Since 1 August 2025, additional requirements from the Radio Equipment Directive (RED) have applied to internet-connected radio equipment: among others, network protection, protection of personal data and protection against fraud. The EN 18031 series serves as the harmonised standards.
The Cyber Resilience Act (EU) 2024/2847 goes further: it covers products with digital elements — from smart hardware to software. Since September 2026 manufacturers must report actively exploited vulnerabilities and severe security incidents; from December 2027 the full requirements apply.
These include secure default settings, security updates over a defined support period and documentation of software components. For IoT products it pays to plan these requirements into development now.
General information without guarantee — does not replace legal advice in the individual case.