That “CE” logo is more than just a label; it’s your gateway to legally marketing products in the European Union (EU), indicating that your device meets essential health and safety requirements.
Until recently, EU regulations for electronic products focused on preventing physical damage, device malfunctions, and radio interference. But as smart, connected products proliferate—from everyday consumer devices to complex industrial systems—so do cybersecurity risks. Devices are increasingly connected to networks, handle personal data, and form part of critical infrastructure, making them prime targets for cyberattacks.
To address these growing concerns, the EU introduced a major update to the Radio Equipment Directive (RED) through the RED Delegated Regulation (RED-DA), which came into force in August 2025. This new regulation ensures that all radio and IoT products marketed in the EU meet mandatory cybersecurity requirements.
Where does the RED-DA apply?
The scope of the RED-DA is broad and continues to expand with the growth of the digital ecosystem. It applies to any product that incorporates a radio interface using wireless technologies. This includes a wide range of devices, such as consumer electronics like smart speakers, connected light switches, and televisions; wearable personal devices like smartwatches and fitness trackers; health technology and medical sensors; connected toys and tracking devices; as well as IoT systems that support smart homes, industrial environments, and critical infrastructure.
Connecting the RED-DA to the Big Picture: The Cyber Resilience Act (CRA)
While the RED-DA focuses specifically on wireless and radio-connected devices, it is not an isolated initiative. It is part of a broader EU regulatory push to build a stronger and more secure digital ecosystem. Enter the CRA, a separate but complementary regulation that targets a wider category of digital products with embedded software, regardless of whether they include a radio interface.
Together, RED-DA and CRA form fundamental pillars of the EU's constantly evolving cybersecurity regulatory framework. While RED-DA ensures that devices using radio technologies are secure, reliable, and compliant before they can bear the CE mark, CRA extends this scope to cover the entire lifecycle of digital products. This includes secure development by design, ongoing software maintenance, vulnerability notification, and long-term support, ensuring greater protection and resilience across the entire digital ecosystem. In short, RED-DA is one of the pillars of the EU's layered approach to digital product security. For manufacturers, understanding RED-DA not only helps them meet immediate compliance requirements but also prepare for the broader, more systemic obligations introduced by CRA.
Along these same lines, Europe has introduced EN 18031 as a harmonized standard to meet network cybersecurity requirements. It covers network protection, data privacy, and fraud prevention, and provides manufacturers with a practical framework for demonstrating compliance. For most wireless and IoT products, the focus is on EN 18031, which sets expectations for protecting networks against misuse, disruption, and attacks. It emphasizes secure design practices, such as authentication, access control, encrypted communication, protected updates, and resilience against common threats, ensuring that connected devices are compliant and reliable. The standard offers tailored guidance for different types of devices, ensuring that security measures are appropriate for the risk.
As Europe strengthens its digital resilience, these standards and regulations will determine how products are designed, tested, documented, and maintained, while raising the bar for security.
Why regulatory compliance is important for wireless product developers.
Risk and Reputation:
For solution providers integrating wireless technologies, supporting robust network security is essential not only to ensure regulatory compliance but also to safeguard customer value and preserve market trust. Failure to comply with RED-DA requirements can expose products to vulnerabilities, recalls, or sales restrictions, disrupting business operations and damaging brand reputation and long-term credibility with partners, regulators, and end users. Compliance has been mandatory for all new wireless devices sold in the EU since August 1, 2025. Any product lacking a valid Declaration of Conformity (DoC) referencing EN 18031 now risks being banned in Europe.
Supply chain complexity:
Manufacturers often integrate wireless modules or systems-on-a-chip (SoCs) as the backbone of their wireless connectivity. Ensuring these components comply with EN 18031 and have an upstream Document of Compliance (DoC) greatly simplifies downstream compliance and reduces costs and engineering burden.
