Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

You import radio equipment into the EU. From 1 August 2025, your responsibility under Art. 12 of Directive 2014/53/EU includes verifying that the manufacturer has drawn up cybersecurity documentation. Without it, you cannot place the product on the market.

Art. 12(1): importers shall place only compliant radio equipment on the EU market. Art. 12(2): before placing on the market, importers shall ensure that the manufacturer has carried out the conformity assessment and drawn up the technical documentation. Delegated Regulation (EU) 2022/30 activated cybersecurity under Art. 3(3)(d) and (e). The documentation must now include cybersecurity. If your Chinese, Indian or Turkish supplier does not have it, YOUR product is blocked — and YOU bear the consequences. REDCheck generates the 5 PDF documents. Send the link to your supplier. 30 minutes. €99 per product.

Generate RED documentation — €99Free: does this product need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

Importer responsibility for cybersecurity documentation: the law

Directive 2014/53/EU distributes obligations across the supply chain. The manufacturer produces. The importer verifies. Both are liable.

Art. 12(1)
Importers shall place ONLY compliant radio equipment on the market
Art. 12(2)
Before placing: verify conformity assessment, technical documentation, CE marking, required documents
Art. 12(7)
If non-compliant: importer shall take corrective measures — bring into compliance, withdraw or recall. Inform authorities immediately.

How REDCheck helps you as importer

The documentation obligation is the manufacturer's (Art. 10). But if your supplier cannot produce it, your products are blocked. REDCheck is a tool you can send to your supplier.

1
Send the link to your supplier
Your manufacturer enters their company and product data into REDCheck. The tool runs in their browser — their data never leaves their computer.
2
Supplier completes product classification
Determines which essential requirements apply: Art. 3(3)(d), Art. 3(3)(e), or both.
3
Supplier completes cybersecurity assessment
Requirement-by-requirement review mapped to EN 18031-1 and EN 18031-2 categories.
4
Supplier generates ZIP with 5 PDFs
Product classification, technical documentation, risk assessment, EU declaration of conformity, simplified declaration + label.
5
You verify and file
Art. 12(2): verify that documentation exists. Art. 12(8): keep a copy of the EU declaration of conformity for 10 years.
6
Place on market
Your product is legally compliant. You have fulfilled Art. 12(1) and 12(2).

Three mistakes EU importers make about cybersecurity responsibility

COMMON ERROR

"My supplier has CE marking — that means everything is covered"

CE marking applied BEFORE 1 August 2025 covers EMC (Art. 3(1)(b)) and safety (Art. 3(1)(a)). It does NOT cover the cybersecurity requirements of Art. 3(3)(d) and (e) activated by Delegated Regulation (EU) 2022/30. You must verify that the technical documentation now INCLUDES cybersecurity (Art. 12(2)).

COMMON ERROR

"My supplier says they comply — I trust them"

Art. 12(2) requires VERIFICATION, not trust. You must ensure that the conformity assessment has been carried out, that technical documentation has been drawn up, and that the product bears CE marking. A verbal assurance from your supplier does not discharge your legal obligation.

COMMON ERROR

"I only distribute — I'm not the importer"

Art. 2(14) of Directive 2014/53/EU defines the importer as the natural or legal person established within the Union who places radio equipment from a third country on the Union market. If you are the first EU entity to make the product available, you are the importer — even if you call yourself a distributor. Art. 12 obligations apply to you.

What's in the ZIP

5 PDF documents generated from the manufacturer's product data. Each cites the exact article of Directive 2014/53/EU that it covers.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V. Requirement-by-requirement documentation.

3

Risk Assessment

Arts. 3(3)(d) and (e). Structured risk table.

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product) — Real structure, real articles, real format. Fictitious data.

The manufacturer generates the documents. You verify and file them. Art. 12(8): retain for 10 years.

