Infineon is committed to enabling security for the IoT

Infineon supports and is ready for the delegated articles 3.3 (d), (e), (f) of the Radio Equipment Directive RED (2014/53/EU) by the EU Commission for certain categories of radio equipment to increase the level of cybersecurity, personal data protection and privacy.

The radio equipment directive 2014/53/EU (RED) is a regulatory framework that sets essential requirements for the safety, health and electromagnetic compatibility of radio equipment placed on the EU market.

All radio equipment within the scope of RED delegated articles 3.3 (d), (e), (f) must comply with the new cybersecurity essential requirements when placed on the EU single market after August 1, 2025 (the original date of August 1, 2024 was postponed by the European Union).

The European Commission has officially listed the EN 18031 series in the Official Journal , designating it as the harmonized standard, that helps manufactures demonstrate compliance with the essential cybersecurity requirements of RED.

A researcher at Infineon
A researcher at Infineon
A researcher at Infineon

Radio Equipment Directive (RED)

As the mandatory cybersecurity essential requirements of the Radio Equipment Directive come into force starting from August 1, 2025, manufacturers have a limited timeframe to comply with them.

In this timeframe, manufacturers are required to complete the conformity assessments for RED and get a CE label for their internet connected radio equipment before placing them in the EU market.

There are two key steps that lead to a manufacturer to put the CE label that denotes its compliance to RED’s security essential requirements:

Step 1:  Complete product assessments for RED compliance

To complete product assessments, manufacturers can do either one of the following two options:

The EN 18031 series of harmonized standards adopted by the EU Commission helps manufactures demonstrate compliance with the essential cybersecurity requirements of RED.

  • EN 18031-1: includes security standards for internet-connected radio equipment
  • EN 18031-2: includes security standards for internet-connected toys, childcare equipment and wearables
  • EN 18031-3: includes security standards for devices landing virtual money or digital payments

a) Default Passwords: Devices allowing no passwords or weak passwords (as outlined in Clauses 6.2.5.1 and 6.2.5.2 of the EN 18031 series) do not meet the essential requirements under Articles 3.3 (d), (e), or (f).

For example, if your device allows no passwords being used (Clauses 6.2.5.1 and 6.2.5.2 of all 3 standards of EN 18031 (-1, -2, -3)), it is considered that the device is not compliant with the essential requirements set in the Article 3(3) (d), (e), (f). Manufacturers do not need to undertake a third-party conformity assessment if they choose to disregard the option provided by clauses 6.2.5.1 and 6.2.5.2 to allow users not to set any passwords.

b) Parental or Guardian Controls: Toy and childcare equipment must implement access control mechanisms (as detailed in EN 18031-2, Clauses 6.1.3–6.1.6). Without such mechanisms, these devices are not compliant with Article 3.3 (e)

For example, if your device allows no access control mechanism for toy radio equipment and for childcare radio equipment (Clauses 6.1.3, 6.1.4, 6.1.5, and 6.1.6 of harmonised standard EN 18031-2:2024), it is considered that the device is not compliant with the essential requirements set in the Article 3(3)(e) of the RED. Manufacturers do not need to undertake a third-party conformity assessment if they ensure the implementation of parental or guardian control as outlined in the relevant clauses.

c) Secure Updates for Payment Devices: Devices handling monetary transactions must implement multiple secure update mechanisms (as specified in Clause 6.3.2.4 of EN 18031-3). A single update mechanism is insufficient, and in such cases, a third-party conformity assessment is required.

For example, if your device is handling money or digital transactions and applies only one of four secured update mechanisms (Clause 6.3.2.4 of harmonised standard EN 18031-3:2024), it is considered that none of the methods alone are sufficient for treatment of financial assets and therefore is not enough for the conformity with the essential requirements in Articles 3(3)(f) of the RED. A manufacturer of products covered by harmonised standard EN 18032-3:2024 to which clause 6.3.2.4 applies does not benefit from presumption of conformity regardless of the design of the product and in this case, a third-party conformity assessment is mandatory.

