This article highlights the new RED regulation (EU) 2022/30, which comes into force on 1 August 2025. It applies to any radio equipment that can connect to the internet independently. For full details, refer to Commission Delegated Regulation (EU) 2022/30 of 29 October 2021, which supplements Directive 2014/53/EU of the European Parliament and of the Council.
A New Era for Cybersecurity Compliance in the EU Under RED
The European Commission’s Directorate-General for the Internal Market, Industry, Entrepreneurship and SMEs introduced this regulation in response to growing concerns around the security of connected devices. With cyberattacks and data breaches on the rise, there’s a stronger push to improve regulation and minimise risk.
The regulation is designed to strengthen cybersecurity, safeguard user privacy and support better interoperability across smart and connected devices in the EU. It also underlines the EU’s commitment to protecting consumers, maintaining digital sovereignty, and building a more resilient digital infrastructure in the age of the Internet of Things.
What Is the RED delegated act?
Commission Delegated Regulation (EU) 2022/30, supplementing RED 2014/53/EU, introduces new essential requirements to ensure that radio equipment:
- protects personal data and user privacy
- prevents misuse of network services
- supports interoperability with existing networks
The regulation covers a broad range of connected equipment, including:
- smartphones and tablets
- smart home devices
- IoT modules (e.g. Wi-Fi, Bluetooth, LTE)
- smart toys and wearables
- wireless routers and modems
| Important note: The regulation is not retroactive. The new cybersecurity requirements apply only to products placed on the market after 1 August 2025. |
The Delegated Act amends Article 3(3) of the RED directive by adding the below obligations:
(d) Network protection – devices must not harm network performance or misuse network resources
(e) User privacy protection – devices must prevent unauthorised access to personal data
(f) Fraud prevention – devices must be secure enough to prevent identity theft or unauthorised payments
To prove compliance, manufacturers can either follow harmonised standards (expected from ETSI or ENISA) or work with a notified body to carry out a conformity assessment.
Who is affected by RED DA (EU) 2022/30?
- manufacturers of wireless devices sold in the EU
- importers bringing products into the EU
- distributors and retailers offering connected devices
They will be responsible for:
- updating technical documentation
- issuing a new EU Declaration of Conformity (DoC)
- conducting cybersecurity risk assessments for their products
What’s recommended when preparing devices for RED DA (EU) 2022/30?
- Review your product portfolio and identify which devices fall under the new scope.
- Conduct cybersecurity risk assessments for applicable products.
- Apply secure-by-design principles (e.g. encryption, authentication).
- Update firmware and software processes to support future patches and security updates.
- Keep track of harmonised standards as they’re published and adjust your testing approach.
- Train internal teams on documentation updates and CE marking requirements.
| You’ll find the full text and all necessary information in Commission Delegated Regulation (EU) 2022/30 of 29 October 2021, which supplements Directive 2014/53/EU of the European Parliament and of the Council regarding the essential requirements set out in Article 3(3), points (d), (e), and (f). |
The official versions of the relevant acts, including their preambles, are available in the Official Journal of the European Union and can be accessed through the EUR-Lex portal.
What else is coming? Upcoming EU and US cybersecurity regulations
In addition to the RED DA, several other cybersecurity regulations are set to take effect over the coming years:
- Cyber Resilience Act (CRA)
This upcoming EU regulation will require connected devices, particularly those used in critical infrastructure, to have built-in cybersecurity features. Manufacturers will need to provide regular security updates and patches. Compliance will be mandatory from 2027.
- US Cyber Trust Mark
A voluntary labelling scheme in the United States, similar in purpose to CRA. While not mandatory, it can help promote a product’s cybersecurity credentials.
- US Regulation on Connected Vehicles
Regulations in the US will require cybersecurity compliance for vehicle software from 2027 and for hardware by 2030. These rules apply to connected vehicles, aftermarket telematics solutions, and spare parts sold on the US market.
Masterclass Quectel – RED DA and beyond: How to prepare for new cybersecurity regulations
Want to better understand how the upcoming cybersecurity rules may affect your project? Or how suppliers can support your compliance efforts and help future-proof your devices? Quectel has put together an expert-led webinar on this topic, featuring Tomaz Petaros and Seungryoul Yoon.
Webinar agenda includes:
- Overview of the RED DA and other upcoming cybersecurity regulations
- How to prepare for the new requirements
- How Quectel can support your compliance process
Watch the webinar here.
Explore our current range of Quectel communication modules. We’re continuously expanding our offer as new models become available.
Your feedback helps us create truly useful content for our readers. Appreciate the above information with an imaginary contribution for this article.
If you have any questions or comments, please don't hesitate to contact us. Thanks again for your time and trust.
Interested in more information about Quectel products or need technical advice on choosing the right product? Have any other questions or requests? Fill out the form below, and we’ll be happy to help!
Do you like our articles? Do not miss any of them! You do not have to worry about anything, we will arrange delivery to you.
