Directive 2014/53/EU · Del. Reg. 2022/30Generate my documentation — €99
ACTIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

Your wearable is worn on the body. Under Delegated Regulation (EU) 2022/30, Art. 3(3)(e) applies to it even if it has no WiFi — because it processes personal data. UKCA does not cover this requirement. Without EU cybersecurity documentation, your wearable cannot be sold in Europe.

You are a UK wearable company — fitness trackers, smartwatches, health bands, earbuds, smart rings. You have UKCA marking for the UK. For the EU, you need CE marking. From 1 August 2025, Delegated Regulation (EU) 2022/30 activates Art. 3(3)(e) for wearable radio equipment under Art. 1(2)(d) — any device worn on the body (wrist, head, neck, trunk, feet) that processes personal data. Heart rate, step count, sleep patterns, GPS location, voice recordings — all personal data under Art. 4(1) of the GDPR. The UK has no equivalent requirement. A European consultancy quotes £8,000–15,000 per model. REDCheck generates the 5 PDF documents. 30 minutes. €99 per product.

Generate my RED documentation — €99Free: does my wearable need RED cybersecurity documentation?

€99 one-time payment · 5 PDF documents in ZIP · 30 minutes · 100% in your browser

Directive 2014/53/EU · Art. 3(3)(d)(e)(f) · Art. 21 + Annex V · Art. 18 + Annex VI · Art. 10(9) + Annex VII · Delegated Reg. (EU) 2022/30 · EN 18031-1, -2, -3

Cybersecurity documentation for wearables: the numbers

Wearable radio equipment has the broadest scope under Delegated Regulation (EU) 2022/30. Art. 1(2)(d) applies Art. 3(3)(e) to wearables that process personal data — regardless of whether they connect to the internet. If they DO connect to the internet, Art. 3(3)(d) applies too.

Art. 1(2)(d)
Wearable radio equipment — worn on the body — subject to Art. 3(3)(e) even without internet if it processes personal data
Double scope
If your wearable also connects to the internet (WiFi, or via a companion app), Art. 3(3)(d) applies in addition to Art. 3(3)(e)
£8,000–15,000
European consultancy cost per model. REDCheck: €99

What REDCheck does with your wearable data

You enter your product specifications. REDCheck structures the cybersecurity documentation requirement by requirement, following the EN 18031 categories.

1
Company details
Legal name, role under Directive 2014/53/EU (manufacturer, Art. 10), country of manufacture, EU contact.
2
Product classification
Determines which essential requirements apply: Art. 3(3)(e) (personal data) for all wearables that process personal data. Art. 3(3)(d) (network protection) if your wearable also connects to the internet.
3
Cybersecurity assessment
Requirement-by-requirement review mapped to EN 18031-1 (network) and EN 18031-2 (personal data) categories: access control, authentication, secure communications, software updates, vulnerability management.
4
Risk assessment
Assessment of implementation status for each applicable requirement of Arts. 3(3)(d) and (e). Maps your answers to a structured risk table.
5
EU Declaration of Conformity
Formal declaration under Art. 18 and Annex VI. Signed by the manufacturer. Basis for CE marking under Arts. 19–20.
6
Download ZIP
5 PDF documents generated in your browser. Add to your technical file alongside test reports and user manual. Retain for 10 years (Art. 10(4)).

Three mistakes UK wearable companies make about EU cybersecurity

COMMON ERROR

"My fitness tracker only uses BLE — no internet, no cybersecurity"

Art. 1(2)(d) of Delegated Regulation (EU) 2022/30 applies Art. 3(3)(e) to wearable radio equipment that processes personal data — REGARDLESS of internet connectivity. A fitness tracker worn on the wrist that records heart rate, step count or sleep patterns processes personal data under Art. 4(1) GDPR. Internet is irrelevant. Art. 3(3)(e) applies to your BLE-only tracker.

