Since 2014 the Radio Equipment Directive 2014/53/EU, abbreviated RED, regulates the making available of radio equipment on the market. A recently published legal act now specifies contents of the Directive with regard to the topics (Cyber)-security and data protection.
This overview intends to explain the motivation of the European Commission as well as some content-related aspects of the legal act.
On a global scale the 5G-technology is on the rise and is most likely going to affect the daily routine within the European Union. Despite all advantages of the technology the dispersion of the standard also endangers cybersecurity. Especially machines being able to communicate via internet connection are in the scope of the Radio Equipment Directive and therefore exposed to such a threat.
So far, the essential requirements of the Directive have not referred to such equipment connected to the internet. Due to the internet-readiness, this kind of asset is exposed to a certain fraud risk, which is to be reduced via a corresponding adjustment of the requirements. Due to those reasons the EU-Commission saw an urge to “re-sharpen” article 3 of the RED.
The Commission published the Regulation in the EU Official Journal “supplementing Directive 2014/53/EU (…) with regard to the application of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of that Directive.”1
The Radio Equipment Directive may grant the Commission the authority to state via delegated legal acts which “categories or classes of radio equipment” are covered in the range of article 3.
A legal act of that kind is Regulation 2022/30: it determines that “internet-connected radio equipment” is also covered by the requirements.
In a broader sense, e.g., internet-connected machinery may not exert any “harm to the network or its functioning or misuse of network resources”, “support features for ensuring protection from fraud” and guarantee the protection of person-related data.
According to the Commission’s information the Regulation will be effective from the 20th day of publication in the Official Journal of the EU (02/01/2022), from 2025-08-01 all products concerned will need to fulfil the new requirements.2
Harmonised standards for the security requirements
The European Standardisation Organisations (ESO) CEN/CENELEC announced after the publication of Regulation 2022/30 that they would develop relevant standards for these requirements. The joint technical committee JTC13 (Cybersecurity and Data Protection) developed the following standards in response:
According to the website of the publisher CEN/CENELEC, these standards will be ratified on 1 August 2024, after which the final versions will be delivered to the national members for publication. Users will then be able to purchase the respective full texts of the standards from there.
For the listing of the standards in the EU Official Journal in accordance with the Radio Equipment Directive, the standards were evaluated by so-called HAS consultants (experts from the auditing firm EY). However, this evaluation of the three parts by the responsible consultants was negative, instead recommending that the Technical Committee reformulate some parts of the standards. It therefore remains to be seen whether the standards will be published in the EU Official Journal at all or possibly only with restrictions.
If the standards are not listed in the Official Journal of the EU (OJEU) by 1 August 2025 - i.e. there is still no approval from the HAS consultants - the conformity of the radio equipment concerned must be verified by a notified body until it is listed. Such a list of ‘Notified Bodies’ for the Radio Equipment Directive can be found on the website of the EU Commission.
Interested readers can read the full text of the legal act on the portal EUR-LEX.
Footnotes:1The full text of the Radio Equipment Directive can be found in our download area.2The effective date was originally scheduled for 2024-08-01, but has now been postponed by one year. The corresponding publication in the Official Journal of the EU can be found on the EUR-LEX website.
Posted on: 2024-07-23 (last amendment)
Daniel Zacek-Gebele, MSc Product manager at IBF for additional products and data manager for updating standards data on the Safexpert Live Server. Studied economics in Passau (BSc) and Stuttgart (MSc), specialising in International Business and Economics. Email: daniel.zacek-gebele@ibf-solutions.com | www.ibf-solutions.com
You are not yet registered? Register now for the free CE-InfoService and receive information by e-mail when new technical articles, important standards publications or other news from the field of machinery and electrical equipment safety or product compliance are available.
Register
CE software for systematic and professional safety engineering
Practical seminars on aspects of risk assessment and ce-marking
With the CE InfoService you stay informed about important developments in the field of product safety.