Commission Delegated Regulation (EU) 2026/339 repeals Commission Delegated Regulation (EU) 2022/30 with effect from 11 December 2027. It preserves RED market surveillance and conformity control for covered radio equipment placed on the Union market between 1 August 2025 and 10 December 2027 that was subject to the relevant requirements.
The repeal date and transition boundary
The European Commission adopted Commission Delegated Regulation (EU) 2026/339 on 16 February 2026. It was published in the Official Journal on 29 April 2026 and repeals Commission Delegated Regulation (EU) 2022/30 with effect from 11 December 2027. The repeal regulation itself entered into force on the twentieth day after publication.
Until 10 December 2027, Commission Delegated Regulation (EU) 2022/30 remains applicable. From 11 December 2027, the Cyber Resilience Act's general application rules apply to products with digital elements that fall within its scope.
Why the Commission is repealing the delegated act
Recital 3 of Commission Delegated Regulation (EU) 2026/339 states that the essential cybersecurity requirements in Annex I to the Cyber Resilience Act include all elements of the requirements in Article 3(3)(d), (e) and (f) of the Radio Equipment Directive.
Recital 4 explains that repeal is intended to provide legal certainty and avoid radio equipment being subject to cybersecurity requirements under both regimes at the same time. The repeal is therefore aligned with the Cyber Resilience Act's general application date.
What applies until 11 December 2027
For the categories and classes of radio equipment covered by Commission Delegated Regulation (EU) 2022/30, the following requirements in Article 3(3) of the Radio Equipment Directive continue to apply:
- Point (d) concerns protection of networks and their functioning from harm, and protection against misuse of network resources.
- Point (e) concerns the protection of personal data and privacy of users and subscribers.
- Point (f) concerns protection against fraud.
The references of EN 18031-1:2024, EN 18031-2:2024 and EN 18031-3:2024 were published in the Official Journal with restrictions. Where a harmonised standard covers the relevant requirement and the published restrictions are observed, its use can create a presumption of conformity. Use of harmonised standards remains voluntary and does not replace the manufacturer's responsibility for conformity assessment. See Commission Implementing Decision (EU) 2025/138.
Recital 5 of Commission Delegated Regulation (EU) 2026/339 preserves market surveillance and conformity control under the Radio Equipment Directive for covered radio equipment placed on the Union market between 1 August 2025 and 10 December 2027 and subject to the requirements concerned. The repeal does not remove that assessment basis retrospectively for those products.
What applies from 11 December 2027
The Cyber Resilience Act generally applies from 11 December 2027. For radio equipment with digital elements, the applicable requirements must then be assessed against the Act's scope and transitional provisions.
Annex I to the Cyber Resilience Act contains essential cybersecurity requirements for products and requirements for vulnerability handling. Harmonised standards may create a presumption of conformity where their references are published in the Official Journal and they cover the requirement concerned. A draft or a standardisation request alone does not create that presumption.
Practical implications for manufacturers
Work undertaken under the Radio Equipment Directive remains relevant until the repeal takes effect. Manufacturers should, however, keep separate records of the legal act, product version, date of placing on the market and published standard reference supporting each assessment.
Existing risk assessments, authentication designs, vulnerability processes and technical evidence may be useful inputs to Cyber Resilience Act preparation. Their reuse alone does not demonstrate conformity with the Cyber Resilience Act. Evidence must be assessed against its actual requirements, the specific product status and the harmonised standards applicable at the time.
Questions and answers
Do the cybersecurity requirements for radio equipment disappear
No. Commission Delegated Regulation (EU) 2022/30 remains applicable until 10 December 2027. From 11 December 2027, the Cyber Resilience Act is the relevant framework for products within its scope. The treatment of a particular product depends, among other matters, on its scope and the applicable transitional provisions.
What happens to radio equipment already placed on the market
Under recital 5, repeal does not affect market surveillance and conformity control under the Radio Equipment Directive for covered radio equipment placed on the Union market between 1 August 2025 and 10 December 2027 that was subject to the requirements concerned.
Must every product be reassessed after 11 December 2027
Not automatically. Article 69 of the Cyber Resilience Act contains transitional provisions for products with digital elements placed on the market before 11 December 2027. The assessment depends on the product, its placing-on-the-market date and any substantial modification.
What is the role of EN 18031
The three parts of EN 18031 are harmonised under the Radio Equipment Directive with expressly published restrictions. Their use is voluntary. A presumption of conformity arises only for the requirements covered and subject to the restrictions published in the Official Journal.
Which standards will apply under the Cyber Resilience Act
European standardisation organisations are developing standards under standardisation request M/606. Only references to harmonised standards published in the Official Journal can create a presumption of conformity for the requirements they cover. Manufacturers should distinguish between working drafts, published standards and harmonised standards referenced in the Official Journal. The European Commission's CRA standardisation information describes the current work.
Transition checklist
- Confirm whether the radio equipment is covered by Commission Delegated Regulation (EU) 2022/30 before the repeal takes effect.
- Record the product version and the date it was placed on the Union market.
- Keep evidence of the relevant Article 3(3)(d), (e) and (f) requirements separate from future Cyber Resilience Act evidence.
- Where EN 18031 is used, check the relevant covered requirement and the published restrictions.
- Assess Cyber Resilience Act scope and transitional provisions for products with digital elements.
- Treat existing RED evidence as input to later work, not as proof of Cyber Resilience Act conformity.