BCTC: Radio Equipment Directive (RED) Cybersecurity Requirements EN18031

In January 2022, the European Commission updated the Radio Equipment Directive (RED) to include additional legislations related to security 2022/30/EU.

COMMISSION DELEGATED REGULATION (EU) 2022/30 of 29 October 2021

supplementing Directive 2014/53/EU of the European Parliament and of the Council with regard to the application of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of that Directive

1. The essential requirement set out in Article 3(3), point (d), of Directive 2014/53/EU shall apply to any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment (‘internet-connected radio equipment’).

2. The essential requirement set out in Article 3(3), point (e), of Directive 2014/53/EU shall apply to any of the following radio equipment, if that radio equipment is capable of processing, within the meaning of Article 4(2) of Regulation (EU) 2016/679, personal data, as defined in Article 4(1) of Regulation (EU) 2016/679, or traffic data and location data, as defined in Article 2, points (b) and (c), of Directive 2002/58/EC:

(a)internet-connected radio equipment, other than the equipment referred to in points (b), (c) or (d);

(b)radio equipment designed or intended exclusively for childcare;

(c)radio equipment covered by Directive 2009/48/EC;

(d)radio equipment designed or intended, whether exclusively or not exclusively, to be worn on, strapped to, or hung from any of the following:

(i)any part of the human body, including the head, neck, trunk, arms, hands, legs and feet;

(ii)any clothing, including headwear, hand wear and footwear, which is worn by human beings.

3. The essential requirement set out in Article 3(3), point (f), of Directive 2014/53/EU shall apply to any internet-connected radio equipment, if that equipment enables the holder or user to transfer money, monetary value or virtual currency as defined in Article 2, point (d), of Directive (EU) 2019/713.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 1 August 2024.