Does the CRA replace the RED cybersecurity requirements under Delegated Regulation (EU) 2022/30?

Not formally. Recital 30 of Regulation (EU) 2024/2847 states that the CRA's essential cybersecurity requirements "include all the elements" of RED Article 3(3)(d)(e)(f). Article 2(5) of the CRA empowers the Commission to adopt delegated acts limiting or excluding CRA application where sectoral rules achieve the same protection level. Until such a delegated act is adopted, both frameworks coexist. In practice, CRA compliance on cybersecurity will cover — and exceed — the RED cybersecurity requirements.

My product is a Wi-Fi router. Is it Default or Important under the CRA?

Annex III Class I category 12 of Regulation (EU) 2024/2847 lists "routers, modems intended for the connection to the internet, and switches." If your Wi-Fi router is intended for internet connection, it is Important Class I. This means Module A self-assessment is available only if harmonised standards are applied in full (Article 32(2)). Otherwise, Module B+C or Module H with a notified body is required.

Can I combine the CRA and RED technical documentation into one file?

Yes. Article 31(3) of Regulation (EU) 2024/2847 states that for products subject to other Union legal acts requiring technical documentation, "a single set of technical documentation shall be drawn up containing the information referred to in Annex VII and the information required by those Union legal acts." You can integrate the CRA Annex VII content into your existing RED technical file.

Can I combine the CRA and RED Declarations of Conformity?

Yes. Article 28(3) of the CRA allows a single EU Declaration of Conformity covering multiple Union legal acts. The combined Declaration must cite both Regulation (EU) 2024/2847 and Directive 2014/53/EU with their publication references.

Is this a subscription?

No. One-time payment. The licence includes 30 days of editing and 10 regenerations. The downloaded PDF is yours permanently.

Can I request a refund?

Under Art. 16(m) of Directive (EU) 2011/83, activating the licence constitutes express consent for immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are only processed for reproducible technical failures.

What if the regulation changes?

If Regulation (EU) 2024/2847 is amended during your licence window, you can regenerate the documentation using the updated version of the generator at no additional cost.

Commission Delegated Regulation (EU) 2022/30 activated cybersecurity requirements under Article 3(3)(d), (e), and (f) of Directive 2014/53/EU for certain radio equipment. Recital 30 of Regulation (EU) 2024/2847 states that the essential cybersecurity requirements of the CRA include all the elements of those RED essential requirements. If your product is radio equipment with a network connection, both the RED and the CRA apply — but the CRA cybersecurity requirements subsume the RED cybersecurity requirements. You still need RED conformity for radio spectrum, EMC, and safety. CRACheck generates the cybersecurity documentation layer under the CRA.

The regulatory geometry for connected radio equipment in the EU is now three-layered: Directive 2014/53/EU (RED) covers radio spectrum access, electromagnetic compatibility, and safety. Delegated Regulation (EU) 2022/30 added cybersecurity requirements under RED Article 3(3)(d)(e)(f) for internet-connected radio equipment. Regulation (EU) 2024/2847 (CRA) covers cybersecurity for all products with digital elements, including radio equipment. Recital 30 of the CRA explicitly states that the CRA's essential cybersecurity requirements "include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU." The CRA does not replace the RED — it absorbs the cybersecurity layer and adds Article 31 technical documentation, Article 14 vulnerability notification, and Article 13 manufacturer obligations. CRACheck generates the CRA documentation. €149. 15–25 minutes. 8 PDFs.

Generate CRA dossier — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key figures

Recital 30

CRA includes all RED Art. 3(3)(d)(e)(f) cybersecurity elements

Art. 2(5)

CRA may limit/exclude application where sectoral rules achieve same protection level

€15M

Maximum CRA fine under Art. 64(2)

How CRACheck handles the CRA documentation for radio equipment

If your product is radio equipment under Directive 2014/53/EU and also a product with digital elements under Regulation (EU) 2024/2847, you need RED conformity for radio/EMC/safety AND CRA documentation for cybersecurity. CRACheck covers the CRA layer.

Product identification

You enter the product type, radio technology (Wi-Fi, Bluetooth, cellular, LoRa, Zigbee, etc.), network connectivity, and intended purpose. CRACheck scopes both the CRA classification (Annex III includes routers, modems, and switches in Class I category 12) and the CRA cybersecurity requirements.

Classification

Many radio equipment products fall into Annex III Class I category 12 (routers, modems intended for internet connection, switches) or category 10 (physical and virtual network interfaces). CRACheck cross-references and documents the classification.

Annex I mapping

CRACheck maps the 21 Annex I requirements to your product. For radio equipment, requirements like secure-by-default configuration (2)(b), vulnerability patching (2)(c), access control (2)(d), encryption (2)(e), and attack surface reduction (2)(j) are typically all applicable.

Vulnerability handling

CRACheck documents your SBOM, CVD policy, and update distribution mechanism. For radio equipment, over-the-air update security is a critical element under Annex I Part II point (7).

Documentation output

8 PDFs covering the CRA cybersecurity layer. Your RED technical file (radio tests, EMC measurements, safety assessments) remains a separate documentation set.

Common mistakes

❌

RECITAL 30

Assuming the RED cybersecurity requirements are sufficient and the CRA adds nothing

Recital 30 of the CRA states that the CRA includes all elements of RED Article 3(3)(d)(e)(f). But the CRA adds significantly more: Article 31 technical documentation (Annex VII), Article 14 vulnerability notification to ENISA, Article 13 manufacturer obligations including risk assessment, and Annex I Part II vulnerability handling requirements. RED does not require an SBOM, a CVD policy, or ENISA notifications.

❌

ANNEX III · CAT 12

Treating a Wi-Fi router as a Default product

Annex III Class I category 12 lists "routers, modems intended for the connection to the internet, and switches." If your radio equipment is a router or internet-connected modem, it is Important Class I, not Default. The classification determines whether Module A self-assessment is available (only if harmonised standards are applied in full under Article 32(2)).

❌

ART. 13(4)

Creating separate technical documentation for CRA and RED without cross-referencing

Article 13(4) of the CRA states that for products subject to other Union legal acts requiring technical documentation, "the cybersecurity risk assessment may be part of the risk assessment required by those Union legal acts." Article 31(3) allows a single technical documentation set. The two files can coexist in one document, reducing duplication.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classification under CRA Annex III (many radio equipment products fall under Class I category 10 or 12). Documents the dual RED + CRA applicability.

Technical Documentation

CRA Annex VII file. Can reference the existing RED technical file for shared elements. Adds cybersecurity-specific content: system architecture, SBOM, CVD policy, vulnerability handling.

Risk Assessment

CRA cybersecurity risk assessment per Article 13(2)–(3). Complementary to — not a replacement for — any RED-specific risk analysis.

User Information

Annex II sheet. Includes support period, vulnerability reporting contact, and security instructions for firmware updates.

Declaration of Conformity

CRA Declaration per Article 28 + Annex V. Article 28(3) allows combining CRA and RED declarations in a single document, but both regulations must be cited.

CVD Policy

Required by Annex I Part II point (5). Not required by the RED.

Notification Template

ENISA notification per Article 14. Not required by the RED.

Obligations Calendar

CRA dates (11 Sept 2026 for Article 14, 11 Dec 2027 for full enforcement) alongside RED timeline.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 THE ALTERNATIVE

Add CRA scope to existing RED compliance consultancy

€8,000–20,000 on top of RED engagement

3–6 months additional work

The consultant must understand both frameworks

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history