Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

You designed a smart home hub in the US with WiFi, Zigbee and BLE. You sell it on Amazon DE, FR and IT. From 1 August 2025, EU cybersecurity requirements under Art. 3(3)(d) and (e) of Directive 2014/53/EU apply — and FCC certification does not cover them.

Your smart home hub connects to WiFi, coordinates Zigbee and BLE devices, and runs a companion app that collects user data. It triggers Art. 3(3)(d) (network protection) because it communicates over the internet AND Art. 3(3)(e) (personal data) because the app processes personal data under GDPR Art. 4(1). Amazon Seller Support has flagged your listings. Your Hamburg importer says: 'FCC is not CE. You need RED cybersecurity documentation.' A European lab quotes $18,000 and 4 months. REDCheck generates the 5 PDF documents covering Art. 21 and Annex V. 30 minutes. €99 per product. 100% in your browser.

Generate my RED documentation — €99Free: does my smart home hub need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

EU cybersecurity requirements for smart home hubs: the numbers

A smart home hub with WiFi, Zigbee and BLE is among the most complex product categories under Delegated Regulation (EU) 2022/30. Multiple radio technologies, cloud connectivity and personal data processing mean both Art. 3(3)(d) and Art. 3(3)(e) apply simultaneously.

1 Aug 2025
Mandatory application date — cybersecurity requirements in force
2 requirements
Art. 3(3)(d) network protection + Art. 3(3)(e) personal data. Smart home hubs trigger both.
$18,000
European lab quote per model. REDCheck: €99

What REDCheck does with your product data

You enter your product specifications. REDCheck structures the cybersecurity documentation requirement by requirement, following the EN 18031 categories.

1
Company details
Legal name, role under Directive 2014/53/EU (manufacturer, Art. 10), country of manufacture, EU contact.
2
Product classification
Determines which essential requirements apply: Art. 3(3)(d) (network protection) for all internet-connected equipment. Art. 3(3)(e) (personal data) if your product processes personal data via its app or cloud service.
3
Cybersecurity assessment
Requirement-by-requirement review mapped to EN 18031-1 (network) and EN 18031-2 (personal data) categories: access control, authentication, secure communications, software updates, vulnerability management.
4
Risk assessment
Assessment of implementation status for each applicable requirement of Arts. 3(3)(d) and (e). Maps your answers to a structured risk table.
5
EU Declaration of Conformity
Formal declaration under Art. 18 and Annex VI. Signed by the manufacturer. Basis for CE marking under Arts. 19–20.
6
Download ZIP
5 PDF documents generated in your browser. Add to your technical file alongside test reports and user manual. Retain for 10 years (Art. 10(4)).

Three mistakes US smart home companies make about EU cybersecurity

COMMON ERROR

"Only the WiFi radio triggers cybersecurity — Zigbee and BLE are local"

Art. 1(1) applies Art. 3(3)(d) to radio equipment that can communicate over the internet, DIRECTLY OR INDIRECTLY. Your hub's Zigbee and BLE radios connect to the internet through the hub's WiFi interface. The entire device is internet-connected radio equipment. Recital 8 of the Delegated Regulation clarifies that all aspects and parts of the equipment must comply.

COMMON ERROR

"Our app stores data in AWS US-East — GDPR doesn't apply"

Art. 3(3)(e) applies when the radio equipment is capable of processing personal data. The location of the server is irrelevant for the purpose of Directive 2014/53/EU. If the device COLLECTS personal data from EU users, Art. 3(3)(e) applies. Where you store it is a GDPR question, not a RED question.

COMMON ERROR

"We'll just pull out of Europe if it gets complicated"

If your products are already listed on Amazon DE, FR or IT, they are already on the EU market. Pulling listings does not retroactively create compliance. Products placed on the market without cybersecurity documentation remain non-compliant. Art. 10(11) requires the manufacturer to take corrective measures.

What's in the ZIP

5 PDF documents per product model. Each cites the exact article of Directive 2014/53/EU that it covers.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V.

3

Risk Assessment

Arts. 3(3)(d) and (e).

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product)

Generated from your data, in your browser. No product data leaves your computer.

What you pay

🧾 EUROPEAN LAB
$18,000
Per product model. 4 months. 1 hub model = $18,000.
✓ REDCHECK
€99
5 documents. 30 minutes. 1 hub model = €99.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99 per product. The documentation that Art. 21 requires BEFORE your product can bear CE marking.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, you can self-declare via Module A (Annex II) without a Notified Body. If you partially apply or don't apply the harmonised standards, Art. 17(4) requires third-party involvement. REDCheck does not replace a Notified Body — it generates the documentation that is a prerequisite for any conformity route.

We do not sell testing. We do not sell consulting. We sell the tool that structures your cybersecurity documentation under Art. 21 and Annex V.

What happens without cybersecurity documentation

Art. 46 of Directive 2014/53/EU requires Member States to establish penalties that are effective, proportionate and dissuasive, including criminal penalties for serious infringements.

🇪🇺
Market withdrawal
Immediate

Arts. 40(1), 40(4) and 43 of Directive 2014/53/EU.

🛒
Amazon EU listing removal
Revenue loss

Amazon requires conformity documentation. ASINs may be suspended immediately.

📉
Board and investor impact
Strategic

If Europe is 15-20% of revenue, losing EU market access is a board-level event.

Alternatives

AlternativeCostWhat you get
European lab$18,000 per model4 months. Full assessment.
EU compliance consultancy$15,000–20,0003–6 months. Custom report.
Assemble documentation yourself$0 (your time)EN 18031 has 600+ pages.
REDCheck€995 documents, 30 min, per model

Selling more than one smart home product in the EU?

Hub, sensors, cameras, plugs — Professional Pack: €999 for 70 generations.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions

My hub uses WiFi + Zigbee + BLE. Do I need documentation for each radio?
No. The documentation is per PRODUCT, not per radio technology. One set of 5 PDF documents covers your smart home hub with all its radio interfaces.
My companion app collects email, home address and device usage data. Does Art. 3(3)(e) apply?
Yes. Email, home address and device usage patterns are personal data under Art. 4(1) of GDPR. Art. 1(2)(a) applies Art. 3(3)(e) to internet-connected radio equipment capable of processing personal data.
Can I use Module A (self-declaration)?
Yes, if you fully apply EN 18031. Art. 17(3)(a) allows Module A when harmonised standards are fully applied.
What happens when the CRA replaces RED?
Delegated Regulation (EU) 2022/30 will be repealed from 11 December 2027. REDCheck covers 1 August 2025 to 11 December 2027.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.
⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

Amazon flagged your listings. Generate the documentation before the next board meeting.

Five PDF documents. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Your product data never leaves your computer. The ZIP you download is yours permanently.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate my RED documentation — €99
✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history