Source: Commission Implementing Decision (EU) 2025/138 of 28 January 2025, OJ L 2025/138.

A manufacturer can use any one of the Notified bodies from the following link: RED notified bodies list. Only those notified bodies that possess specific expertise in cybersecurity matters under the Radio Equipment Directive (RED) are entitled to issue EU-type certificates under conformity procedures in accordance to the RED (Commission Delegated Regulation).

Step 2:  Complete the formalities for declaration of conformity to EU Norms and CE-Marking

After a manufacturer has conducted either a self-assessment or a third-party assessment, they can complete the formalities for declaration of conformity to RED’s delegated articles on security and privacy.

For this, they need to:

  • put together a technical dossier documenting conformity to RED
  • prepare and sign an EU declaration of conformity document.

Once the product bears the CE marking, if a competent national authority requests, the manufacturer must provide all information and documentation on the product’s CE marking for at least 10 years.

RED pic 2
RED pic 2
RED pic 2

Non-compliance with the Radio Equipment Directive (RED) can result in significant risks and consequences for manufacturers, importers, and distributors of radio equipment.

Failure to meet the directive's requirements can lead to corrective measures, and if necessary, product recall or withdrawal, damage to reputation, financial penalties, and loss of the CE marking. (in more serious cases even, criminal penalties).

If a device does not meet all the legal requirements, it will not receive the CE marking, therefore it is not allowed to be placed on the EU market. *

According to the Radio Equipment Directive (2014/53/EU) of 16 April 2014, published in the Official Journal of the European Union (OJ L 153, 22.5.2014, p. 62):

Article 10(11): “Manufacturers who consider or have reason to believe that radio equipment which they have placed on the market is not in conformity with this Directive shall immediately take the corrective measures necessary to bring that radio equipment into conformity, to withdraw it or recall it, if appropriate.”

Article 13(2): “Before making radio equipment available on the market, distributors shall verify that the radio equipment bears the CE marking, that it is accompanied by the documents required by this Directive and by the instructions and safety information in a language…”

Article 46: “Member States shall lay down rules on penalties applicable to infringements by economic operators of the provisions of national law adopted pursuant to this Directive and shall take all measures necessary to ensure that they are enforced. Such rules may include criminal penalties for serious infringements. The penalties provided for shall be effective, proportionate and dissuasive.”

Source: Directive 2014/53/EU (Radio Equipment Directive)

A researcher at Infineon
A researcher at Infineon
A researcher at Infineon

If your radio equipment is connected to the internet directly OR indirectly, it falls under article 3(3) d.

Examples of such devices are: laptops, mobile phones, tablets, IOT device etc.

If your radio equipment is capable of processing personal data, it falls under article 3(3) e.

Examples of such devices are:

a) Any internet connected RE like cameras, speakers, microphones

b) Toys and childcare devices

c) Wearables

If your internet-connected radio equipment enables the holder or user to transfer money, monetary value or virtual currency, it falls under article 3(3) f.

Examples of such devices are: laptops, mobile phones, tablets, IOT device etc.

From August 1, 2025, radio equipment within the scope of the Radio Equipment Directive (RED) must comply with the mandatory cybersecurity requirements when placed on the market

Non-compliance with the Radio Equipment Directive (RED) could result in significant risks and consequences for manufacturers, importers, and distributors of radio equipment such as:

a) Loss of CE Marking and Market Access

b) Corrective measures and if necessary, product recall or withdrawal

c) Financial penalties

d) In more serious cases even criminal penalties

To complete product assessments, manufacturers can do one of the following two options:

1) Perform a self-assessment as per CENELEC EN 18031 standard group

2) Use a RED Notified body from the RED notified bodies list to perform the RED compliance assessments

The EN 18031 series (developed by CENELEC) was adopted by the EU Commission, which makes it a harmonized standard, that can be used demonstrate compliance with the essential cybersecurity requirements of RED.

