Radio Equipment Directive (RED):
Secure networking, starting with the development process.
IEC 62443-4-1 · Certified security
5-year warranty · 10+ years of service life
RED-Ready · Secure products
Made in Germany · Developed in Regensburg
What is the Radio Equipment Directive?
With the Radio Equipment Directive (RED) 2014/53/EU, the European Union establishes uniform requirements for placing radio equipment on the European internal market. In response to increasing cyber threats, mandatory cybersecurity provisions have been added to these requirements. They have applied to certain types of radio equipment since 1 August 2025.
The extended RED requirements aim to ensure a uniform level of protection across the EU internal market. They focus in particular on network security, the protection of personal data and privacy, and the prevention of fraud and misuse. Affected products include internet-enabled radio equipment such as industrial routers that connect to networks or enable communication between devices.
Manufacturers must take cybersecurity into account during the development and design of their radio equipment and demonstrate compliance with the relevant requirements as part of the conformity assessment. These include protection against unauthorised access and ensuring the confidentiality, integrity and availability of data and functions. The harmonised standards EN 18031-1:2024, EN 18031-2:2024 and EN 18031-3:2024 are particularly relevant to technical implementation.
What is new in the extended Radio Equipment Directive?
The original Radio Equipment Directive focused on essential requirements for radio equipment, particularly electromagnetic compatibility (EMC) and the efficient use of the radio spectrum. The latest revision adds specific cybersecurity provisions to these requirements.
New mandatory requirements apply, particularly to devices with an internet connection:
These changes address the growing threat landscape for connected products.
Who is affected?
The new requirements of the Radio Equipment Directive affect a wide range of stakeholders along the value chain for connected radio equipment. The following groups in particular must prepare for the stricter security requirements:
Relevant industries: Energy supply, transport, water supply and wastewater management, healthcare, public administration, industrial automation and other security-relevant sectors with internet or wireless connectivity
Designed for secure products. Built for reliable infrastructure.
Cybersecurity that protects people and infrastructure.
“Trust and stability are crucial in industrial networks. What inspires me is that our solutions help reliably secure critical processes in areas such as water and energy supply.”
René Al-Abid
Head of Product
What does the Radio Equipment Directive mean in practice?
Specific obligations:
Operational requirements:
Evidence requirements:
What needs to be done?
The extended requirements of the Radio Equipment Directive have applied since 1 August 2025. No transitional period is provided for. The requirements have been binding for all affected devices since that date.
Key challenges:
Sabine Bleicher
Sales INSYS icom
Quick answers, clear solutions, here to help you personally
What are the penalties?
Non-compliance with the RED cybersecurity requirements can have serious consequences:
We think a thousand steps ahead
So you can take the next one.
01
Secure throughout the lifecycle
State-of-the-art hardware, Secure Boot and long-term update capability. For infrastructure that needs to stay protected today and tomorrow.
02
Security audits
Audit-proof logging of all configuration changes and access to the router.
03
Lower risk. Greater cost-effectiveness
Fewer security risks, less maintenance and predictable operating costs. Optimised for low total costs throughout the entire lifecycle.
04
One system. One contact person
Routers, VPN, management and connectivity from a single source. Seamlessly integrated and secured end to end.
05
Rugged design for long-term industrial use
Wide temperature range, vibration resistance and unbeatable quality made in Germany. From the housing to the SIM card, no compromises on security or industrial quality.
06
Secure all the way to the edge
Local data processing with containers directly on the router. Stay in control, reduce dependencies and protect data.
Update management in accordance with RED:
Implementation with icom Router Management
icom Router Management (iRM) provides a RED-compliant update infrastructure in accordance with EN 18031-1 and ensures a secure update mechanism. Whether automated or subject to release, iRM supports the secure implementation of key requirements for protecting radio equipment. With strong cryptography and tamper-proof distribution, iRM sets the standard for secure, scalable and RED-compliant device management throughout the entire lifecycle.
| RED requirement (in accordance with EN 18031-1) | Implementation through iRM + icom OS |
|---|---|
| Remote software/firmware updates must be secure and authorised | iRM uses certificate-based signing and encryption of update packets, which routers running icom OS validate before installation. |
| Updates must prevent unauthorised changes | Optionally, only packets with a verified digital signature or encrypted content from a trusted certification authority can be accepted. |
| Update strategies must be fail-safe | Updates can be scheduled, released manually or performed unattended. This ensures flexible and secure provision of updates. |
| Integrity and authenticity checks before execution | Routers check integrity using hashes and require the use of verified certificates. |
| Protection against manipulation | Routers reject unsigned or unverified packets. Customers can define enforcement guidelines on the router. |
| Human supervision is possible but not required | iRM supports fully automated, semi-automated or manually supervised updates. This meets the RED requirement for updates “with release or without risk”. |
| Traceability of updates and access | All update actions are logged, displayed in the iRM dashboard and traceable for audit purposes. |
Get exclusive video access now
Complete the form to get immediate access to the expert talk.
Expert talk on the Radio Equipment Directive
In this expert talk, INSYS icom shows how to achieve RED compliance and cybersecurity
in practice.
Security & Compliance
Find relevant evidence and documents on RED compliance, certified development processes and IT security measures at INSYS icom here.
H. Tautor
Head of Sales
L. Abu Isbeih
Senior Key Account Manager
A. Wels
Vice president Project Business icom
Personal consultation directly from the manufacturer
Based in Regensburg, our experts are on hand to assist you with selection, configuration, and migration – from the pilot phase through to successful operation.
Radio Equipment Directive – Frequently asked questions
When do the new RED cybersecurity requirements apply?
The new requirements have been mandatory since 1 August 2025. No transitional period is provided for.
Which products are affected by the RED cybersecurity requirements?
All radio equipment that enables communication over the internet or controls internet-based communication processes is affected.
How does INSYS icom support implementation?
INSYS icom supports implementation with secure hardware, a BSI-compliant software architecture, encrypted VPN connections and automated security updates, including audit-proof evidence documentation through icom Router Management.
What is audit-proof evidence documentation?
Changes to configurations and system access are automatically logged and securely archived. The evidence is protected against subsequent alteration and remains traceable at all times.
How does icom Router Management support the implementation of RED cybersecurity requirements?
icom Router Management enables automated software updates, centralised management of device configurations and audit-proof documentation of security-relevant processes.
Does the INSYS icom VPN service meet the requirements of the Radio Equipment Directive?
Yes, icom Connectivity Suite – VPN provides encrypted connections with strong authentication, meeting key RED cybersecurity requirements.
INSYS icom also meets these cybersecurity requirements
NIS 2
The NIS-2 Directive (Network and Information Security) sets binding cybersecurity requirements for critical infrastructure.
Cyber Resilience Act (CRA)
The CRA requires manufacturers of digital products to ensure cybersecurity throughout the entire product lifecycle.
Secure.
Designed as a system
With routers and services, as well as icom Connectivity Suite – VPN (iCS) and icom Router Management (iRM), we support you in implementing the CRA requirements – for secure products and protected operation throughout the entire lifecycle.
Any questions? We will be happy to advise you!