RED 3.3: the first CE gate that says cybersecurity.
Delegated Regulation (EU) 2022/30 activated Article 3(3)(d), (e) and (f) of the Radio Equipment Directive. Since 1 August 2025, connected radio equipment placed on the EU market must protect the network, personal data and against fraud, as a condition for CE marking.
The succession is formal: Commission Delegated Regulation C(2026) 778 repeals the Article 3(3)(d), (e) and (f) activation when the CRA applies in full on 11 December 2027.
What it demands
Who must care
Manufacturers of internet-connected radio equipment. That means consumer devices, but just as much the industrial kind: wireless sensors, gateways, modems in the field. Out of scope where an equivalent sector regime exists, notably medical devices and type-approved vehicles.
One care point: the EN 18031 listing carries restrictions (Implementing Decision (EU) 2025/138), around default passwords among others. Applying the standard "in full" needs attention; where you can’t, a notified body enters the picture.
Where OT comes in
Your plant fills with radio equipment one gateway at a time, and each one carries a Declaration of Conformity somebody signed. Ask suppliers for the basis: EN 18031 applied fully, or a notified-body route. In OT vocabulary, IEC 62443-4-2 covers the same component capabilities.
How OTRISK helps
Questions we hear
Is EN 18031 mandatory?
No. It is the harmonised route to presumption of conformity. The essential requirements are what is mandatory; the standard is the easiest way to show them.
What happens when the CRA applies?
From 11 December 2027 the CRA covers this ground for products with digital elements, radio or not. Files built on 18031 and 4-2 evidence carry over largely intact.
We only buy equipment.
Then read this page as a procurement checklist: ask for the DoC and its basis before the device ships, and file the answer as evidence.
From standard to signed-off.
Bring one installation in mind. In thirty minutes we show you which parts of OTRISK fit your situation and how the way of working looks. You leave with concrete next steps and pricing.