Does the Radio Equipment Directive (RED) demand the implementation of security?

Since 2014 the Radio Equipment Directive 2014/53/EU, abbreviated RED, regulates the making available of radio equipment on the market. A recently published legal act now specifies contents of the Directive with regard to the topics (Cyber)-security and data protection.

This overview intends to explain the motivation of the European Commission as well as some content-related aspects of the legal act.

Considerations of the Commission

On a global scale the 5G-technology is on the rise and is most likely going to affect the daily routine within the European Union. Despite all advantages of the technology the dispersion of the standard also endangers cybersecurity. Especially machines being able to communicate via internet connection are in the scope of the Radio Equipment Directive and therefore exposed to such a threat.

So far, the essential requirements of the Directive have not referred to such equipment connected to the internet. Due to the internet-readiness, this kind of asset is exposed to a certain fraud risk, which is to be reduced via a corresponding adjustment of the requirements. Due to those reasons the EU-Commission saw an urge to “re-sharpen” article 3 of the RED.

Content of the legal act

The Commission published the Regulation in the EU Official Journal “supplementing Directive 2014/53/EU (…) with regard to the application of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of that Directive.”¹

The Radio Equipment Directive may grant the Commission the authority to state via delegated legal acts which “categories or classes of radio equipment” are covered in the range of article 3.

A legal act of that kind is Regulation 2022/30: it determines that “internet-connected radio equipment” is also covered by the requirements.

In a broader sense, e.g., internet-connected machinery may not exert any “harm to the network or its functioning or misuse of network resources”, “support features for ensuring protection from fraud” and guarantee the protection of person-related data.

Effective date and further information

According to the Commission’s information the Regulation will be effective from the 20th day of publication in the Official Journal of the EU (02/01/2022), from August 1st all products concerned will need to fulfil the new requirements.

With respect to standardization, CENELEC have announced that they have already initiated a preparation of appropriate harmonized standards.

Link to the delegated Regulation

Interested readers can read the full text of the legal act on the portal EUR-LEX. The link can be found here.

Footnote:
¹The full text of the Radio Equipment Directive can be found on the Commission's webpage EUR-LEX.