RED Article 3(3) has applied to radio equipment since 1 August 2025. Most teams counting down to the CRA never noticed it, and it is already enforceable.

---

The short answer

Radio Equipment Directive Article 3(3), points (d), (e) and (f), has been applicable since 1 August 2025.

It is not upcoming. It is not proposed. It is a year old, and it is enforced by the same market surveillance authorities that will enforce the Cyber Resilience Act.

Most engineering teams we speak to are planning around September 2026 — CRA Article 14. They are planning around a deadline that has not arrived while standing past one that has.

---

What Article 3(3) actually requires

It was activated by Delegated Regulation (EU) 2022/30, which switched on three requirements for radio equipment placed on the EU market:

3(3)(d)   network protection — the device must not harm the network
3(3)(e)   personal data and privacy safeguards
3(3)(f)   protection against fraud

"Radio equipment" is far broader than the phrase suggests. Anything that transmits or receives radio waves intentionally: Wi-Fi, Bluetooth, cellular, LoRa, Zigbee, NFC in most implementations. A sensor, a thermostat, a wearable, a car, an industrial gateway — all radio equipment.

If your product connects wirelessly and is sold in the EU, this reached you a year ago.

---

Why so many teams missed it

Three reasons, and they compound.

The date moved. The original application date was August 2024. It was postponed to 1 August 2025 by Delegated Regulation (EU) 2023/2444. Teams that noted the first date and heard "postponed" often never recorded the second.

The standards arrived late and imperfect. The harmonised standards EN 18031-1, -2 and -3 were cited in the Official Journal with restrictions — meaning that for parts of them, the presumption of conformity does not apply. A manufacturer relying on them still has work to do.

It is a Directive, not a Regulation. It arrives through national law rather than directly, which makes it quieter — and easier to miss for teams tracking EU-level texts.

---

What "with restrictions" means for you

This is the part that costs the most and is understood the least.

A harmonised standard normally gives you presumption of conformity: follow it, and you are presumed to meet the legal requirement. The restrictions on EN 18031 remove that presumption for specific clauses — typically those where the standard permits a default that the Directive does not accept.

The practical consequence: applying the standard end to end is not automatically sufficient. You have to know which clauses are restricted, and demonstrate conformity for those by another route.

A team that ticked "we follow EN 18031" and moved on has not necessarily closed the requirement.

---

What it means that this is already enforceable

Market surveillance authorities can act now. Not from a future date — from twelve months ago.

non-compliant radio equipment    ->  restriction, withdrawal or recall
                                     from the EU market

There is no grace period left to plan inside. The question is no longer when to start; it is what you can show if asked today.

---

The connection to the CRA that most teams miss

RED 3(3) and the CRA overlap heavily on substance — secure defaults, protection of data, resilience against interference. They are not the same instrument, and one does not discharge the other.

But the evidence largely transfers. A risk assessment, a secure-by-default configuration record, a vulnerability handling process built for RED 3(3) is most of what CRA Annex I asks for.

Which reverses the usual reading. A team that treated RED 3(3) seriously last year is not behind on the CRA — it is ahead, and does not know it. A team that skipped it now has both to do, on the tighter of the two clocks.

---

What to do this week

1Determine whether your product is radio equipment. If it transmits or receives intentionally, assume yes until you have written down why not.
2Check your EN 18031 reliance against the published restrictions. "We follow the standard" is not a conclusion.
3Write down the determination and date it. A dated assessment from today is worth more than an undated one claimed from last year.
4Map what you already have to CRA Annex I. Most of the work counts twice.

---

Check which deadlines have already reached you — free, no account

[Free readiness assessment](/assess) — which of the five EU regulations apply to you, and from when
[Penalty calculator](/resources/penalty-calculator) — exposure on your own turnover

---

The EU Cyber Deadline That Already Passed — RED 3(3)