EU RED Cybersecurity Requirements in Force: Checklist (2025)
RED cybersecurity requirements entered into force on 1 August 2025 for wireless and IoT devices, adding new obligations for risk management, vulnerability monitoring, and security policies. This update also covers the EAEU energy-efficiency regulation delay to 2028 and Indonesia’s mandatory new telecom Declaration of Conformity format (DJID, Aug 2025).
Table of Contents
🇪🇺 EU RED Cybersecurity Requirements (In Force 1 Aug 2025): Documentation & Obligations
New cybersecurity requirements under the EU Radio Equipment Directive (RED) took effect on 1 August 2025, set out in Commission Delegated Regulation (EU) 2022/30 — a year later than first planned, after Delegated Regulation (EU) 2023/2444 moved the date from 1 August 2024.
They apply to radio equipment that connects to the internet, to equipment that processes personal, traffic or location data — including childcare equipment, toys and wearables — and to equipment that lets the user transfer money, monetary value or virtual currency. The scope is not limited to consumer products. Equipment placed on the market before 1 August 2025 is not caught retroactively, but a product that is substantially modified has to be assessed again.
The exclusions are narrow. Radio equipment that is also covered by the Medical Devices Regulation (EU) 2017/745, the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746, the civil aviation Regulation (EU) 2018/1139, the vehicle general safety Regulation (EU) 2019/2144 or the electronic road toll Directive (EU) 2019/520 falls outside these requirements.
Harmonised standards for these requirements were cited in the Official Journal by Commission Implementing Decision (EU) 2025/138 of 28 January 2025: EN 18031-1:2024 for internet-connected radio equipment, EN 18031-2:2024 for equipment processing personal, childcare, toy or wearable data, and EN 18031-3:2024 for equipment handling virtual money or monetary value. All three are listed with restrictions. The presumption of conformity does not extend to equipment that lets the user skip setting a password, and the clauses of the standards headed "rationale" and "guidance" confer no presumption of conformity at all. Anyone relying on these standards still has to cover those points separately in the technical file.
Under the Delegated Regulation, the manufacturer has to design the equipment so that it does not harm the network, safeguards users' personal data and privacy, and protects against fraud, and has to show how it did so in the technical documentation. The Delegated Regulation itself sets no fixed support or monitoring period.
This is an interim regime. Commission Delegated Regulation (EU) 2026/339 of 16 February 2026 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027, the date the Cyber Resilience Act (EU) 2024/2847 starts to apply. Products placed on the market before that date fall under the CRA only if they are substantially modified, but the CRA's vulnerability and incident reporting obligations under Article 14 have applied since 11 September 2026 to every in-scope product, including those already on the market.
Status: In force since 1 August 2025
📌 What This Means for Manufacturers
- Update the technical documentation and revisit the conformity assessment route for every wireless or IoT device you place on the EU market.
- Run a cybersecurity risk assessment and keep the vulnerability monitoring records and security policies in the technical file.
- Agree with engineering how the device handles secure updates and how long you will keep supplying security updates. Delegated Regulation (EU) 2022/30 sets no minimum period; from 11 December 2027 the Cyber Resilience Act sets its own support period rules.
{{cta}}
🌍 EAEU Energy Efficiency & Labelling Regulation Delayed to 2028
The Council of the Eurasian Economic Commission, at Russia's request, has postponed the entry into force of the EAEU technical regulation on energy efficiency requirements for energy-consuming devices to 1 September 2028.
The extra time is meant to let the Commission finish the planned amendments to the technical regulation and adopt the second-level acts it depends on: the list of standards and the energy efficiency labels for energy-consuming devices.
Additionally, the decision establishing label forms and design rules for various energy-consuming devices has been postponed to 1 March 2028. Specific requirements in several annexes to the technical regulation have also been delayed by three years.
Status: Postponed — the technical regulation now applies from 1 September 2028. It will cover all energy-labelled product groups traded with Eurasian Economic Union countries (Armenia, Belarus, Kazakhstan, Kyrgyz Republic, Russian Federation).
📌 What This Means for Manufacturers
- Hold off on immediate compliance spending, but start aligning your documentation with the standards expected for 2028.
- Monitor the secondary legislation drafts — especially the energy labelling templates — to avoid future redesign cycles.
- Map affected product categories and update internal roadmaps for Eurasian market entry or product updates.
🇮🇩 Indonesia Telecom Declaration of Conformity (DoC) Format Mandatory (DJID, Aug 2025)
The Directorate of Digital Infrastructure Services, part of the Directorate General of Digital Infrastructure (DJID) at Indonesia's Ministry of Communication and Digital Affairs (Komdigi), changed the Declaration of Conformity (DoC) format for telecommunications equipment in Circular Letter No. 03 of 2025, signed in Jakarta on 15 July 2025.
Every certification application filed from 1 August 2025 had to use the new DoC format, and applications filed on the old format have been rejected since 1 September 2025. The circular implements Ministry of Communication and Information Technology Regulation No. 3 of 2024, which makes the DoC one of the mandatory documents in a certification filing.
The new format is meant to speed up evaluation and make the submitted documents consistent. The DoC is issued on the letterhead of the company responsible for the application and declares that the device meets the applicable technical standards.
Status: In force
📌 What This Means for Manufacturers
- Applications on the old format have been rejected since 1 September 2025 — check any file that is still pending or due for resubmission.
- Check that your local certification team is working from the current DoC template before it files anything.
- Clarify document ownership within compliance, legal, or product divisions to avoid submission bottlenecks.
✅ Need help putting these changes into practice? EcoComply’s real-time alerts and workflow automation keep your compliance documentation, labelling and cybersecurity policies up to date — across markets.
Related reading: Selling electronics in the EU: complete compliance guide for manufacturers.
Frequently Asked Questions
Everything you need to know about EU compliance
Keeping an electronics product compliant as the rules move?
Between RED, EMC, RoHS and the battery rules, most electronics carry four or five obligations that each change on their own schedule. We track them against your product list so nothing lapses quietly. More than 100 manufacturers across the EU work with us.
- Every applicable directive mapped to your products
- Documentation kept current as the rules change
- EU and UK representation in one place
Discuss your product and compliance needs
Tell us about your product and target markets. Receive an initial requirements assessment and a personalised proposal based on our fixed pricing. No obligation.
