Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

Your children's GPS watch or fitness band is wearable radio equipment. Under Delegated Regulation (EU) 2022/30, it needs cybersecurity documentation — even if it never connects to the internet directly.

You manufacture or sell children's GPS watches, kids' fitness trackers, location-tracking wristbands or any wearable device with radio function designed for children. Art. 1(2)(d) of Delegated Regulation (EU) 2022/30 activates Art. 3(3)(e) for wearable radio equipment that processes personal data — regardless of internet connectivity. A children's GPS watch processes location data by definition — Art. 2(c) of Directive 2002/58/EC explicitly includes location data. If the wearable also connects to the internet (most do, via a companion app), Art. 3(3)(d) applies additionally. Plus, if the product is designed exclusively for childcare, Art. 1(2)(b) provides a second legal basis for Art. 3(3)(e). Your wearable may trigger up to THREE articles simultaneously. REDCheck documents all applicable requirements in a single package. 30 minutes. €99 per product.

Generate my RED documentation — €99Free: does my product need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

Children's wearables and EU cybersecurity: the numbers

Children's wearables sit at the intersection of three categories in the Delegated Regulation: wearable (Art. 1(2)(d)), childcare (Art. 1(2)(b) if exclusively designed for children), and internet-connected (Art. 1(1) if connected). The cybersecurity documentation must cover ALL applicable requirements.

Up to 3 articles
Art. 3(3)(d) (network) + Art. 3(3)(e) via Art. 1(2)(d) (wearable) + Art. 3(3)(e) via Art. 1(2)(b) (childcare) — if all conditions are met
Location data
Art. 2(c) of Directive 2002/58/EC: location data processed by a GPS watch is explicitly covered by Art. 3(3)(e)
€99
Single documentation package covering all applicable requirements. vs €5,000–12,000 at a lab.

What REDCheck does with your children's wearable data

You enter your product specifications. REDCheck structures the cybersecurity documentation requirement by requirement, following the EN 18031 categories.

1
Company details
Legal name, role under Directive 2014/53/EU (manufacturer, Art. 10), country of manufacture, EU contact.
2
Product classification
Determines which essential requirements apply. Art. 1(2)(d): wearable radio equipment. Art. 1(2)(b): childcare equipment. Art. 1(1): internet-connected. Your children's wearable may trigger Art. 3(3)(e) through multiple legal bases AND Art. 3(3)(d) if internet-connected.
3
Cybersecurity assessment
Requirement-by-requirement review mapped to EN 18031-1 (network) and EN 18031-2 (personal data) categories: access control, authentication, secure communications, software updates, vulnerability management.
4
Risk assessment
Assessment of implementation status for each applicable requirement of Arts. 3(3)(d) and (e). Maps your answers to a structured risk table.
5
EU Declaration of Conformity
Formal declaration under Art. 18 and Annex VI. Signed by the manufacturer. Basis for CE marking under Arts. 19–20.
6
Download ZIP
5 PDF documents generated in your browser. Add to your technical file alongside test reports and user manual. Retain for 10 years (Art. 10(4)).

Three mistakes children's wearable manufacturers make about RED cybersecurity

COMMON ERROR

"Our GPS watch uses cellular (4G), not WiFi — the Radio Equipment Directive doesn't apply"

Art. 2(1)(1) of Directive 2014/53/EU defines radio equipment as any product that intentionally emits or receives radio waves for communication or radiodetermination. A 4G/LTE module emits radio waves. A GPS receiver uses radio waves for radiodetermination. Your GPS watch is radio equipment on BOTH counts. The Directive applies regardless of the radio technology used.

COMMON ERROR

"The wearable category only applies to adults — our product is for children"

Art. 1(2)(d) of the Delegated Regulation does not distinguish between adult and children's wearables. It applies to ALL radio equipment designed to be worn on any part of the human body. A children's GPS watch is wearable radio equipment. In fact, a children's wearable is MORE regulated: it may also fall under Art. 1(2)(b) (childcare) if designed exclusively for the care of children, triggering Art. 3(3)(e) through TWO separate legal bases.