The Role of the Declaration of Conformity (DoC)
A DoC is an official declaration confirming that a product complies with all applicable directives and standards, including the cybersecurity requirements set out in RED-DA. For organizations integrating wireless modules or System-on-a-Chip (SoC), obtaining a DoC from technology vendors offers significant advantages. It simplifies documentation by allowing the vendor's DoC to be incorporated into product conformity records, accelerates CE marking by leveraging pre-certified modules, and reduces the overall compliance burden by minimizing the need for additional, extensive testing. Beyond efficiency, it also increases trust by signaling a strong commitment to regulatory responsibility to both partners and end users. SoC and wireless module vendors who prioritize RED-DA compliance enable their customers to innovate faster, more securely, and with greater confidence.
Practical Steps for Wireless Device Manufacturers
: For wireless device manufacturers, complying with RED-DA requirements involves a series of practical steps, beginning with developing a clear understanding of the regulations and identifying the harmonized standard applicable to their product. It is essential to select wireless modules or chipsets only from suppliers that comply with RED-DA and have valid Declarations of Conformity for EN 18031. Since the responsibility for the final product ultimately rests with the manufacturer, conducting a thorough gap analysis ensures that any additional requirements not covered by the selected module or SoC are adequately addressed. Security must also be built in from the outset, with security-by-design practices integrated into both the hardware and software lifecycles. To support compliance, manufacturers should maintain complete and auditable documentation, including technical files, test reports, and supplier Declarations of Conformity, for at least ten years after market launch. Finally, organizations must plan for ongoing compliance by monitoring evolving regulations, such as the Cyber Resilience Act, and implementing processes for timely security updates and vulnerability management.
Trusted Partners for RED-DA Compliance:
Microchip Technology is a global leader in secure, connected solutions for embedded systems. As a trusted provider of wireless modules, SoCs, and development tools, Microchip is committed to supporting its customers in the evolving regulatory compliance landscape.
Microchip's wireless solutions are built on security-by-design principles and developed to meet the stringent requirements of EN 18031 under RED-DA. By providing comprehensive declarations of conformity, detailed technical documentation, and ongoing support, Microchip helps device manufacturers accelerate time to market with pre-certified, RED-DA-ready modules. This helps streamline compliance processes while reducing engineering overhead and enables customers to create secure and resilient products that not only meet EU regulatory requirements but also enhance customer confidence.
By choosing Microchip as their wireless technology partner, developers gain access to a robust portfolio of compliant solutions, expert guidance, and a commitment to long-term success in the connected device market. Learn more about Microchip's wireless products and RED-DA compliance online: https://www.microchip.com/en-us/solutions/technologies/embedded-security/radio-equipment-directive
Security is a shared responsibility.
The RED-DA cybersecurity requirements, with EN 18031 as their core standard, represent a fundamental shift in how manufacturers must approach the security of wireless and IoT products. The responsibility for ensuring compliance does not rest with a single stakeholder, but is a shared obligation across the entire development and supply ecosystem.
Choosing the right wireless module or SOC provider—one that proactively supports RED-DA and provides a declaration of conformity—is essential. But it is equally important that manufacturers take responsibility for how these technologies are integrated and implemented in their final products. Security must be built into the entire design lifecycle, not added as a late-stage patch.
This includes applying the defense-in-depth principle, ensuring that security is implemented across multiple layers of the system, rather than relying on a single point of protection. For example, customers should be encouraged to enable Transport Layer Security (TLS) for encrypted communication, even if their devices already use Wi-Fi security protocols. Layering protections like these helps mitigate risk if one layer fails and prevents attackers from accessing sensitive data or system controls through a single weak point.
By working closely with experienced, compliance-ready suppliers and aligning internal development practices with recognized standards, organizations can not only meet regulatory requirements but also deliver more resilient and reliable solutions for the connected world. Now is the time to act to prepare, collaborate, and create secure wireless products that meet both current expectations and future challenges.
Author: By Abhinay Venuturumilli, Senior Director of Worldwide Marketing, Wireless Solutions Group, Microchip
https://www.microchip.com/en-us/solutions/technologies/embedded-security/radio-equipment-directive