COMMON ERROR

"UKCA certification covers us for EU wearable compliance"

Since Brexit, UKCA is valid only in Great Britain. The UK has NOT adopted Delegated Regulation (EU) 2022/30. There is no UKCA equivalent of Art. 3(3)(e) for wearables. For the EU market, CE marking under Directive 2014/53/EU with cybersecurity documentation is a separate, mandatory requirement.

COMMON ERROR

"The UK PSTI Act covers the same ground"

The UK Product Security and Telecommunications Infrastructure Act 2022 focuses on passwords, vulnerability reporting and update periods for consumer connectable products. It does NOT require cybersecurity technical documentation under EN 18031 mapped to Annex V. It is a different regime with different requirements. Compliance with PSTI does not satisfy Directive 2014/53/EU.

What's in the ZIP

5 PDF documents generated from your wearable data. Each cites the exact article of Directive 2014/53/EU that it covers.

1

Product Classification

Art. 1, Del. Reg. (EU) 2022/30 + Art. 3(3), Dir. 2014/53/EU.

2

Cybersecurity Technical Documentation

Art. 21 + Annex V. Requirement-by-requirement documentation.

3

Risk Assessment

Arts. 3(3)(d) and (e). Structured risk table.

4

EU Declaration of Conformity

Art. 18 + Annex VI.

5

Simplified Declaration + Label

Art. 10(9) + Annex VII.

Look before you buy — Download sample dossier (PDF, fictitious product) — Real structure, real articles, real format. Fictitious data.

Generated from your data, in your browser. No product data leaves your computer.

What you pay

🧾 EU CONSULTANCY
£8,000–15,000
Per product model. Weeks of wait. 4 models (band, watch, ring, earbud) = £32,000–60,000.
✓ REDCHECK
€99
5 documents. 30 minutes per model. 4 models = €396.

Technical documentation and third-party testing: two layers

● LAYER 1

Cybersecurity technical documentation (Annex V)

5 PDF documents. 30 min. €99 per product. The documentation that Art. 21 requires BEFORE your product can bear CE marking.

∅ LAYER 2

Conformity assessment by a Notified Body

If you fully apply EN 18031, you can self-declare via Module A (Annex II) without a Notified Body. If you partially apply or don't apply the harmonised standards, Art. 17(4) requires third-party involvement. REDCheck does not replace a Notified Body — it generates the documentation that is a prerequisite for any conformity route.

We do not sell testing. We do not sell consulting. We sell the tool that structures your cybersecurity documentation under Art. 21 and Annex V.

What happens without cybersecurity documentation

Art. 46 of Directive 2014/53/EU requires Member States to establish penalties that are effective, proportionate and dissuasive.

🇪🇺
Market withdrawal and sales prohibition
Immediate

Art. 40 of Directive 2014/53/EU. Market surveillance authorities can require withdrawal across all 27 Member States.

🛒
Amazon DE / FR listing suspension
Revenue loss

Amazon EU marketplaces require CE conformity documentation. UKCA is not accepted. Wearable listings without cybersecurity documentation may be suspended without notice.

🔒
GDPR overlay
Up to €20M or 4% of turnover

A wearable that processes personal data without adequate cybersecurity safeguards may also trigger GDPR enforcement. Art. 3(3)(e) and GDPR protect the same data — a failure in one regime signals a risk in the other.

Alternatives

AlternativeCostWhat you get
EU cybersecurity consultancy£8,000–15,000Per model. Weeks of wait.
UK-based regulatory advisor£5,000–10,000May not know EN 18031 structure.
Assemble documentation yourself£0 (your time)EN 18031 has 600+ pages. No template.
REDCheck€995 documents, 30 min, per model

Launching more than one wearable model in the EU?

If you document 10 or more product models, write to us for the Professional Pack: €999 for 70 generations with a single license key. One generation per product model.

Request volume pricing
Reply within one business day.