The EN 18031-1, -2, & -3 harmonized standards come with certain restrictions that in some cases involve a third-party assessment.

The restrictions are following:

A manufacturer can use any one of the Notified bodies from the following link: RED notified bodies list. Only those notified bodies that possess specific expertise in cybersecurity matters under the Radio Equipment Directive (RED) are entitled to issue EU-type certificates under conformity procedures in accordance to EU RED.

After a manufacturer has conducted either a self-assessment or a third-party assessment, they need to:

1) Put together a technical dossier documenting conformity to RED AND prepare and sign an EU declaration of conformity document.

2) Store all information and documentation on the product’s CE marking for at least 10 years.

For this manufacturer should:

1) Determine under which cybersecurity article their product falls and either they can self-assess or need an involvement of a RED notified body

2) Put together a technical dossier documenting conformity to RED

3) Draft and sign an EU declaration of conformity document

Once the product bears the CE marking, if a competent national authority requests, the manufacturer must provide all information and documentation on the product’s CE marking for at least 10 years.

A researcher at Infineon
A researcher at Infineon
A researcher at Infineon

As a device manufacturer, you have two options to comply with the new cybersecurity requirements of the EU Radio Equipment Directive (RED):

a)   Perform a self-assessment as per CENELEC EN 18031 series

b)   Use a RED Notified Body

For a detailed guide on how to become RED compliant, visit our [How to become RED compliant](link to page) section.

Infineon's Support for RED Compliance

At Infineon, we're committed to helping our customers meet the cybersecurity requirements of the RED. By using our wireless System-on-Chip (SoC) products, we can support you in two ways:

1.   Attestation of Conformity for Connected MCU Products:  

We provide an “attestation of conformity” to the EN 18031 standard for our Connected MCU products, confirming that our SoCs have been thoroughly tested and verified to meet the requirements of this standard. This attestation simplifies the process of demonstrating compliance with the RED for your final products.

Learn more about our microcontroller portfolio

2.   Secure System Solutions with Wi-Fi/BT Combo Products:

Our Wi-Fi/BT Combo products can be used in a secured system to support the EU Radio Equipment Directive. To achieve this, our SoCs require pairing with a secure MPU or MCU to ensure compliance with the RED cybersecurity requirements

Learn more about our Wi-Fi and Wi-Fi+Bluetooth combo products

To build security outcomes for you RED device you can choose from the following Infineon security solutions: 

As the mandatory cybersecurity essential requirements of the Radio Equipment Directive come into force starting from August 1, 2025, manufacturers have a limited timeframe to comply with them.

In this timeframe, manufacturers are required to complete the conformity assessments for RED and get a CE label for their internet connected radio equipment before placing them in the EU market.

There are two key steps that lead to a manufacturer to put the CE label that denotes its compliance to RED’s security essential requirements:

Step 1:  Complete product assessments for RED compliance

To complete product assessments, manufacturers can do either one of the following two options:

The EN 18031 series of harmonized standards adopted by the EU Commission helps manufactures demonstrate compliance with the essential cybersecurity requirements of RED.

  • EN 18031-1: includes security standards for internet-connected radio equipment
  • EN 18031-2: includes security standards for internet-connected toys, childcare equipment and wearables
  • EN 18031-3: includes security standards for devices landing virtual money or digital payments

a) Default Passwords: Devices allowing no passwords or weak passwords (as outlined in Clauses 6.2.5.1 and 6.2.5.2 of the EN 18031 series) do not meet the essential requirements under Articles 3.3 (d), (e), or (f).

