## What Has Changed Article 3.3(d)(e)(f) of the RED Directive 2014/53/EU is substantiated through Delegated Regulation (EU) 2022/30, requiring connected wireless devices to meet three categories of requirements: network protection, personal data and privacy protection, and fraud prevention. This means the scope of RED assessment has expanded from "radio frequency + EMC + safety" to "radio frequency + EMC + safety + cybersecurity."
## Why It Is Now Being Exposed in Concentrated Fashion RED reports issued between 2019 and 2022 only cover the traditional three items in their assessment scope. When buyer compliance departments or platforms check against the new requirements, they will find that the reports lack cybersecurity assessment sections and will therefore request supplementation. This is not a case of reports "expiring" but rather "incomplete scope."
## Three Scenarios Enterprises Will Encounter **Scenario One: The product has connectivity functions but no cybersecurity assessment has been conducted.** A gap analysis needs to be supplemented, and then a decision must be made on whether to go the self-declaration route or require NB involvement.
**Scenario Two: An IEC 62443 or ETSI EN 303 645 report already exists.** This is a favorable foundation, but it is still necessary to confirm the correspondence between the assessment items and the RED Delegated Regulation — the two are not a one-to-one mapping.
**Scenario Three: The product is merely a simple peripheral with Bluetooth.** If it genuinely does not have networked data processing capability, the rationale for applicability exclusion can be stated in the technical documentation, but there must be a basis for it — simply writing "not applicable" is not acceptable.
## Practical Recommendations 1. First conduct an applicability determination: whether the product has the capability to transmit data over a network. 2. If it has such capability, conduct a gap analysis according to EN 303 645 or the EN 18031 series. 3. Write the conclusions into the technical documentation to form a traceable assessment record. 4. For existing projects, supplement at the next standard review to avoid a second round of assessment.
## Note This article is an industry observation and does not constitute legal advice. For the specific applicable dates and exemption circumstances of the Delegated Regulation, please refer to the Official Journal of the European Union and Commission explanations.