Radio Equipment Directive certification for the EU market

Radio Equipment Directive certification is, for most products, a declaration you sign yourself: test against the harmonised standards listed for Directive 2014/53/EU, compile the Annex V technical documentation, sign the EU declaration of conformity and affix the CE mark. A Notified Body becomes unavoidable only for a requirement where you have not applied a harmonised standard in full (Article 17(4)). Anything that intentionally emits or receives radio waves is radio equipment, so a machine with a Wi-Fi module, a Bluetooth sensor, an RFID reader and a product built around a pre-certified module all fall in, and the directive then takes over electrical safety and EMC with no lower voltage limit. Since 1 August 2025 the Article 3(3) cybersecurity requirements apply to internet-connected equipment, and that evidence is where files stall.

Is your product radio equipment under RED 2014/53/EU?

Yes if it intentionally emits or receives radio waves for communication or radiodetermination, or needs only an antenna to do so. Article 2(1) of Directive 2014/53/EU draws the line there, and recital 8 of Delegated Regulation (EU) 2022/30 spells out that the directive makes no distinction between the radio and the non-radio functions of the equipment. Wi-Fi, Bluetooth, cellular, RFID and a radar sensor all qualify. A product built around a certified module is radio equipment in its own right.

Once inside, Article 1(4) takes the product out of the Low Voltage Directive and Article 3(1)(a) brings the safety objectives back with no voltage limit, next to EMC under Article 3(1)(b) and spectrum use under Article 3(2). Annex I keeps out only amateur, marine and airborne equipment and evaluation kits for research.

The pattern we see most is a 24 V industrial controller with a Bluetooth interface added late. Below the LVD threshold, so nobody planned EU safety work. Under RED the 24 V limit does not exist. The multi-market picture, ANATEL, FCC, ISED and the EAEU notification next to RED, is on the telecom type approval page; products without a radio go under the EMC Directive and the Low Voltage Directive instead.

Which conformity route does RED give you?

Three modules exist, and the harmonised standards decide which you may use. Module A (Annex II) is self-declaration. Modules B and C (Annex III) put an EU-type examination certificate from a Notified Body in front of your own production control. Module H (Annex IV) is full quality assurance, the only route where the body's number follows the CE mark (Article 20(3)). For safety and EMC under Article 3(1) you choose freely.

For spectrum and every Article 3(3) requirement, Article 17(3) gives you that choice only if you applied the standards published in the Official Journal in full. Apply one in part, or find that none exists, and Article 17(4) leaves B plus C or H, both through a Notified Body (RED offers no self-declared way round it).

Partial application is the trap. A report that says "tested to EN 300 328 with deviations" is a partial application, and that one deviation puts spectrum use into Article 17(4) while everything else self-declares. Read the report before you accept it. Timeline: six to fourteen weeks when every standard applies in full and the lab has a slot; three to six months with a Notified Body, because the body reads the whole file and asks for what is missing.

What do the RED cybersecurity requirements and the common charger add?

Delegated Regulation (EU) 2022/30 switched on Article 3(3)(d), (e) and (f) from 1 August 2025. Point (d), no harm to the network, applies to any equipment that can itself communicate over the internet, directly or through another device. Point (e), personal data and privacy, applies to internet-connected equipment and, even offline, to childcare equipment, toys and wearables that process personal, traffic or location data. Point (f), protection from fraud, applies to internet-connected equipment that can transfer money or virtual currency. Medical devices are outside all three.

The harmonised standards are EN 18031-1, -2 and -3:2024, listed by Implementing Decision (EU) 2025/138 of 28 January 2025 with restrictions that decide whether you can self-declare. None of the three confers presumption of conformity if the user may choose not to set a password (clauses 6.2.5.1 and 6.2.5.2). EN 18031-2 confers none for toys and childcare equipment without parental access control, and EN 18031-3 confers none for its secure-update criteria in clause 6.3.2.4, so a payment-capable device goes to a Notified Body for point (f) whatever else it does. Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027, when the Cyber Resilience Act applies in full.

Cybersecurity evidence is the new blocker. Radio and EMC are lab measurements; the EN 18031 assessment asks for a threat analysis, a password and update policy, and a description of what the device stores and who can reach it. A module vendor's EN 18031 report covers the module's own interfaces, so a host that adds a web interface or a cloud link starts from zero. RED compliance is now decided here more often than at the antenna.

The common charger came earlier. Directive (EU) 2022/2380 added Annex Ia: from 28 December 2024 phones, tablets, cameras, headsets, earbuds, portable speakers, e-readers, keyboards and mice, twelve categories in all, charge through a USB Type-C receptacle to EN IEC 62680-1-3:2021; laptops follow from 28 April 2026. The product must be offered without a charger, with the Annex Ia pictogram on the packaging. Module A covers it.

What goes in the technical file, the DoC and on the label?

Annex V lists the minimum: photographs of the outside, the markings and the internal layout; the software and firmware versions that affect compliance; drawings and schematics; the harmonised standards applied in full or in part, naming the parts where partial; test reports; a copy of the DoC and of any EU-type examination certificate. The file is kept updated (Article 21(2)) and held, with the DoC, for ten years (Article 10(4)).

The EU declaration of conformity follows Annex VI: one declaration for every Union act the product falls under (Article 18(3)), each standard cited by number and version, and item 8 naming the accessories and software, antenna included, that it covers. Each unit ships with a copy or with the one-sentence simplified declaration of Annex VII and the internet address of the full text (Article 10(9)).

On the product: CE on the equipment or its data plate and on the packaging (Article 20(1)), allowed under 5 mm where the housing forces it (Article 19(2)); the manufacturer's name and one postal address; a type, batch or serial number. In the instructions: the frequency bands used and the maximum radio-frequency power in each (Article 10(8)). Where a member state restricts use, the packaging must name it (Article 10(10)), in the form set by Implementing Regulation (EU) 2017/1354.

Antenna and firmware changes reopen the assessment. Article 17(1) demands conformity in every configuration the equipment can take, and Article 10(5) makes design changes yours to account for: a different antenna gain or a firmware build that alters the power table changes the Article 3(2) result, and a file listing the old firmware version is out of date the day the build ships. The module certificate does not survive that either. It names the antenna and conditions of use it was tested with, and the host inherits the module's spectrum result only while it keeps them.

RED 2014/53/EU, requirement by requirement

Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027 by Delegated Regulation (EU) 2026/339, when the Cyber Resilience Act applies in full. Equipment placed on the market before that date stays under RED market surveillance.