normakte  /  CRA and radio equipment

Radio equipment: cybersecurity already today, the CRA comes on top

Products with Wi-Fi, Bluetooth or cellular connectivity are already subject to cybersecurity requirements. From December 2027 the CRA applies as well.

What applies today

Delegated Regulation (EU) 2022/30 makes requirements of the Radio Equipment Directive 2014/53/EU on network protection, data protection and fraud protection mandatory for internet-connected radio equipment since 1 August 2025. The harmonised standards for this are the EN 18031 series.

What is added from December 2027

The CRA is broader: it also requires vulnerability handling, an SBOM, a support period, security updates and reporting. The reporting obligations have already applied since September 2026.

What it means in practice

Keep EN 18031 evidence so that it can be reused for the CRA, and map the requirements of both acts in one file. The declaration of conformity names all applicable acts.

Directive 2014/53/EUReg. (EU) 2022/30Annex I CRA

The CRA file for your product

Register with all CRA requirements, classification, SBOM, reports with deadlines, support period and a target page for user information – one trial file free until 20.01.2027.

Create a trial fileCalculate reporting deadlines

Read next

CRA for smart home and IoTCRACRA for routers and networksCRACRA declaration generatorCRACRA for digital productsCRAImportant and critical productsCRADeclaration and documentationCRA

Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.