EU CE Certification RED Cybersecurity Directive

CE RED Directive - Cybersecurity

In January 2022, the European Union officially issued Delegated Regulation (EU) 2022/30, mandating the enforcement of RED Directive Articles 3.3.d/e/f for relevant products.

Mandatory Implementation Date: August 1, 2025

Products covered include, but are not limited to:

• Laptops: Laptops connect to the internet via Wi-Fi, enabling web browsing and other functionalities.

• Smartphones: Smartphones connect to the internet via mobile networks or Wi-Fi, allowing calls, web browsing, and app usage.

• Smart TVs: Internet-connected televisions that can stream videos, browse online content, and support applications and smart features.

• Smart Cameras & Surveillance Systems: Internet-connected cameras used for home security monitoring or other purposes.

• Smart Wearables: Devices such as smartwatches and fitness trackers that transmit health and activity data via the internet.

• Smart Home Devices: Including smart lighting, smart plugs, and smart thermostats, which can be controlled remotely via the internet.

• Smart Refrigerators: Internet-connected refrigerators that help users manage food inventory, access recipes, etc.

• Smart Security Systems: Including smart locks and alarm systems that enable remote monitoring and control via the internet.

• Smart Kitchen Appliances: Examples include smart coffee machines and ovens that can be controlled remotely via the internet.

• Bluetooth Headphones: Capable of accessing contacts or location information.

• POS Machines: Devices that support payment functionality.

In May 2024, the EU officially released the final draft of the en 18031 cybersecurity standard series and widely solicited opinions from member states. The standard was officially approved on August 1, 2024.

However, the EN 18031 standard series must still receive final approval from the EU and be incorporated into the Official Journal of the European Union (OJ) before it can formally become a harmonized standard that meets RED Directive requirements.

Testing Process

Test Samples: 2 complete devices + 3 PCBs

Testing Duration: 12 weeks

Key Notes:

Note 1: If document review and rectification take longer than expected, the certification timeline will be extended. It is recommended to allow extra time for rectification.

Note 2: Over 80% of products currently on the market will require rectification, so it is advisable to allocate time for this within the certification process, ideally starting six months to a year in advance.

Note 3: Since different products have varying testing requirements and design schemes, it is recommended to conduct a preliminary test for each product category. Understanding the specific requirements beforehand will help integrate them into product development, minimizing extensive rectifications during certification.

1. Which products need to comply?

• New models that have not been shipped before and are scheduled for shipment after the mandatory implementation date (2025-08-01) must complete testing and obtain certification.

• Existing models that have already been shipped and will continue to be shipped after the mandatory implementation date (2025-08-01) must complete testing and obtain certification.

• Existing models that have already been shipped and will no longer be sold in the EU market after the mandatory implementation date (2025-08-01) do not need to undergo new testing or certification.

2. If a product has already undergone EN 303 645 testing, does it still need to comply with RED 3.3d/e/f?

• Products that have been tested under EN 303 645 must undergo additional differential testing under EN 18031 and obtain an NB certificate to meet compliance requirements.

3. How is certification for RED 3.3d/e/f issued?

• Upon completion of testing, a test report is submitted to the NB body for certification. A standalone RED 3.3d/e/f certificate can be issued, or it can be combined with existing EMC/Safety/RF certifications.