CE, RED Cybersecurity, CRA and FCC: Market Access for Connected Devices (2026)

Dates were checked against EUR-Lex, the European Commission and the FCC in September 2026 (sources at the end). This page is general engineering guidance, not legal advice; confirm scope for your product with a notified body or test lab.

The practical message for a product launching in 2026–2027: design once to the stricter CRA requirements, and use EN 18031 to demonstrate RED compliance until December 2027. Our blog post on the Cyber Resilience Act for IoT goes deeper into the CRA roadmap.

Any product that intentionally transmits or receives radio waves falls under the Radio Equipment Directive rather than the separate EMC and Low Voltage Directives. Its essential requirements map to test standards like this for a typical Bluetooth or Wi-Fi product:

If you apply harmonised standards in full, you can use internal production control (Module A): test, compile a technical file, sign the EU declaration of conformity and affix the CE mark. Other EU laws usually apply in parallel: RoHS, WEEE, REACH, the Batteries Regulation, and — for chargers and many small devices — the common charger rules that made USB-C mandatory from 28 December 2024.

Delegated Regulation (EU) 2022/30 activated three RED essential requirements from 1 August 2025. They apply to:

• Radio equipment that can communicate over the internet, directly or through another device (EN 18031-1).
• Radio equipment that processes personal, traffic or location data — including internet-connected devices, toys, childcare equipment and wearables (EN 18031-2).
• Internet-connected radio equipment that enables the transfer of money, monetary value or virtual currency (EN 18031-3).

The EN 18031 standards were cited in the Official Journal on 28 January 2025 with restrictions. The most consequential for product teams: if the user can choose not to set a password (or keep a default one), the standard does not give a presumption of conformity for that product, and the manufacturer must use a notified body (Implementing Decision (EU) 2025/138). Similar restrictions apply to parental controls for toys and childcare products and to some update mechanisms under EN 18031-3.

What the standards look for in practice

• No universal default passwords; unique per-device credentials or a forced change at first use.
• Secure update mechanism: authenticated, integrity-checked firmware updates with rollback protection.
• Protection of stored secrets and personal data (secure element or protected storage, encryption at rest where relevant).
• Secure communication: current TLS or equivalent, no unauthenticated remote interfaces.
• Minimised attack surface: debug ports (JTAG/SWD, UART consoles) locked or disabled in production.
• Logging, resilience to denial of service and documented access control.

The Cyber Resilience Act applies to “products with digital elements” — hardware and software, wired or wireless — placed on the EU market. Compared with the RED delegated regulation it adds lifecycle duties:

• Meet the Annex I essential cybersecurity requirements by design, based on a documented risk assessment.
• Handle vulnerabilities: a disclosure policy, a contact point, and security updates delivered free of charge for a declared support period (at least five years unless the product’s expected use is shorter).
• Include a software bill of materials (SBOM) in the technical documentation.
• From 11 September 2026, report actively exploited vulnerabilities and severe incidents through the single reporting platform: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report later.
• Use the conformity assessment route for the product’s class: most products can self-assess; ‘important’ products (Annex III — for example routers, smart-home security products such as door locks, cameras and baby monitors, and certain health-monitoring wearables) need harmonised standards or third-party assessment; ‘critical’ products follow stricter routes.

The reporting obligation applies to products already on the market, so a manufacturer shipping connected devices into the EU needs a working vulnerability-intake and reporting process now, not in 2027 (European Commission).