COMMON ERROR

"We comply with GDPR — that covers the personal data requirement"

GDPR (Regulation 2016/679) regulates how you PROCESS personal data (consent, retention, deletion, rights). Art. 3(3)(e) of Directive 2014/53/EU requires the HARDWARE to incorporate safeguards that PROTECT personal data and privacy. These are complementary obligations: GDPR governs your data practices, RED governs your product's built-in protections. Complying with GDPR does not mean your radio equipment meets Art. 3(3)(e).

What's in the ZIP

5 PDF documents generated from your product data. Each cites the exact article of Directive 2014/53/EU that it covers.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V. Requirement-by-requirement documentation.

3

Risk Assessment

Arts. 3(3)(d) and (e). Structured risk table.

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product) — Real structure, real articles, real format. Fictitious data.

Generated from your data, in your browser. No product data leaves your computer.

What you pay

🧾 NOTIFIED BODY / LAB
€5,000–12,000
Per product model. 3–6 months.
✓ REDCHECK
€99
5 documents covering all applicable articles. 30 minutes per model.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99 per product. The documentation that Art. 21 requires BEFORE your product can bear CE marking.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, you can self-declare via Module A (Annex II) without a Notified Body. If you partially apply or don't apply the harmonised standards, Art. 17(4) requires third-party involvement. REDCheck does not replace a Notified Body — it generates the documentation that is a prerequisite for any conformity route.

We do not sell testing. We do not sell consulting. We sell the tool that structures your cybersecurity documentation under Art. 21 and Annex V.

What happens without cybersecurity documentation

Children's wearables combining location tracking and personal data face heightened enforcement scrutiny.

🧸
Child safety product recall
Immediate + Safety Gate

A children's wearable with cybersecurity vulnerabilities — especially one that tracks location — will be prioritised by market surveillance authorities. Recalls are published in the Safety Gate system.

🇪🇺
Safety Gate (RAPEX) notification
Reputational damage

Non-compliant children's products are published in the EU Safety Gate system. Location-tracking devices for children attract particular media attention.

🛒
Marketplace listing removal
Revenue loss

Amazon, eBay and European marketplaces require conformity documentation. Children's products receive heightened scrutiny. Listings can be removed without prior notice.

Alternatives

AlternativeCostWhat you get
Notified Body / accredited lab€5,000–10,000 per model3–6 months. Full third-party assessment.
Cybersecurity consultancy€5,000–15,000 per modelCustom report. Weeks of wait.
Assemble documentation yourself€0 (your time)EN 18031 has 600+ pages. No template.
REDCheck€995 documents, 30 min, per model

Manufacturing more than one children's wearable model?

If you document 10 or more product models, write to us for the Professional Pack: €999 for 70 generations with a single license key.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case, nor by a commercial buyer in a procurement process.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions — children's wearable cybersecurity compliance

Our GPS watch connects to the internet via a companion app on the parent's phone. Does Art. 3(3)(d) apply?
Yes. Art. 1(1) of the Delegated Regulation applies to radio equipment that can communicate over the internet 'directly or via any other equipment.' The watch → phone → cloud path constitutes indirect internet communication. Art. 3(3)(d) applies.
What exactly is 'location data' under Directive 2002/58/EC?
Art. 2(c) of Directive 2002/58/EC defines location data as 'any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user.' A GPS watch determines and transmits the geographic position of the child wearing it. This is location data. Art. 1(2)(d) of the Delegated Regulation explicitly includes location data as a trigger for Art. 3(3)(e).
Is a children's fitness band without GPS also in scope?
If it processes personal data — yes. Heart rate data, step counts, sleep patterns of an identifiable child are personal data under GDPR Art. 4(1). The fitness band is wearable radio equipment (Art. 1(2)(d)). If it processes personal data, Art. 3(3)(e) applies. GPS is not required — any personal data processing triggers the requirement.
What happens when the CRA replaces the RED cybersecurity requirements?
Delegated Regulation (EU) 2022/30 will be repealed with effect from 11 December 2027, when the Cyber Resilience Act — Regulation (EU) 2024/2847 — enters full application. REDCheck covers the window from 1 August 2025 to 11 December 2027. For CRA documentation from that date, SolidwareTools offers CRACheck.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.
⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

Your children's wearable processes personal data. Cybersecurity documentation is mandatory. Generate it in 30 minutes.

Five PDF documents. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Covers Art. 3(3)(d) and Art. 3(3)(e) as applicable. Your product data never leaves your computer.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate my RED documentation — €99
✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history