For example, if your device allows no passwords being used (Clauses 6.2.5.1 and 6.2.5.2 of all 3 standards of EN 18031 (-1, -2, -3)), it is considered that the device is not compliant with the essential requirements set in the Article 3(3) (d), (e), (f). Manufacturers do not need to undertake a third-party conformity assessment if they choose to disregard the option provided by clauses 6.2.5.1 and 6.2.5.2 to allow users not to set any passwords.

b) Parental or Guardian Controls: Toy and childcare equipment must implement access control mechanisms (as detailed in EN 18031-2, Clauses 6.1.3–6.1.6). Without such mechanisms, these devices are not compliant with Article 3.3 (e)

For example, if your device allows no access control mechanism for toy radio equipment and for childcare radio equipment (Clauses 6.1.3, 6.1.4, 6.1.5, and 6.1.6 of harmonised standard EN 18031-2:2024), it is considered that the device is not compliant with the essential requirements set in the Article 3(3)(e) of the RED. Manufacturers do not need to undertake a third-party conformity assessment if they ensure the implementation of parental or guardian control as outlined in the relevant clauses.

c) Secure Updates for Payment Devices: Devices handling monetary transactions must implement multiple secure update mechanisms (as specified in Clause 6.3.2.4 of EN 18031-3). A single update mechanism is insufficient, and in such cases, a third-party conformity assessment is required.

For example, if your device is handling money or digital transactions and applies only one of four secured update mechanisms (Clause 6.3.2.4 of harmonised standard EN 18031-3:2024), it is considered that none of the methods alone are sufficient for treatment of financial assets and therefore is not enough for the conformity with the essential requirements in Articles 3(3)(f) of the RED. A manufacturer of products covered by harmonised standard EN 18032-3:2024 to which clause 6.3.2.4 applies does not benefit from presumption of conformity regardless of the design of the product and in this case, a third-party conformity assessment is mandatory.

Source: Commission Implementing Decision (EU) 2025/138 of 28 January 2025, OJ L 2025/138.

A manufacturer can use any one of the Notified bodies from the following link: RED notified bodies list. Only those notified bodies that possess specific expertise in cybersecurity matters under the Radio Equipment Directive (RED) are entitled to issue EU-type certificates under conformity procedures in accordance to the RED (Commission Delegated Regulation).

Step 2:  Complete the formalities for declaration of conformity to EU Norms and CE-Marking

After a manufacturer has conducted either a self-assessment or a third-party assessment, they can complete the formalities for declaration of conformity to RED’s delegated articles on security and privacy.

For this, they need to:

  • put together a technical dossier documenting conformity to RED
  • prepare and sign an EU declaration of conformity document.

Once the product bears the CE marking, if a competent national authority requests, the manufacturer must provide all information and documentation on the product’s CE marking for at least 10 years.

RED pic 2
RED pic 2
RED pic 2

Non-compliance with the Radio Equipment Directive (RED) can result in significant risks and consequences for manufacturers, importers, and distributors of radio equipment.

Failure to meet the directive's requirements can lead to corrective measures, and if necessary, product recall or withdrawal, damage to reputation, financial penalties, and loss of the CE marking. (in more serious cases even, criminal penalties).

If a device does not meet all the legal requirements, it will not receive the CE marking, therefore it is not allowed to be placed on the EU market. *

According to the Radio Equipment Directive (2014/53/EU) of 16 April 2014, published in the Official Journal of the European Union (OJ L 153, 22.5.2014, p. 62):

Article 10(11): “Manufacturers who consider or have reason to believe that radio equipment which they have placed on the market is not in conformity with this Directive shall immediately take the corrective measures necessary to bring that radio equipment into conformity, to withdraw it or recall it, if appropriate.”

Article 13(2): “Before making radio equipment available on the market, distributors shall verify that the radio equipment bears the CE marking, that it is accompanied by the documents required by this Directive and by the instructions and safety information in a language…”

Article 46: “Member States shall lay down rules on penalties applicable to infringements by economic operators of the provisions of national law adopted pursuant to this Directive and shall take all measures necessary to ensure that they are enforced. Such rules may include criminal penalties for serious infringements. The penalties provided for shall be effective, proportionate and dissuasive.”

