Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

You manufacture IoT sensors in the EU. Your lab quotes €6,800 per model for cybersecurity documentation. You have eight models. That is €54,400 — money your SME does not have. Directive 2014/53/EU makes no exemption for company size.

You are a European SME manufacturing IoT sensors with WiFi, LoRa or Zigbee connectivity. Your sensors are deployed in buildings, factories or public infrastructure. From 1 August 2025, Delegated Regulation (EU) 2022/30 requires cybersecurity documentation under Art. 3(3)(d) and, if your sensors process personal data, Art. 3(3)(e). Your lab in Grenoble, Munich or Amsterdam quotes €5,000–8,000 per model. You have 8 models. That is €40,000–64,000 — a quarter of your annual budget for certification. REDCheck generates the 5 PDF documents. 30 minutes. €99 per product. 100% in your browser.

Generate my RED documentation — €99Free: does my IoT sensor need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

Cybersecurity documentation for IoT sensor SMEs: the numbers

Directive 2014/53/EU does not differentiate by company size. The essential requirements of Art. 3(3)(d) and (e) apply identically to a 7-person startup and a 7,000-person corporation. The only variable is how much you pay to produce the documentation.

1 Aug 2025
Application date — mandatory for all manufacturers, regardless of size
No SME exemption
Art. 10 obligations apply equally. Art. 21 technical documentation is required for every product.
€5,000–8,000
Typical lab cost per model for European SMEs. REDCheck: €99

What REDCheck does with your IoT sensor data

You enter your product specifications. REDCheck structures the cybersecurity documentation requirement by requirement, following the EN 18031 categories.

1
Company details
Legal name, role under Directive 2014/53/EU (manufacturer, Art. 10), country of manufacture, EU contact.
2
Product classification
Determines which essential requirements apply: Art. 3(3)(d) (network protection) for all internet-connected IoT sensors. Art. 3(3)(e) (personal data) if your sensor processes personal data.
3
Cybersecurity assessment
Requirement-by-requirement review mapped to EN 18031-1 (network) and EN 18031-2 (personal data) categories: access control, authentication, secure communications, software updates, vulnerability management.
4
Risk assessment
Assessment of implementation status for each applicable requirement of Arts. 3(3)(d) and (e). Maps your answers to a structured risk table.
5
EU Declaration of Conformity
Formal declaration under Art. 18 and Annex VI. Signed by the manufacturer. Basis for CE marking under Arts. 19–20.
6
Download ZIP
5 PDF documents generated in your browser. Add to your technical file alongside test reports and user manual. Retain for 10 years (Art. 10(4)).

Three mistakes IoT sensor SMEs make about RED cybersecurity

COMMON ERROR

"We are a small company — surely there is an exemption"

Directive 2014/53/EU contains no exemption based on company size, revenue or number of employees. Art. 10 obligations apply to the manufacturer regardless of scale. A 7-person startup has the same documentation obligation as Siemens.

COMMON ERROR

"Our sensors are B2B — only consumer products need cybersecurity"

Art. 1(1) of Delegated Regulation (EU) 2022/30 applies Art. 3(3)(d) to ANY radio equipment that communicates over the internet. There is no B2B exemption. An IoT sensor deployed in an office building, a factory or a hospital has the same obligation as a smart plug in a home.

COMMON ERROR

"We'll ask our lab to add cybersecurity to the existing EMC test"

EMC testing (Art. 3(1)(b)) and cybersecurity documentation (Art. 3(3)(d)) are fundamentally different processes. EMC is a physical measurement in a lab. Cybersecurity documentation is a structured assessment of your product's security features against EN 18031. Your EMC lab may or may not offer this service — and if they do, it costs €5,000–8,000 per model.

What's in the ZIP

5 PDF documents generated from your IoT sensor data. Each cites the exact article of Directive 2014/53/EU that it covers.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V. Requirement-by-requirement documentation.

3

Risk Assessment

Arts. 3(3)(d) and (e). Structured risk table.

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product) — Real structure, real articles, real format. Fictitious data.

Generated from your data, in your browser. No product data leaves your computer.

What you pay

🧾 LAB (GRENOBLE / MUNICH / AMSTERDAM)
€5,000–8,000
Per product model. Weeks of wait. 8 models = €40,000–64,000.
✓ REDCHECK
€99
5 documents. 30 minutes per model. 8 models = €792.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99 per product. The documentation that Art. 21 requires BEFORE your product can bear CE marking.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, you can self-declare via Module A (Annex II) without a Notified Body. If you partially apply or don't apply the harmonised standards, Art. 17(4) requires third-party involvement. REDCheck does not replace a Notified Body — it generates the documentation that is a prerequisite for any conformity route.

We do not sell testing. We do not sell consulting. We sell the tool that structures your cybersecurity documentation under Art. 21 and Annex V.

What happens without cybersecurity documentation

Art. 46 of Directive 2014/53/EU requires Member States to establish penalties that are effective, proportionate and dissuasive.

🇪🇺
Market withdrawal — no SME grace period
Immediate

Art. 40(1) of Directive 2014/53/EU: market surveillance authorities can require withdrawal regardless of company size. No grace period for SMEs.

🇩🇪
Germany — BNetzA enforcement
€3,000–€30,000

German market surveillance has sent requests for documentation to SME manufacturers. The BNetzA does not distinguish by company size.

📋
Public procurement exclusion
Lost contracts

EU public procurement increasingly requires full CE compliance documentation. Missing cybersecurity documentation can disqualify your tender for building automation, smart city or industrial projects.

Alternatives

AlternativeCostWhat you get
Notified Body / accredited lab€5,000–10,000 per model3–6 months. Full third-party assessment.
Cybersecurity consultancy€5,000–15,000 per modelCustom report. Weeks of wait.
Assemble documentation yourself€0 (your time)EN 18031 has 600+ pages. No template.
REDCheck€995 documents, 30 min, per model

Manufacturing more than one IoT sensor model?

If you document 10 or more product models, write to us for the Professional Pack: €999 for 70 generations with a single license key.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case, nor by a commercial buyer in a procurement process.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions — IoT sensor SME cybersecurity

Is there any EU exemption for small manufacturers?
No. Directive 2014/53/EU does not contain exemptions based on company size, turnover or employee count. Art. 10 and Art. 21 obligations apply equally to all manufacturers.
My sensor uses LoRa — not WiFi. Does Art. 3(3)(d) apply?
If your LoRa sensor communicates over the internet — for instance, via a LoRa gateway that connects to the internet — it is internet-connected radio equipment under Art. 1(1) of Delegated Regulation (EU) 2022/30. Art. 3(3)(d) applies. If the sensor operates on a closed LoRa network with no internet connectivity, Art. 3(3)(d) does not apply to the sensor itself — but it may apply to the gateway.
I received a letter from the BNetzA asking for documentation. What do I do?
Respond promptly. Art. 10(12) requires manufacturers to cooperate with competent national authorities and provide all information and documentation necessary to demonstrate conformity. Generate the documentation with REDCheck (30 minutes, €99) and respond within the deadline stated in the letter.
Can I use Module A (self-declaration) instead of a Notified Body?
If you fully apply the harmonised standards EN 18031-1, EN 18031-2 and, where applicable, EN 18031-3, you can use Module A (self-declaration, Annex II) under Art. 17(3)(a) of Directive 2014/53/EU. No Notified Body required. If you partially apply or do not apply the standards, Art. 17(4) requires a Notified Body (Module B+C or Module H). REDCheck generates the documentation for both routes.
What happens when the CRA replaces the RED cybersecurity requirements?
The Cyber Resilience Act (Regulation (EU) 2024/2847) will gradually replace the cybersecurity requirements of Art. 3(3)(d), (e) and (f) of Directive 2014/53/EU. The transition is expected by 2027–2028. Until the CRA fully applies, the RED cybersecurity requirements remain in force. Documentation generated now remains valid for products placed on the market during the RED regime.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.
⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

No SME exemption. No grace period. Generate the cybersecurity documentation for your IoT sensor in 30 minutes.

Five PDF documents. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Your product data never leaves your computer. The ZIP you download is yours permanently.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate my RED documentation — €99
✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history