Blog · August 4, 2026
RED and CRA: What is coming for device manufacturers — and when
Two pieces of EU legislation demand cybersecurity directly in the device: the Radio Equipment Directive (RED) for everything that uses radio, and the Cyber Resilience Act (CRA) for practically every product with a digital interface. The first deadline has already passed; the next one is weeks away. Here is what applies, from when — and what a manufacturer should do now, depending on whether the device is already in series production or still on the drawing board.
What the two regulations are
The RED (Radio Equipment Directive, 2014/53/EU) is the directive under which every radio device is placed on the EU market — from a Bluetooth sensor to a cellular module. What is new are its cybersecurity requirements from Article 3(3): internet-connected devices must protect the network, protect personal data, and provide fraud protection. In practice, compliance is usually assessed against the EN 18031 series of standards.
The CRA (Cyber Resilience Act, Regulation (EU) 2024/2847) goes further: it applies not only to radio equipment but to almost all “products with digital elements” — including a device that has nothing more than a USB socket or an RS-485 port. It demands security by design, vulnerability handling across the life cycle, and security updates for years.
The deadlines
| Date | What applies |
|---|---|
| 1 August 2025 | RED Article 3(3) d/e/f is mandatory — already in force. Internet-connected radio devices placed on the market since then must comply |
| 11 September 2026 | CRA reporting obligations: actively exploited vulnerabilities and severe security incidents must be reported to ENISA and the national CSIRT |
| 11 December 2027 | CRA fully applicable: no conformity, no placing on the EU market. Support period of at least five years; security updates must remain available for ten years |
One point that summaries often get wrong: EN 18031 itself is not mandatory. What is binding are the RED requirements — the standard provides the presumption of conformity, and its harmonisation applies only with restrictions. If you need certainty, read the implementing decision or ask your test house.
What this means if your device is already in series production
The CRA applies to products placed on the market from its deadlines onwards — every unit you sell after 11 December 2027 must comply. “We have always built it this way” stops being an argument. For a running series, three questions matter:
- Does the device have an update path? Without the ability to update firmware in the field, the security-update obligation cannot be met. This is the hard core — everything else is paperwork.
- Does the device verify what it installs? An update path without signature verification is itself a vulnerability.
- Do you know what is inside your firmware? Third-party libraries, old protocol stacks — the reporting obligation starting September 2026 assumes that you know your own device.
In many cases an update path can be retrofitted — depending on the microcontroller, free memory, and the available interface. It is not magic, but it is bootloader work, and it needs time before the deadline, not after it.
What this means if you are developing right now
Then you are in the better position: security by design costs little now and a lot later. Concretely — plan the update mechanism and signature verification from the start, lock down interfaces instead of leaving them open, document your dependencies, and settle the certification strategy before the layout is frozen. Whoever designs a device without an update path today is designing a device that cannot be sold after the end of 2027.
Where we can help — and where we can't. We are not standards consultants and we do not interpret legal texts; that is what test houses and specialised lawyers are for. What we build is the technical foundation without which every CRA strategy stays on paper: the secure update path into the field. We have implemented it twice — in series production over cellular, with signature verification on the device, and in clinical use via a dedicated base station. And we have taken two products through TÜV certification, with the development done by a single engineer. If your device has no update path yet: after a look at the firmware and the memory map we can tell you whether one can be retrofitted.
What about you?
We are interested in the practice: how are you dealing with the deadlines — retrofitting, redesigning, or waiting? Write to us; we are collecting the cases.
Deadlines as of 4 August 2026, checked against the legal texts. This article is a technical orientation, not legal advice.
Transparency note: This article was written with the help of artificial intelligence and reviewed by the author before publication. The review applies to the German original; this English version is a translation.