Source: Directive 2014/53/EU (Radio Equipment Directive)

A researcher at Infineon
A researcher at Infineon
A researcher at Infineon

If your radio equipment is connected to the internet directly OR indirectly, it falls under article 3(3) d.

Examples of such devices are: laptops, mobile phones, tablets, IOT device etc.

If your radio equipment is capable of processing personal data, it falls under article 3(3) e.

Examples of such devices are:

a) Any internet connected RE like cameras, speakers, microphones

b) Toys and childcare devices

c) Wearables

If your internet-connected radio equipment enables the holder or user to transfer money, monetary value or virtual currency, it falls under article 3(3) f.

Examples of such devices are: laptops, mobile phones, tablets, IOT device etc.

From August 1, 2025, radio equipment within the scope of the Radio Equipment Directive (RED) must comply with the mandatory cybersecurity requirements when placed on the market

Non-compliance with the Radio Equipment Directive (RED) could result in significant risks and consequences for manufacturers, importers, and distributors of radio equipment such as:

a) Loss of CE Marking and Market Access

b) Corrective measures and if necessary, product recall or withdrawal

c) Financial penalties

d) In more serious cases even criminal penalties

To complete product assessments, manufacturers can do one of the following two options:

1) Perform a self-assessment as per CENELEC EN 18031 standard group

2) Use a RED Notified body from the RED notified bodies list to perform the RED compliance assessments

The EN 18031 series (developed by CENELEC) was adopted by the EU Commission, which makes it a harmonized standard, that can be used demonstrate compliance with the essential cybersecurity requirements of RED.

The EN 18031-1, -2, & -3 harmonized standards come with certain restrictions that in some cases involve a third-party assessment.

The restrictions are following:

A manufacturer can use any one of the Notified bodies from the following link: RED notified bodies list. Only those notified bodies that possess specific expertise in cybersecurity matters under the Radio Equipment Directive (RED) are entitled to issue EU-type certificates under conformity procedures in accordance to EU RED.

After a manufacturer has conducted either a self-assessment or a third-party assessment, they need to:

1) Put together a technical dossier documenting conformity to RED AND prepare and sign an EU declaration of conformity document.

2) Store all information and documentation on the product’s CE marking for at least 10 years.

For this manufacturer should:

1) Determine under which cybersecurity article their product falls and either they can self-assess or need an involvement of a RED notified body

2) Put together a technical dossier documenting conformity to RED

3) Draft and sign an EU declaration of conformity document

Once the product bears the CE marking, if a competent national authority requests, the manufacturer must provide all information and documentation on the product’s CE marking for at least 10 years.

A researcher at Infineon
A researcher at Infineon
A researcher at Infineon

As a device manufacturer, you have two options to comply with the new cybersecurity requirements of the EU Radio Equipment Directive (RED):

a)   Perform a self-assessment as per CENELEC EN 18031 series

b)   Use a RED Notified Body

For a detailed guide on how to become RED compliant, visit our [How to become RED compliant](link to page) section.

Infineon's Support for RED Compliance

At Infineon, we're committed to helping our customers meet the cybersecurity requirements of the RED. By using our wireless System-on-Chip (SoC) products, we can support you in two ways:

1.   Attestation of Conformity for Connected MCU Products:  

We provide an “attestation of conformity” to the EN 18031 standard for our Connected MCU products, confirming that our SoCs have been thoroughly tested and verified to meet the requirements of this standard. This attestation simplifies the process of demonstrating compliance with the RED for your final products.

Learn more about our microcontroller portfolio

2.   Secure System Solutions with Wi-Fi/BT Combo Products:

Our Wi-Fi/BT Combo products can be used in a secured system to support the EU Radio Equipment Directive. To achieve this, our SoCs require pairing with a secure MPU or MCU to ensure compliance with the RED cybersecurity requirements

Learn more about our Wi-Fi and Wi-Fi+Bluetooth combo products

To build security outcomes for you RED device you can choose from the following Infineon security solutions: 

Documents

Documents