RED and CRA: 2027 Dual-Regime Guide

If you manufacture connected radio equipment for the EU market, you are operating under two cybersecurity regimes simultaneously right now. That is not a forecasting statement. It is the current legal position, and it will remain so until 11 December 2027.

Commission Delegated Regulation (EU) 2022/30 became applicable on 1 August 2025, activating the cybersecurity essential requirements under Articles 3(3)(d), (e) and (f) of the Radio Equipment Directive (RED) for specified categories of radio equipment. On 16 February 2026, the Commission adopted Delegated Regulation (EU) 2026/339, which repeals Regulation (EU) 2022/30 — but with effect from 11 December 2027, the date the Cyber Resilience Act (CRA) becomes fully applicable. Until that date, both instruments are live.

The practical consequence: the regime that governs your product depends entirely on when it was placed on the EU market, not on when you started designing it or when you expect to reach CRA compliance. Products placed on the market from 1 August 2025 through to 10 December 2027 remain subject to RED cybersecurity requirements and RED market surveillance, even after the CRA applies to new placements.

Most compliance content presents this transition as a clean handover. It is not. There is a 28-month window in which your obligations, your conformity route, and the authority enforcing against you differ depending on placement date. This guide sets out exactly where the lines fall and what you need to do on each side of them.

The transition is structured around a single anchor point: the date of placement on the market. Understanding that anchor is the foundation for every compliance decision you make between now and the end of 2027.

The three phases in sequence

Phase 1: Before 1 August 2025 Products placed on the EU market before this date were not subject to the RED cybersecurity essential requirements under Articles 3(3)(d), (e) and (f). The general RED requirements under Articles 3(1) and 3(2) applied, but cybersecurity was not a mandatory essential requirement. Market surveillance authorities had no grounds to enforce against those products on cybersecurity.

Phase 2: 1 August 2025 to 10 December 2027 (the dual-regime window) This is where most manufacturers are operating today. From 1 August 2025, the RED cybersecurity requirements became mandatory for the categories of equipment specified in Delegated Regulation (EU) 2022/30. Products placed on the market during this window must:

1. Meet the essential requirements under Articles 3(3)(d), (e) and (f) of the RED
2. Follow the conformity assessment routes available under the RED (self-assessment where permitted by the EN 18031 series, third-party assessment where mandated)
3. Carry a valid Declaration of Conformity (DoC) referencing the RED
4. Be CE marked under the RED framework

Critically, the repeal of Regulation (EU) 2022/30 does not extinguish these obligations retroactively. Products placed in this window remain under RED market surveillance for as long as they are on the market, even after 11 December 2027.

Phase 3: From 11 December 2027 The CRA becomes fully applicable. New placements of products with digital elements that include radio functionality fall under the CRA. The RED cybersecurity delegated act is repealed. Market surveillance for new placements transfers to CRA authorities.

The placement date is the determinative fact

Key point: "Placed on the market" means the first making available of an individual product unit in the EU. It is not the date of design freeze, type approval, or CE marking. If a product was CE marked under the RED in June 2025 but first sold in September 2025, the RED cybersecurity requirements apply to it.

Not every product covered by the RED falls within the cybersecurity essential requirements. Delegated Regulation (EU) 2022/30 specifies the categories in scope for each of the three articles. Getting this wrong in either direction carries risk: missing a requirement creates enforcement exposure; over-applying it creates unnecessary conformity cost.

