RED-DA Compliance

Information on Avnet Silica's and its suppliers' commitments to RED-DA compliance

An introduction to the new Requirements for Wireless Devices in the EU starting August  2025

The RED-DA (Delegated Act 2022/30/EU to the Radio Equipment Directive) came into effect on August 1, 2025, supplementing the existing Radio Equipment Directive (RED—EU Directive 2014/53/EU) with mandatory cybersecurity requirements. The associated harmonised standards EN 18031-1/-2/-3 were published with limitations in the EU Official Journal on January 30, 2025, and will be applicable from the effective date.

Objective

The objective is to ensure that radio equipment:

• does not harm the network (Art. 3.3(d)),
• protects personal data (Art. 3.3(e)),
• and prevents financial fraud (Art. 3.3(f)).

These requirements apply to end products as well as components (e.g., chips, modules, boards) that can connect directly or indirectly to the Internet. The responsibility lies primarily with the manufacturer of the final product. However, a declaration of conformity may also be required for certain subassemblies.

The three standards

The three standards address different types of devices:

• EN 18031-1: Radio systems with Internet connectivity
• EN 18031-2: Data-processing radio devices, wearables, gaming devices, baby monitors, portable radios
• EN 18031-3: Internet-enabled radio devices used for financial transactions

Devices requiring certification by a Notified Body

Some devices require certification by a Notified Body. Affected categories include:

• Cellular devices (2G–5G)
• Wi-Fi and Bluetooth®-enabled devices
• Radar equipment
• RFID Devices
• Televisions and radio receivers

While the EU Commission primarily focuses on end products, there is room for interpretation. According to the EU Blue Guide (2022) and the RED Compliance Association (RED CA), the following clarifications apply and are currently Notified Body practice:

• Radio Chips, Modules and SOMs, actually require a form of product integration (Antenna integration, Software, Drivers, Protocol Stacks), hence do not qualify as Final Radio Products and therefore are not subject to standalone RED Cyber assessments.
• Wireless Components (Chips/Modules/SOMs) shipped  as a bare product (i.e., without operating systems or functional application firmware or antenna) are not in scope for RED Article 3.3 (d), (e), or (f) because they cannot:
  • Connect to the Internet directly or indirectly
  • Execute any network-facing behaviour
  • Handle personal data, credentials, or software updates
• If a Radio Chip or Module includes firmware (e.g., AT command interface, embedded OS and/or Bluetooth stack or special security features supported by ROM bootloader), the decision is on the manufacturer's side, if :
  • The firmware enables Internet connectivity or sensitive data processing out of the box
  • The manufacturer chooses to declare the component as an end product or a subcomponent
• Modems, routers, and gateways with full software integration must be tested according to RED-DA and provided with a Declaration of Conformity—even if shipped without housing.

Our Wireless & Connectivity suppliers and their commitments to RED-DA compliance

The following overview shows how Avnet Silica’s wireless product suppliers categorise their products and for which types a Declaration of Conformity can be provided.

Ultimately, the manufacturer of the final product placed on the market and the customer are responsible for ensuring RED-DA compliance. 

If you have questions or require a specific DoC from a supplier below, please contact our experts. 

CONTACT OUR WIRELESS & CONNECTIVITY EXPERTS