Cybersecurity testing of radio equipment moves under the Cyber Resilience Act
On 16 February 2026 the Commission adopted a regulation repealing delegated act 2022/30 with effect from 11 December 2027. Until that day the radio directive requirements apply, from the next one the Cyber Resilience Act takes over.
- Delegated act 2022/30 activated the essential cybersecurity requirements for some radio equipment; they apply to products placed on the market from 1 August 2025.
- The repeal takes effect on 11 December 2027, the day the Cyber Resilience Act — Regulation (EU) 2024/2847 — becomes fully applicable.
- Products placed on the market between 1 August 2025 and 10 December 2027 remain subject to the radio directive requirements and to market surveillance on that basis.
- For testing laboratories and notified bodies this means a period in which two legal bases run in parallel for different vintages of product — and therefore two sets of documentation.