Article 3(3)(d): Network protection

This requirement applies to radio equipment that connects to the internet. The intent is to ensure devices do not harm the network or misuse network resources. In practice, this captures:

1. IoT devices with internet connectivity (smart sensors, connected industrial equipment, home automation devices)
2. Wearables capable of internet connection
3. Any radio device capable of communicating with internet-connected systems

Article 3(3)(e): Personal data and privacy

This requirement applies to equipment that processes personal data, traffic data, or location data. It is not limited to internet-connected devices. Equipment that processes location data without internet connectivity can still fall in scope. Categories include:

1. Wearables that track health or location data
2. Childcare equipment with audio or video monitoring capability
3. Any device processing data defined under Article 4(1) of GDPR

Article 3(3)(f): Financial fraud prevention

This requirement applies to radio equipment that permits monetary transactions. It is the narrowest of the three in scope, primarily covering:

1. Payment-enabled devices with radio functionality
2. Devices that can initiate or facilitate financial transfers

Scope is product-specific, not category-wide

A practical caution: the delegated regulation specifies which article applies to which equipment category. A product may be in scope for one or two articles but not all three. Your Declaration of Conformity must reference only the articles that apply to your specific product, and your technical documentation must demonstrate conformity against each applicable requirement separately.

If you are uncertain whether a specific product falls within scope, the Commission's CRA FAQ and the guidance on EN 18031 application published via CIRCABC are the authoritative references.

The EN 18031 series of harmonised standards is the technical bridge between the RED delegated act and the CRA. Understanding its role and its limits is essential for any manufacturer making conformity decisions during the transition window.

What the standards cover

Three harmonised standards were published in 2024 and cited in the Official Journal via Commission Implementing Decision (EU) 2022/2191:

1. EN 18031-1:2024: Internet-connected radio equipment (Article 3(3)(d))
2. EN 18031-2:2024: Radio equipment processing personal data, traffic data, or location data (Article 3(3)(e))
3. EN 18031-3:2024: Radio equipment with monetary transaction capability (Article 3(3)(f))

Application of these standards confers a presumption of conformity with the corresponding RED essential requirements. That presumption is the basis for self-assessment under the RED, where it is available.

The restrictions that limit the presumption

The harmonised standards are cited with restrictions. This is the part most compliance summaries omit. Two restrictions are particularly significant for manufacturers:

1. EN 18031-3:2024, clause 6.3.2.4: Products to which this clause applies do not benefit from the presumption of conformity regardless of product design. Third-party conformity assessment via a notified body is mandatory for these products. Self-declaration is not available.
2. Partial application: Where a manufacturer applies only parts of the standard, or where the standard is applied in a way affected by the cited restrictions, the presumption of conformity does not apply to the restricted elements. The technical documentation must demonstrate conformity by other means for those elements.

The practical implication: before deciding your conformity route, you need to confirm whether your product falls within the restricted clauses of the applicable standard. Assuming self-assessment is available when a restriction applies is a compliance failure, not a grey area.

EN 18031 and the CRA: the carry-forward

The EN 18031 standards were designed to align with the cybersecurity essential requirements of both the RED delegated act and the CRA. The Commission's position, confirmed in the repeal regulation's recitals, is that the CRA's Annex I cybersecurity requirements encompass all elements of Articles 3(3)(d), (e) and (f) of the RED.

This alignment has a practical consequence: technical work done to EN 18031 standards during the RED transition window will remain relevant to CRA conformity. It is not wasted effort. However, the CRA introduces additional requirements beyond what the RED delegated act covers, including:

1. Vulnerability handling obligations
2. Incident reporting to ENISA
3. Software bill of materials (SBOM) documentation
4. Post-market obligations for the product's supported lifetime

EN 18031 compliance gets you most of the way to CRA readiness on cybersecurity properties. It does not get you to full CRA compliance. The gap is real and needs to be planned for.

This is the question most manufacturers ask first, and the answer is more conditional than most guidance acknowledges.

The carry-over rule: what the repeal regulation actually says

The repeal regulation (EU) 2026/339 is explicit on this point. The repeal of Delegated Regulation (EU) 2022/30 does not affect market surveillance and control under the RED for products placed on the market between 1 August 2025 and 10 December 2027. Those products remain subject to RED enforcement, and the DoC issued under the RED remains the relevant conformity document for those products.

