The Official Journal of the European Union has published delegated regulation 2022/30/EU, enforcing compliance requirements to RED Article 3.3(d), (e) and (f). The regulation requires cybersecurity, personal data privacy and fraud protection for applicable wireless devices available on the EU market.
The regulation becomes mandatory Aug. 1, 2025.
The new regulation covers devices that can communicate over the internet, whether directly or via other equipment. Radio equipment that may expose sensitive personal data is also in scope. For example:
While the EU has activated essential requirements for Article 3.3(d)(e)(f), there are no agreed-upon harmonized standards yet. However, the EU has published the EN 18031 series of standards to the corresponding articles 3.3 (d), (e), and (f). Although these are not harmonized, UL Solutions can provide a full evaluation to the standards to be used for the final Notified Body approval.
As there is no harmonized standard, Article 17 and Annex III of the Directive note that the conformity assessment procedure needs to be carried out by an EU-type examination with a Notified Body, making it mandatory.
At UL Solutions, we are a registered Notified Body and can support you regardless of your current development stage. For early-stage projects, we offer training and workshops led by our security experts to equip your team with the knowledge to successfully implement your products. For projects in a later development stage, we can assist you with a gap analysis or full compliance assessment to EN 18031-1/EN 18031-2/EN 18031-3, EN 303 645 and IEC 62443-4-2, which will help you increase the security posture of your products.
We can work with you to help confirm your compliance with the RED cybersecurity requirements.