From RED to CRA, cybersecurity in practice

For radio products, cybersecurity is already part of CE marking. Since 1 August 2025, every radio product placed on the EU market has to meet the cybersecurity requirements of the RED, usually by applying the harmonised standard EN 18031. This also applies to existing designs that are still being sold.

The roles are the same as for any other CE topic. As the manufacturer, you steer and decide. We contribute our expertise in the implementation. Two examples from practice show what this looks like.

How do we approach cybersecurity for our customers?

Case study 1: deciding what applies and closing the gaps

A customer came to us with a clear ambition: their Wi-Fi product had to comply with the RED cybersecurity requirements.

The first step was a risk assessment to determine which of the articles 3.3(d), (e) and (f) apply. We provided all the technical information on the product for this assessment. The well-founded conclusion was that only article 3.3(d), protection of the network, applies. That meant the rest of the project could focus on EN 18031-1.

We then went through the standard with the customer, requirement by requirement, to see where the product already complied and what was still missing. We closed the gaps in the product and provided the technical input for the documentation. The dossier is currently being assessed by an independent notified body.

Case study 2: the customer leads, we deliver

A manufacturer of industrial products managed the compliance process themselves and involved an independent assessor at an early stage.

We supplied all the technical information on how security was implemented in the product. Based on the assessor's findings, we then strengthened the product's security further. Good communication between the customer, the assessor and our engineers kept the project on track.

Technical building blocks

Whichever route a customer chooses, the technical basis is often the same. Typical building blocks we implement and document are:

• Secure boot: the device only starts firmware that is verifiably genuine.
• Secure updates: only authorised, verified firmware can be installed.
• Protected flash memory: firmware and sensitive data are protected against reading and tampering.
• Dependency check: third-party software components are checked for known vulnerabilities.

A head start for the CRA

With RED requirements now in force, companies that have already completed EN 18031-based risk assessments, implemented security controls and established the necessary documentation are not starting from zero when preparing for the CRA.

As the draft CRA product standard (prEN 40000-1-4) is largely based on EN 18031, much of this work can be reused and extended towards CRA compliance in December 2027.

What we have learned

• Start with the right question. A well-founded risk assessment determines which requirements apply and avoids unnecessary work.
• You steer, we implement. You know the product and how it is used. We know the electronics and firmware. Together we close the gaps quickly.
• Involve external experts early. Many parties can help you set up the required policies and processes and assess your product. Findings are easier to deal with during development than just before launch. For SMEs, the SECURE funding call can help cover part of the cost.
• Willingness makes the difference. In every project, the customer's proactive attitude was what made it work.

>>> That is why we encourage companies not to wait until 2027, but to start assessing today how cybersecurity requirements will impact their products.

Ready for the next step?

Whether you are currently working on RED compliance or preparing for the Cyber Resilience Act, an initial analysis of your product portfolio is often the most valuable first step.

Together, we identify which requirements apply, which risks need attention, and which technical measures are required to make your products future-proof.

>>> Call our cybersecurity team on +32 3 620 18 18 or send us an e-mail.

Additional information

• In our whitepaper "The rules are changing – 'REDy' or not?" (May 2025), we took a closer look at cybersecurity requirements for radio products under the RED Directive. Download you copy using the button below.
   
• In the whitepaper "CRA: Software Compliance on the Rise, First Steps Toward 2027" (April 2026), we looked ahead to the Cyber Resilience Act. Download your copy using the button below.