What this means in practice:

1. A RED DoC issued today, referencing Articles 3(3)(d), (e) and (f), remains valid for the product it covers throughout that product's time on the market
2. Market surveillance authorities can and will act against RED non-compliance for products in the transition window, even after the CRA applies to new placements
3. The RED DoC does not need to be reissued under the CRA for products already placed on the market before 11 December 2027

Where certificates do not carry forward

The carry-over applies to conformity documentation for products already placed on the market. It does not apply in the following situations:

The "substantial modification" risk

The CRA introduces a concept of substantial modification that can reset a product's compliance status. If a product placed on the market before 11 December 2027 under the RED is subsequently substantially modified, it may be treated as a new product under the CRA for the purposes of the modified version. The boundary between a software update and a substantial modification is not yet settled in guidance, but the CRA's Article 23 provides the starting framework.

This is a material risk for manufacturers with long product lifetimes and active software development pipelines. A product shipped in 2026 under the RED could become subject to CRA conformity requirements if a post-2027 update is deemed a substantial modification. Planning for this now, rather than treating it as a 2027 problem, is the prudent approach.

The conformity route available to you depends on which regime governs the product and, within the RED regime, whether the applicable EN 18031 standard permits self-assessment.

Under the RED (placements 1 August 2025 to 10 December 2027)

The RED provides two conformity assessment routes for products in scope of the cybersecurity essential requirements:

Route 1: Self-assessment (internal production control) Available where the manufacturer applies the relevant harmonised standard from the EN 18031 series in full, and the product is not affected by any restriction that mandates third-party assessment. The manufacturer issues the DoC and retains technical documentation. No notified body involvement is required.

Route 2: Third-party assessment via notified body Mandatory where:

1. The manufacturer does not apply the harmonised standard (or applies it only in part)
2. The product falls within the restricted clauses of the standard (notably EN 18031-3:2024, clause 6.3.2.4)
3. The manufacturer chooses third-party assessment voluntarily

The guidance document on EN 18031 application, published via CIRCABC, clarifies that self-assessment is permitted only where the full applicable harmonised standard is applied and no restriction removes the presumption of conformity. Partial application of the standard does not trigger a presumption, and partial reliance on the standard combined with alternative technical evidence does not substitute for notified body involvement where that is mandated.

Under the CRA (placements from 11 December 2027)

The CRA introduces a risk-based conformity assessment structure. Products are classified as default, important (Class I), or critical (Class II). The conformity route depends on classification:

For radio equipment manufacturers, the relevant classification will depend on the product's function. Connected devices in critical infrastructure sectors, for example, are more likely to attract Class II classification. The Commission is expected to publish further classification guidance before the December 2027 deadline.

The transition conformity decision

If you are placing a product on the market now, the decision tree is straightforward:

1. Is the product in scope of the RED cybersecurity requirements (Articles 3(3)(d), (e), and/or (f))? If yes, proceed under the RED.
2. Which EN 18031 standard applies? Check whether any restriction removes the presumption of conformity.
3. If no restriction applies and the full standard is applied, self-assessment is available. Issue the RED DoC and retain technical documentation.
4. If a restriction applies or the standard is not fully applied, engage a notified body.
5. Begin CRA classification assessment in parallel, particularly if the product will still be in active development or on the market after 11 December 2027.

The transition window closes on 10 December 2027. That is 14 months from the date of publication of this article. For manufacturers with product development cycles of 12 to 18 months, that deadline is already inside the design window for products currently in development.

Immediate actions (now to Q1 2027)

1. Audit your current product portfolio against placement dates Map each product to its first placement date on the EU market. Any product placed from 1 August 2025 must have a valid RED DoC referencing the applicable cybersecurity essential requirements. If it does not, that is an active compliance gap, not a future risk.

2. Verify your conformity route for each in-scope product For each product in the RED cybersecurity window, confirm whether the conformity route taken (self-assessment or notified body) was appropriate given the applicable EN 18031 standard and any restrictions. If self-assessment was used where a restriction mandated third-party assessment, that gap needs to be remediated.

3. Begin CRA classification assessment for your product pipeline Any product you expect to place on the market after 11 December 2027 needs a CRA classification assessment now. This determines the conformity route, the documentation requirements, and whether notified body engagement is needed. Starting this in 2027 is too late for most product development timelines.

