us