What REDCheck guarantees and what it does not

REDCheck generates a document structured under Art. 21 and Annex V of Directive 2014/53/EU based on the information you enter. The truthfulness, accuracy and completeness of that information is your responsibility as manufacturer of the radio equipment.

We guarantee that the document structure follows Art. 21 and Annex V of Directive 2014/53/EU and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case, nor by a commercial buyer in a procurement process.

REDCheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions — EU cybersecurity for UK wearables

What counts as personal data for a wearable?
Personal data is defined in Art. 4(1) of Regulation (EU) 2016/679 (GDPR) as any information relating to an identified or identifiable natural person. For wearables, this includes: heart rate, step count, sleep patterns, GPS location, skin temperature, blood oxygen, voice recordings, user account data in a companion app. If your device records any of these, it processes personal data.
My wearable connects to the internet via a companion app. Does Art. 3(3)(d) apply too?
Yes. If your wearable communicates over the internet — directly via WiFi, or indirectly via a phone app that sends data to a cloud server — it is internet-connected radio equipment under Art. 1(1) of Delegated Regulation (EU) 2022/30. Art. 3(3)(d) applies in addition to Art. 3(3)(e). Both requirements must be documented.
Are medical wearables excluded?
Yes — if your wearable falls under Regulation (EU) 2017/745 (Medical Devices Regulation), Art. 2(1)(a) of Delegated Regulation (EU) 2022/30 excludes it from the cybersecurity requirements of Art. 3(3)(d), (e) and (f). Medical device regulations address cybersecurity separately. If your wearable is NOT classified as a medical device, the exclusion does not apply.
Can I use Module A (self-declaration) instead of a Notified Body?
If you fully apply the harmonised standards EN 18031-1, EN 18031-2 and, where applicable, EN 18031-3, you can use Module A (self-declaration, Annex II) under Art. 17(3)(a) of Directive 2014/53/EU. No Notified Body required. If you partially apply or do not apply the standards, Art. 17(4) requires a Notified Body (Module B+C or Module H). REDCheck generates the documentation for both routes.
What happens when the CRA replaces the RED cybersecurity requirements?
The Cyber Resilience Act (Regulation (EU) 2024/2847) will gradually replace the cybersecurity requirements of Art. 3(3)(d), (e) and (f) of Directive 2014/53/EU. The transition is expected by 2027–2028. Until the CRA fully applies, the RED cybersecurity requirements remain in force. Documentation generated now remains valid for products placed on the market during the RED regime.
Is it a subscription?
No. One-time payment. Each license includes a 30-day editing window and up to 10 regenerations. The 5 PDF documents you download are yours permanently.
Can I request a refund?
Under Art. 16(m) of Directive (EU) 2011/83 on consumer rights, by activating the license you give express consent to the immediate generation of the digital content, waiving the 14-day right of withdrawal. Refunds are accepted only for reproducible technical failures reported to hello@solidwaretools.com within 14 days of purchase.
What if the regulation changes?
If Directive 2014/53/EU, Delegated Regulation (EU) 2022/30 or the EN 18031 standards change during your license validity period, you can regenerate the documents with the updated version of the generator at no additional cost.
⚠️ Important notice: REDCheck is a documentary self-assessment tool, not legal advice or a third-party audit. The document is generated from the data you enter. The accuracy of the data is your responsibility under Art. 10(1) of Directive 2014/53/EU. REDCheck does not replace a conformity assessment by a Notified Body where required under Art. 17(4) of the Directive.

Art. 3(3)(e) applies to your wearable. Generate the cybersecurity documentation in your browser in 30 minutes.

Five PDF documents. Art. 21 and Annex V fully structured. Directive 2014/53/EU. Your product data never leaves your computer. The ZIP you download is yours permanently.

€99 per product
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing window · Professional Pack: €999
Generate my RED documentation — €99
✓ Last regulatory check: 6 May 2026 · No substantive changes detected · View history