4. Identify the CRA gaps beyond EN 18031 If you have already done EN 18031 work, you have a foundation. Identify what the CRA requires that EN 18031 does not cover: vulnerability disclosure policy, SBOM, incident reporting to ENISA within 24 hours of becoming aware of an actively exploited vulnerability, and post-market security support commitments.

Before 11 December 2027

1. Ensure all products intended for pre-CRA placement are on the market If a product is designed to be placed under the RED regime and you intend to rely on the RED DoC, it must be placed on the market by 10 December 2027. Products not yet placed by that date must comply with the CRA regardless of when development began.

2. Establish your CRA technical documentation structure The CRA requires a different technical documentation set from the RED. This includes the security risk assessment, the vulnerability handling process, and the SBOM. These take time to build properly. Waiting until late 2027 creates execution risk.

3. Review your software update and modification policy Define internally what constitutes a substantial modification for your products. This matters for products placed under the RED that will continue to receive software updates post-2027. A clear policy, documented before the CRA applies, reduces the risk of inadvertent reclassification.

The parallel-running risk

The most common mistake manufacturers make in transition windows is treating the two regimes as sequential rather than simultaneous. The RED cybersecurity requirements are not winding down. They are fully in force for every product placed on the market today. Diverting compliance resource towards CRA preparation at the expense of RED compliance creates enforcement exposure right now, under a regime that is already active.

The right posture is parallel compliance: RED conformity for current placements, CRA readiness building in parallel for the pipeline. The EN 18031 work you do now serves both.

The dual-regime window is not just a legal complexity. It is an operational one. Compliance teams managing product portfolios that span multiple product lines, multiple placement dates, and multiple applicable standards are effectively running two compliance programmes simultaneously, against different documentation requirements, different enforcement authorities, and different timelines.

The challenge compounds for manufacturers who also carry obligations under other EU frameworks: NIS2 (if the manufacturer is itself an essential or important entity), the General Product Safety Regulation, or sector-specific requirements for medical devices or industrial equipment. Each framework has its own conformity logic, and the overlaps between them are not always resolved in guidance.

What effective transition management looks like

Three capabilities separate manufacturers who navigate this cleanly from those who accumulate compliance debt:

1. Product-level traceability Each product in the portfolio needs a clear record of its placement date, the applicable regime, the conformity route taken, the standards applied, and any restrictions that affected the presumption of conformity. This is not optional documentation. It is the evidence base for responding to market surveillance enquiries and for demonstrating ongoing compliance.

2. Pipeline visibility Products in development need to be mapped against the December 2027 deadline now. If a product will not be ready for placement before 10 December 2027, its CRA conformity route needs to be planned. If it might be ready, the team needs to understand what "placement" requires and whether accelerating the timeline is feasible.

3. Change management for substantial modifications For products with active software development pipelines, the risk of inadvertent substantial modification is real. A formal change control process that evaluates proposed updates against the CRA's substantial modification criteria is not a bureaucratic overhead. It is the mechanism that prevents a post-2027 software update from triggering a full CRA conformity assessment on a product that was shipped under the RED.

SureCloud's compliance management platform supports exactly this kind of multi-framework, multi-product compliance tracking: connecting regulatory requirements to product-level evidence, surfacing gaps before they become enforcement issues, and giving compliance and regulatory affairs teams a single view of obligations across frameworks. If you are managing CRA and RED obligations alongside NIS2 or other EU requirements, speak to the SureCloud team about how to structure that programme.

1. Delegated Regulation (EU) 2022/30 — the RED cybersecurity delegated act
2. Delegated Regulation (EU) 2026/339 — the repeal regulation
3. Regulation (EU) 2024/2847 — the Cyber Resilience Act
4. Commission guidance on EN 18031 application — CIRCABC guidance document (August 2026)
5. European Commission CRA FAQ — Commission Digital Strategy pages