This one’s practical. We’ll cover what the articles want, how to check a product against them, what testing involves, and which certification route you’ll probably land on. The UK wrinkles and the December 2027 switch get a mention too.
What the Radio Equipment Directive (RED) Cybersecurity Requirements Means for You
Three articles do the heavy lifting, and they split the job by risk for RED cybersecurity requirements. 3(3)(d) is about not harming the network. 3(3)(e) is about personal data and privacy, and 3(3)(f) is about fraud. The Commission activated them through Delegated Regulation (EU) 2022/30, which has been in scope since 1 August 2025.
The articles read like goals. Nobody says “turn on secure boot”. So the real detail lives in EN 18031-1, -2 and -3, which break each goal into named mechanisms you can test. BSI’s RED Directive guide lists them, and we have put them in plain English below.
What the RED Directive Cybersecurity Rules Mean for UK Sellers
The answer splits by market. UK government guidance says CE-marked radio equipment can still go on the Great Britain market. It’s deemed to meet the Radio Equipment Regulations 2017.
Northern Ireland plays by different RED directive cybersecurity rules. The extra cybersecurity requirements apply there from 1 August 2025 under the Windsor Framework, so the full conformity assessment applies. PSTI applies separately in Great Britain; RED products supplied in Northern Ireland are exempt from it.
Many UK teams ask whether they can ignore all this and sell only in Great Britain. You can, for now. But it limits your market, and most buyers want an EU option sooner or later. My view: build your RED directive cybersecurity to the EU standard once and sell everywhere. Maintaining a GB-only variant rarely saves money.
How Qualysec Supports Your RED Compliance Work
Qualysec is a CREST-accredited penetration testing company. It isn’t a notified body, so no certificates come from it. What you get is someone attacking your device the way a hostile tester would. The faults they hunt for are the ones that sink EN 18031 mechanisms in practice: weak authentication, insecure firmware updates, poor encryption, loose access control, unprotected protocols, and debug interfaces somebody forgot to switch off.
Firmware and Hardware Testing
Qualysec’s IoT and embedded device testing covers the firmware, the communication protocols, the hardware interfaces, and the server-side components. Testing is manual, and you choose the depth. Black box means the tester starts as an outsider and sees what they can reach. White box hands over your firmware, schematics, APIs, and source code, which is the fastest way to turn up hard-coded secrets and test accounts nobody remembered.
App and Cloud Testing
A lot of connected-device failures aren’t in the device at all. They’re in the app, or in the cloud API sitting behind it. Qualysec tests the cloud interface, the mobile app, and the APIs along with the hardware, so you find the “checked the user once, then trusted everything” flaws before a lab does.
Findings, Fixes and Retest
Every report gives you the vulnerabilities, each with a risk level, its impact, and a suggested fix. Qualysec’s dashboard lets your team track findings, assign them to developers, and request a retest, and every engagement ends with remediation testing. That fits neatly with the checklist above. Each finding becomes a ticket, and each closed ticket gets a retest behind it. File the retest report next to your risk assessment, so you’ve got supporting evidence if anyone asks.
Before anything starts, Qualysec sends over a pre-assessment form and a checklist of prerequisites. Get your architecture notes, update procedure, and test credentials together first, and the scoping call goes faster.
Source: https://qualysec.com/red-cy ...