EU · Delegated Regulation (EU) 2022/30; Regulation (EU) 2026/339
Cybersecurity duties for specified radio equipment
Identify the market and product category first. Each dossier separates legal duties, referenced standards, evidence and the comparison needed for an award.
Product Scope
Article 3(3)(d) covers defined internet-connected radio equipment; privacy requirements additionally concern specified equipment, including childcare and wearable products, where relevant data are processed. Fraud protection applies to defined money-transfer functionality. Product-specific exceptions must be checked.
Requirements
Identify which network-protection, personal-data/privacy and fraud requirements actually apply. Assess assets, interfaces, authentication, access control, updates and the relevant threat assumptions. Cited EN 18031 parts are a technical route with published restrictions, not a blanket cybersecurity approval for every implementation.
Required Evidence
Provide architecture and interface inventories, software and firmware versions, threat and security assessments, full test results and the conformity route. Where restricted or incompletely applied harmonised standards do not establish the required presumption, examine the notified-body procedure rather than relying on a generic penetration-test certificate.
Comparison for the Awards
A security duty or vulnerability-disclosure document is not a numerical award margin. Only a specific, repeatable technical comparison with an applicable requirement can support an above-baseline finding; absence of detected vulnerabilities is not proof of zero vulnerability.
Version & Transition
The duties apply from 1 August 2025. Regulation 2026/339 repeals 2022/30 with effect from 11 December 2027, not on its April 2026 publication date. The Cyber Resilience Act has its own phased obligations.
Official Sources
Applicability depends on the product classification, intended use, configuration and actual sales territory. Manufacturing, placing-on-the-market and testing dates, together with transition provisions, are checked as required by each applicable rule. The directory identifies sources; it does not replace assessment of the specific model. Standards are identified by reference, and their authoritative texts remain with the issuing bodies. Official source documents retain their original language.