RED Directive testing
Compliance with the Radio Equipment Directive (RED)
Are you launching a product on the European market with a wireless radio connection? Since August 2025, it must comply with the Delegated Act of the Radio Equipment Directive (RED Directive). That was determined by the European Commission. The RED Directive contains various cybersecurity requirements that manufacturers, importers and distributors must meet to market their wireless devices in the European Union (EU). DEKRA is happy to help your products comply with these regulations. Read more about the legislation and how our services can help you with compliance.
What is the RED Directive?
The RED Directive stands for Radio Equipment Directive. It is a European directive that sets requirements for radio equipment placed on the European market. The RED Directive applies, for example, to products with Wi-Fi, Bluetooth, NFC, or other wireless communication technologies. Among other things, the directive sets requirements for safety, electromagnetic compatibility (EMC), and the efficient use of the radio spectrum.
What is the purpose of the RED Directive?
The purpose of the RED Directive is to better protect devices in the EU against cyber risks. The directive is also intended to increase consumer confidence in these devices. This will better protect Europe against cyberattacks. The new requirements focus on:
- improving network resilience (Article 3(3)(d));
- increasing users' personal data and privacy protection (Article 3(3)(e));
- reducing monetary fraud (Article 3(3)(f)).
These new cybersecurity requirements apply to all products with a radio connection, such as 4G, 5G, Bluetooth, Zigbee and WiFi. This includes a variety of products, including mobile phones, tablets, smart watches, smart TVs, connected streetlights, wireless sensors, charging stations, connected cars, drones, vending machines and much more.
The standards EN 18031-1, EN 18031-2, and EN 18031-3 have been developed to address the cybersecurity requirements under the RED. Each standard corresponds to a specific requirement in Article 3(3) of the RED:
- EN 18031-1: network protection (Article 3(3)(d));
- EN 18031-2: protection of personal data and privacy (Article 3(3)(e));
- EN 18031-3: protection against financial fraud (Article 3(3)(f)).
RED Directive is mandatory
The European committee CEN-CENELEC has developed harmonized standards based on the requirements of the RED Directive for the EU. These standards allow you to demonstrate that your products comply with the testing requirements for wireless products under the RED Directive, which is now mandatory.
The EN 18031 standards were harmonized in January 2025, subject to certain limitations. As a result, in certain cases, manufacturers can demonstrate through self-assessment that their product meets the RED requirements and issue an EU Declaration of Conformity.
Does a product fall under one of the limitations of the harmonized standards? If so, the involvement of a Notified Body may be necessary to demonstrate conformity.
Our RED testing services
At DEKRA, we test your product according to technical requirements defined in existing cybersecurity standards. These standards are the basis for the harmonized standards for the RED Delegated Act, such as:
- ETSI EN 303 645
- IEC 62443-X series
Does your product meet the cybersecurity requirements? Then you will receive a test report with an accompanying certificate for this compliance. With the IEC 62443 it is possible to obtain an IECEE-CB certificate. This shows you the security level.
Since August 1, 2025, the European Union’s Radio Equipment Directive Delegated Act (RED-DA) has come into effect. This regulation introduces stricter cybersecurity requirements for wireless equipment. Manufacturers must demonstrate that their products comply with the new requirements based on the EN 18031 standards.
To support this process, DEKRA offers a structured three-step approach toward RED-DA compliance:
Step 1: pre-evaluation – GAP analysis
We begin with a thorough GAP analysis. You provide an Implementation eXtra Information for Testing (IXIT) file describing the software implementation of your product. Based on this, DEKRA assesses the degree of compliance with EN 18031, including references to specific clauses within the standard. This gives you clear insights into areas for improvement.
Step 2: product evaluation
Next, DEKRA conducts an in-depth evaluation of your product in accordance with EN 18031. Using the IXIT file, we perform penetration testing to verify that the implementation aligns with the documented specifications. The results are documented in a detailed test report that can be used for self-declaration.
Step 3: EU-type examination and certification
As a designated Notified Body, DEKRA can issue an EU-Type Examination Certificate. This certificate serves as strong evidence of compliance and supports the CE marking process for products covered by the RED-DA.
Why DEKRA?
We are an independent certification body and laboratory accredited under ISO/IEC 17025 to test and certify the cybersecurity of products in accordance with ETSI EN 303 645 and the IEC 62443-X series. In addition, DEKRA is an EU Notified Body for the Radio Equipment Directive and is recognized for radio and telecommunications testing under the IECEE's CB scheme. Therefore, we can support you in complying with the requirements of the Radio Equipment Directive in conjunction with other regulations and standards applicable to radio equipment and devices.