Radio equipment, Bluetooth and Wi-Fi devices

• Directive 2014/53/EU — Radio Equipment
• Delegated Regulation (EU) 2022/30 — cybersecurity requirements
• Directive 2011/65/EU — RoHS
• Regulation (EU) 2024/2847 — CRA, from 2026 and 2027
• Regulation (EU) 2019/1020 — Article 4

Who has to appoint one

Manufacturers outside the Union placing on the EU market any product that intentionally transmits or receives radio waves for communication or radiodetermination. That includes Bluetooth accessories, Wi-Fi devices, smart speakers, drones, wearables, remote controls, NFC-enabled products and any device with a cellular module. Importers who brand the product become manufacturers. Distance sellers need an EU-established operator under Article 4.

Thresholds and exemptions

No threshold. The Radio Equipment Directive replaces the Low Voltage and EMC Directives for products in its scope, so a wireless device is assessed under RED rather than LVD, and the essential requirements of both are carried across. Products that only receive broadcast radio or television are in scope too.

What must appear on the label

CE marking. Manufacturer's name, registered trade name or trade mark, and postal address, plus the same for the importer or authorised representative. Type, batch or serial number. Where the equipment is restricted in use in any member state, a short indication on the packaging identifying the restrictions. The instructions must state the frequency bands in which the equipment operates and the maximum radio-frequency power transmitted in those bands.

Marketplace fields

Amazon and other marketplaces request the declaration of conformity for radio products on challenge and block listings that cannot produce one. Since 1 August 2025 the cybersecurity requirements of the delegated Regulation apply, and listings for connected devices are increasingly asked for evidence of compliance with EN 18031. Drones face an additional class-marking regime under the EU drone rules.

Documentation you must hold

EU declaration of conformity, which for radio equipment must be supplied in full or as a simplified declaration with an internet address. Technical documentation with the design, the radio test reports, the assessment of conformity with the essential requirements, and where harmonised standards were not applied in full, the notified body opinion. From August 2025, the documentation showing how the network protection, personal data protection and fraud prevention requirements are met. From December 2027, the CRA technical documentation and SBOM on top.

Standards and testing

EN 300 328 for wideband 2.4 GHz, EN 301 893 for 5 GHz RLAN, EN 301 511 and EN 301 908 for cellular, EN 303 645 as the baseline for consumer IoT security and the EN 18031 series for the delegated Regulation requirements. EN IEC 62368-1 for safety and the EN 301 489 series for electromagnetic compatibility. Radio parameters must be measured by a competent laboratory; self-declaration is possible where harmonised standards are applied in full, otherwise a notified body must be involved.

Language requirements

Instructions, safety information and the information on frequency bands and power in the language of each member state where the equipment is made available. The declaration of conformity or the simplified declaration must be translated into the language required by that state.

When it applies

Documentation before placing on the market. The cybersecurity requirements under Articles 3(3)(d), (e) and (f) have applied since 1 August 2025 with no transition remaining. CRA vulnerability reporting starts 11 September 2026 and the full CRA regime on 11 December 2027, at which point the two frameworks overlap for connected radio products.

How long records are kept

Technical documentation and the declaration of conformity for ten years from placing on the market. Where the CRA applies, for the support period if longer.

What happens if you do not comply

Radio products are checked at the EU border more often than most categories, because the marking and the EU address are easy to verify and non-compliant transmitters cause interference. Consequences run from customs refusal and destruction, through withdrawal orders and Safety Gate alerts, to national fines. Interference with licensed spectrum can also bring action from the national radio regulator, separately from market surveillance.

Who enforces it

National market surveillance authorities and national radio spectrum regulators, customs at import, and notified bodies where harmonised standards are not applied in full.

Where the boundary lies

Adding any wireless function moves a product from the Low Voltage and EMC Directives into RED, and that surprises manufacturers who add a Bluetooth module to an existing product without redoing the assessment. Conversely a passive accessory — a cable, a case — is not radio equipment. From December 2027 the CRA adds obligations that RED cybersecurity does not cover, in particular vulnerability handling and the support period, so compliance with EN 18031 will not be sufficient on its own.

Questions we are asked

Does a USB dongle need this?

If it transmits or receives radio waves, yes. If it is a passive cable or a wired adapter, it falls under the Low Voltage and EMC Directives instead.

We already comply with FCC rules — does that help?

The test data may be partly reusable, but the FCC limits, the frequency allocations and the essential requirements differ. An FCC ID has no legal effect in the Union and cannot appear in place of the EU declaration.

What changed on 1 August 2025?

The delegated Regulation made three cybersecurity essential requirements applicable to most internet-connected radio equipment: protection of the network, protection of personal data and privacy, and protection from fraud. Products placed on the market after that date must meet them.

Are drones covered by this?

Yes for their radio function, and separately by the EU drone Regulations 2019/945 and 2019/947 for the class marking and the operational rules. Both apply at once.