What your supplier pays

🧾 NOTIFIED BODY / CONSULTANCY
€5,000–10,000
Per product model. 3–6 months. 23 models = €115,000–230,000. Will your supplier pay that?
✓ REDCHECK
€99
5 documents. 30 minutes per model. 23 models = €2,277. Send your supplier the link.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99 per product. The documentation that Art. 21 requires BEFORE your product can bear CE marking.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, you can self-declare via Module A (Annex II) without a Notified Body. If you partially apply or don't apply the harmonised standards, Art. 17(4) requires third-party involvement. REDCheck does not replace a Notified Body — it generates the documentation that is a prerequisite for any conformity route.

As importer, your role is to VERIFY Layer 1 documentation exists. The manufacturer produces it.

What happens to importers without verified cybersecurity documentation

Art. 46 of Directive 2014/53/EU requires Member States to establish penalties. As importer, YOU are liable — not just the manufacturer.

🇪🇺
Market withdrawal — at importer's expense
Immediate

Art. 40(4): market surveillance authorities can prohibit sale, require withdrawal or order recall. Art. 12(7): the importer must take corrective action on all affected products throughout the EU.

🇩🇪
Germany — Produktsicherheitsgesetz
€3,000–€30,000

Administrative fines under §19. Up to 1 year of imprisonment for serious offences under §20. The importer — not the manufacturer — faces German enforcement.

⚖️
Formal non-compliance — Art. 43
Listing of deficiencies

Art. 43(1)(f): if technical documentation is not available or not complete, the Member State shall require the economic operator to put an end to the non-compliance. Incomplete documentation = non-compliance.

Options for your supplier

OptionCostWhat your supplier gets
Notified Body / lab in China€5,000–10,000 per model3–6 months. Full third-party assessment.
EU-based cybersecurity consultancy€5,000–15,000 per modelCustom report. Weeks of wait.
Supplier assembles documentation€0 (their time)EN 18031 has 600+ pages. No guidance.
REDCheck — send them the link€995 documents, 30 min, per model

Importing more than ten product models?

If your suppliers document 10 or more product models, we offer the Professional Pack: €999 for 70 generations with a single license key. You can purchase the Pack and distribute the license key to your suppliers.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case, nor by a commercial buyer in a procurement process.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions — EU importer cybersecurity responsibility

What exactly must I verify as importer?
Art. 12(2) requires you to verify: (1) the manufacturer has carried out the conformity assessment procedure under Art. 17; (2) the manufacturer has drawn up the technical documentation; (3) the radio equipment bears CE marking; (4) the product is accompanied by the information and documents required by Art. 10(8), (9) and (10); (5) the manufacturer has complied with Art. 10(6) and (7) — identification and contact details.
What if my supplier refuses to produce cybersecurity documentation?
You cannot place the product on the EU market. Art. 12(1) is absolute: importers shall place ONLY compliant radio equipment. If your supplier will not produce the documentation, you must either find a supplier who will, or provide your supplier with a tool that makes it feasible — such as REDCheck at €99 per product.
If I place a product under my own brand, am I the manufacturer?
Yes. Art. 14 of Directive 2014/53/EU: an importer who places radio equipment under their own name or trade mark is considered the manufacturer and is subject to Art. 10 obligations — including producing the technical documentation.
What happens when the CRA replaces the RED cybersecurity requirements?
The Cyber Resilience Act (Regulation (EU) 2024/2847) will gradually replace the cybersecurity requirements of Art. 3(3)(d), (e) and (f) of Directive 2014/53/EU. The transition is expected by 2027–2028. Until the CRA fully applies, the RED cybersecurity requirements remain in force. Documentation generated now remains valid for products placed on the market during the RED regime.
Can I use Module A (self-declaration) instead of a Notified Body?
If you fully apply the harmonised standards EN 18031-1, EN 18031-2 and, where applicable, EN 18031-3, you can use Module A (self-declaration, Annex II) under Art. 17(3)(a) of Directive 2014/53/EU. No Notified Body required. If you partially apply or do not apply the standards, Art. 17(4) requires a Notified Body (Module B+C or Module H). REDCheck generates the documentation for both routes.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.
⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

Your supplier needs cybersecurity documentation. Send them the link. 30 minutes. €99 per product.

Five PDF documents per model. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Data stays in the manufacturer's browser. You verify and file.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate RED documentation — €99
✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history