Delegated Regulation RED compliance cybersecurity IoT products published in OJEU
The Official Journal of the European Union (OJEU) has published the Delegated Regulation (2022/30/EU), making compliance to the RED (2014/53/EU) articles 3.3 (d), (e) and (f) mandatory for cybersecurity aspects of IoT products. The Delegated Regulation will come in effect on the 1st of February 2022.
Update 2026: The cybersecurity requirements under RED Articles 3(3)(d), (e) and (f) have applied to relevant radio equipment since 1 August 2025. Delegated Regulation (EU) 2022/30 is set to be repealed with effect from 11 December 2027, when the Cyber Resilience Act (CRA) becomes fully applicable. Until then, manufacturers of applicable radio equipment must continue to comply with the RED cybersecurity requirements.
After a transition period, compliance become mandatory from 1st August 2025. This regulation shall be binding in its entirety and will become directly applicable in all EU member states.
What does this mean for you as a manufacturer?
Compliance with the cybersecurity requirements of Articles 3(3)(d), (e) and (f) of the RED (2014/53/EU) became mandatory for applicable radio equipment on 1 August 2025. Until then there is a transition period in which you have the opportunity to make your products compliant to these specific articles. Effectively this means that from the 1st of August 2024 you are not allowed to sell your products on the European market if they do not comply to articles 3.3 (d), (e) and (f) of the RED. For more information on the impact, timeliness and solutions on basis of this regulation read our white paper.
How can Kiwa help?
Kiwa supports manufacturers who want to get their products ready for European market access. For market access in Europe, RED compliance of a product is essential. In addition to the already mandatory articles of the RED (3.1a, 3.1b and 3.2) we can also help with testing and certification according to articles 3.3 d, e and f resulting in a one stop solution for your product’s RED compliance.
More information
You can read all about the Delegated Regulation in the official EU website. For more information about Kiwa’s services in the field of RED certification, please feel free to contact us via cybersecurity.certification@kiwa.com or +31 (0)88 998 33 70.
ETSI EN 303 645: security of IoT consumer electronics
Refrigerators, lighting, TV’s, smoke detectors, toys, fitness trackers... An ever-increasing number of everyday electronic consumer products is connected to the internet. These ‘smart’ devices make our lives more pleasant and often easier, but they also entail security risks.
IEC 62443 certification: Cyber Security for Industrial Automation & Control Systems (IACS)
Digitalization and the Internet of Things (IoT) offer great opportunities for manufacturing industries. However, if not properly secured they can cause vulnerability, leading to cybercrime and attacks by hackers. This can seriously damage daily operations and business continuity.
Remote Access for Remote Services (RARS) Certification Scheme
By taking the recent cybersecurity trends into account, Kiwa developed the Remote Access for Remote Services (RARS) scheme, also known as K21048. The RARS scheme is a collection of assessments set up by Kiwa that focusses on different types of systems that are remotely accessible.