In the US, the Federal Communications Commission regulates radio-frequency devices under 47 CFR Part 15:

• Intentional radiators (Bluetooth, Wi-Fi, LoRa, cellular) need Certification: testing at an FCC-recognised lab, then a grant from a Telecommunication Certification Body (TCB), which produces the FCC ID (grantee code plus product code).
• Unintentional radiators (any digital device) use Supplier’s Declaration of Conformity (SDoC) to the Part 15 Subpart B Class A (business) or Class B (residential) limits.
• Modular approval: integrating a module that holds its own grant avoids re-certifying the transmitter if you follow the grant conditions (approved antennas, integration instructions). The host still needs Subpart B compliance and a “Contains FCC ID” label.
• RF exposure: body-worn and handheld devices must meet the exposure limits in 47 CFR 1.1310 or qualify for an exemption; this can require SAR evaluation.
• Covered List: the FCC does not authorize equipment on its Covered List. On 22 December 2025 it added foreign-produced uncrewed aircraft systems and UAS critical components — check module and component vendors against the list early.

Canada’s ISED requirements (RSS-Gen, RSS-247 and others) are usually tested in the same lab session as FCC.

IEC 62368-1 (edition 4, 2023) is the hazard-based safety standard for audio/video and ICT equipment. It classifies energy sources — electrical (ES1–ES3), power (PS1–PS3), thermal and mechanical — and requires safeguards between each source and the user. In the EU it is used for RED article 3.1(a) as EN IEC 62368-1; in the US and Canada as UL 62368-1 / CSA C22.2 No. 62368-1; in India as IS/IEC 62368-1:2023. One well-planned evaluation, usually through the IECEE CB Scheme, can feed all three markets.

Batteries add their own layer: IEC 62133-2 for portable lithium cells and packs, UN 38.3 transport testing before you can ship, and the EU Batteries Regulation, whose Article 11 requires portable batteries to be removable and replaceable by the end user from 18 February 2027 unless an exemption applies (Regulation (EU) 2023/1542).

• Treating cybersecurity as a documentation exercise after the hardware is frozen — secure boot and key storage are hardware decisions.
• Assuming a certified module makes the whole product compliant.
• Changing the antenna or enclosure after certification without checking whether a permissive change or re-test is needed.
• Shipping with a debug UART or unlocked SWD port.
• No owner for vulnerability reports once the CRA reporting duty applies.
• Planning EU launch of a sealed-battery product without checking the Batteries Regulation removability rules.

We design connected products with certification and security built into the architecture — module selection, antenna and layout, secure boot and OTA, SBOM tooling — and run pre-compliance before the paid lab session. Formal testing and certification are carried out by accredited labs, notified bodies and TCBs; we prepare the design, technical documentation and samples. See our compliance testing, RF design, firmware development and IoT solutions pages, and the white paper on IoT security best practices.

1. EUR-Lex — Radio Equipment Directive 2014/53/EU — consolidated legal text
2. EUR-Lex — Delegated Regulation (EU) 2022/30 (RED cybersecurity) — applies from 1 August 2025
3. EUR-Lex — Implementing Decision (EU) 2025/138 (EN 18031 series) — published 28 January 2025, with restrictions
4. European Commission — Delegated Regulation of 16.2.2026 repealing (EU) 2022/30 — repeal effective 11 December 2027
5. EUR-Lex — Cyber Resilience Act, Regulation (EU) 2024/2847 — in force 10 December 2024
6. European Commission — Cyber Resilience Act — reporting from 11 September 2026; main obligations from 11 December 2027
7. European Commission — CRA reporting obligations — checked September 2026
8. European Commission — The EU common charger — USB-C from 28 December 2024; laptops from 28 April 2026
9. EUR-Lex — Batteries Regulation (EU) 2023/1542 — Article 11 removability from 18 February 2027
10. FCC — Equipment authorization — certification and SDoC procedures (checked September 2026)
11. FCC — Covered List — equipment not eligible for authorization (checked September 2026)
12. IEC — IEC 62368-1:2023 — audio/video, ICT equipment safety, edition 4

• India certification guide (BIS, WPC, TEC, CDSCO)
• IoT development cost guide
• BLE vs Wi-Fi vs Thread vs Matter
• TWS earbud and audio electronics guide
• Hardware product development roadmap
• Compliance standards explained