European Union: Implemented Delegated Act to Radio Equipment Directive includes cybersecurity measures

On 1 August 2025, the delegated act to the Radio Equipment Directive enters into force. The European Commission adopted the Delegated Regulation (EU) 2023/2444, postponing the implementation date from 1 August 2024 to 1 August 2025 and expanding the radio equipment subject to the act’s obligations. The act applies to radio equipment that can process personal data, location or traffic data. The act includes cybersecurity requirements for wireless devices to ensure the resilience of communication networks. The delegated act outlines provisions to guarantee the protection of privacy and personal data and prevent monetary fraud. The manufacturers of devices such as mobile phones and fitness trackers have to follow the new requirements when they are designing and producing the products if they want to sell them in the EU market.