CRA vs RED delegated act

The RED delegated act arrived first, in August 2025, and covers only radio equipment; the CRA arrives in stages through 2027 and covers everything with digital elements. For a wireless consumer product both apply, and the Commission has said the CRA will eventually take over the RED cybersecurity requirements.

	EU Cyber Resilience Act	EU Radio Equipment Directive, cybersecurity delegated act
Applies when	Any product with digital elements placed on the EU market, consumer or industrial	Radio equipment sold in the EU that connects to the internet, processes personal data, or handles payments
Who demands it	Market access, mandatory (CE marking)	Market access, mandatory (CE marking)
What it is	Regulation	Directive plus delegated regulation 2022/30
Scope	Security by design, SBOMs, 24-hour reporting of actively exploited vulnerabilities to the CSIRT and ENISA, coordinated disclosure, post-market monitoring for the support period	Network protection, personal-data and privacy protection, fraud protection, via harmonised standard EN 18031
In force	In force 10 Dec 2024; reporting duties from 11 Sep 2026; main obligations from 11 Dec 2027	Applies from 1 Aug 2025
Penalties	Up to EUR 15M or 2.5% of global turnover	National; typically withdrawal from market and fines
Authoritative text	CRA text ↗ · on this site	RED delegated act text ↗

What a product team should do

If you ship a wireless product to the EU today, EN 18031 under the RED is the live obligation. Build the CRA file alongside it; the overlap is large and the CRA is the one that lasts.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: EU Cyber Resilience Act (official text) and EU Radio Equipment Directive, cybersecurity delegated act (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons