Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

Your NFC payment device transfers money. Three separate cybersecurity requirements apply: Art. 3(3)(d) for network protection, Art. 3(3)(e) for personal data, and Art. 3(3)(f) for fraud protection. Without documentation for all three, your device cannot be marketed in the EU.

You manufacture NFC payment devices — terminals, smart cards, mobile payment accessories. Art. 1(3) applies Art. 3(3)(f). Since the device is internet-connected, Art. 3(3)(d) applies. Since it processes cardholder data, Art. 3(3)(e) applies too. Triple requirement. REDCheck generates the 5 PDF documents covering all three. 30 minutes. €99 per product.

Generate my RED documentation — €99Free: does my product need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

Cybersecurity documentation for NFC payment devices: the numbers

NFC payment devices trigger ALL THREE cybersecurity requirements: (d) network, (e) personal data, (f) fraud. The broadest scope in the Regulation.

3 requirements
Art. 3(3)(d) + (e) + (f) — full scope
Art. 1(3)
Art. 3(3)(f) applies to internet-connected radio equipment enabling transfer of money, monetary value or virtual currency
€5,000–15,000
Typical consultancy cost for triple-scope assessment. REDCheck: €99

What REDCheck does with your product data

You enter your product specifications. REDCheck structures the cybersecurity documentation requirement by requirement.

1
Company details
Legal name, role under Directive 2014/53/EU, country, EU contact.
2
Product classification
Determines applicable requirements: Art. 3(3)(d), (e) and/or (f).
3
Cybersecurity assessment
EN 18031 categories: access control, authentication, secure comms, updates, vulnerability management.
4
Risk assessment
Structured risk table per applicable requirement.
5
EU Declaration of Conformity
Art. 18 + Annex VI. Basis for CE marking.
6
Download ZIP
5 PDFs. Add to technical file. Retain 10 years (Art. 10(4)).

Three mistakes NFC payment device manufacturers make about RED cybersecurity

❌
COMMON ERROR

"PCI-DSS compliance covers us for EU requirements"

PCI-DSS is a payment industry standard. It is NOT a harmonised standard under Directive 2014/53/EU. The cybersecurity requirements require documentation referencing EN 18031. PCI-DSS does not satisfy the legal obligation.

❌
COMMON ERROR

"Art. 3(3)(f) only applies to virtual currency devices"

Art. 1(3) applies Art. 3(3)(f) to any internet-connected radio equipment enabling transfer of money, monetary value OR virtual currency. Standard NFC card payments transfer monetary value. Art. 3(3)(f) applies.

❌
COMMON ERROR

"My importer handles compliance"

Art. 10(1) and 10(3): obligation is on the manufacturer.

What's in the ZIP

5 PDF documents per product model.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V.

3

Risk Assessment

Arts. 3(3)(d) and (e).

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product)

Generated from your data, in your browser. No product data leaves your computer.

What you pay

🧾 CONSULTANCY / LAB
€5,000–15,000
Per model. Triple scope (d)+(e)+(f). Weeks to months.
✓ REDCHECK
€99
5 documents covering all three requirements. 30 minutes.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99. Art. 21 prerequisite for any conformity route.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, self-declare via Module A (Annex II). If not, Art. 17(4) requires third-party involvement.

We do not sell testing. We do not sell consulting. We sell the tool that structures your cybersecurity documentation.

What happens without cybersecurity documentation

Art. 46 of Directive 2014/53/EU requires effective, proportionate and dissuasive penalties.

🇪🇺
Market withdrawal
Immediate

Arts. 40(1), 40(4) and 43.

🏦
Payment industry consequences
Contract termination

Acquirers may suspend terminal certification if EU compliance is not demonstrated.

🛒
Distribution removal
Revenue loss

Missing documentation = no market.

Alternatives

AlternativeCostWhat you get
Consultancy / lab€5,000–15,000/modelTriple scope. Months.
Rely on PCI-DSS€0PCI-DSS is not a harmonised standard. Does not satisfy Art. 21.
Assemble yourself€0EN 18031: 600+ pages × 3 parts.
REDCheck€995 documents, 30 min, per model

Multiple NFC payment device models?

Professional Pack: €999 for 70 generations.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions

What is Art. 3(3)(f) and why does it apply?
Art. 3(3)(f) requires protection from fraud. Art. 1(3) applies it to internet-connected radio equipment enabling transfer of money, monetary value or virtual currency as defined in Directive (EU) 2019/713. An NFC payment device that processes card payments qualifies.
Do all three — (d), (e) and (f) — always apply?
For most NFC payment devices, yes. Art. 3(3)(d) applies if internet-connected. Art. 3(3)(e) applies because cardholder data is personal data. Art. 3(3)(f) applies because the device enables monetary transfer.
Can I use Module A?
Yes, if you fully apply EN 18031-1, -2 and -3. Art. 17(3)(a).
My importer says docs are my responsibility. Correct?
Yes. Art. 10(1) and 10(3).
CRA?
Repealed from 11 December 2027.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.

Official legal sources

⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

Generate the cybersecurity documentation for your NFC payment device — Art. 3(3)(d), (e) and (f) — in 30 minutes.

Five PDF documents. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Your product data never leaves your computer.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate my RED documentation — €99

Related landings

🇹🇷 Turkey

Turkish manufacturer: RED cybersecurity documentation

🔊 Speakers

Bluetooth speaker manufacturer Turkey: EU RED compliance

📦 Importers

German importer: RED cybersecurity documentation requirements

✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history