Cybersecurity

The RED Delegated Act (EU) 2022/30 introduces mandatory cybersecurity requirements for the design and certification of radio equipment in Europe. RED compliance is a prerequisite for CE marking of all in‑scope products. It applies to radio equipment devices that emit or receive radio waves for communication e.g.  Wi-Fi, Bluetooth or LTE, such as telemetry devices.

Key aspects:

• Equipment must be safe for user
• Equipment must avoid harmful interference
• Equipment shall ensure an adequate level of electromagnetic compatibility
• RED DA compliance is now a prerequisite for CE marking starting August 1st, 2025. Without it, a product cannot be legally sold in the EU.

Key requirements:

• Protection of the network or its functioning from harm
• Protection of personal data and privacy of the user
• Protection from fraud 

The Machinery Regulation (EU) 2023/1230 fundamentally transforms how machinery products are developed, certified, and operated in Europe. It introduces stricter requirements for safety and cybersecurity, mandates digital documentation throughout the product lifecycle, and establishes new, more rigorous compliance and conformity assessment procedures. 

Key aspects:

• Make safety and risk management core requirements for all machinery and related products, from initial design through post-market monitoring.
• Requires modern machinery to address new risks related to automation, digitalization, artificial intelligence, and connectivity ensuring machinery is safe even as technologies evolve.
• The new MR compliance is becoming mandatory for CE marking from 2027 forward. Without Machinery Regulation compliance, products cannot be legally placed on the EU market.​
• For the first time, digital instructions for use and documentation are allowed, streamlining information delivery and conformity processes for manufacturers and users alike.

Key requirements:

• Conduct a product risk assessment
• Ensure protection of the health and safety of persons
• Ensure protection against corruption
• Evidence collection of legitimate or illegitimate intervention (connection or software update)
• Provide Software integrity

The Cyber Resilience Act 2024/2847 is an EU rule which sets the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that security is seriously guaranteed throughout a product’s lifecycle.

Key Aspects:

• Make cybersecurity a core requirement for all products with digital elements, from design to post-market.​
• Ensures that digital products are secure by default, reducing risks for consumers and businesses.​
• CRA compliance is now a prerequisite for CE marking starting in 2027. Without CRA compliance, a product cannot be sold in the EU.

Key requirements:

• Integrate Security-by-Design principles throughout the product lifecycle
• Develop secure configuration guidelines for users for update in field
• Fulfill manufacturer obligations like creating Software Bill of Materials (SBOMs)
• Establish security monitoring
• Report vulnerability to legal entity and user over the product life cycle