What Is the EU RED (Radio Equipment Directive)?

What Is the Radio Equipment Directive?

The Radio Equipment Directive (RED), formally known as Directive 2014/53/EU, is European Union legislation that governs all radio equipment placed on the EU market. It replaced the earlier R&TTE Directive (1999/5/EC) in June 2016 and applies to any device that intentionally transmits or receives radio waves for communication or radio determination purposes.

The RED covers a broad category of products: smartphones, WiFi routers, Bluetooth devices, IoT sensors, walkie-talkies, radar equipment, and wireless security research tools. If a device uses radio frequencies and is sold in the European Economic Area (EEA), it must comply with the RED.

Unlike the FCC system in the United States (which relies on government-issued certification), the RED uses a self-declaration model for most product categories. The manufacturer or their authorized representative declares that the product meets the directive's requirements, marks it with the CE symbol, and creates a Declaration of Conformity document.

However, "self-declaration" does not mean "no testing." Manufacturers must have their products tested against harmonized European standards (EN standards) by accredited laboratories. The test results support the Declaration of Conformity.

graph TD
    subgraph "RED Compliance Framework"
        A[Radio Equipment Directive 2014/53/EU] --> B[Article 3.1 - Safety]
        A --> C[Article 3.2 - Spectrum Use]
        A --> D[Article 3.3 - Additional Requirements]
        B --> E[LVD - Electrical Safety]
        B --> F[EMC - Electromagnetic Compatibility]
        C --> G[Efficient Use of Spectrum]
        C --> H[No Harmful Interference]
        D --> I[Network Security - New 2022]
        D --> J[Privacy Protection - New 2022]
        D --> K[Fraud Prevention - New 2022]
    end

RED structure - core articles and the 2022 cybersecurity additions

Key Articles of the RED

The RED organizes its technical requirements under Article 3, which has three main sections:

Article 3.1 - Health and Safety: Radio equipment must be constructed to ensure the health and safety of persons, domestic animals, and property. This aligns with the Low Voltage Directive (LVD) for electrical safety and includes requirements for electromagnetic compatibility (EMC). Devices must not emit excessive electromagnetic radiation and must function properly in the presence of normal electromagnetic interference.

Article 3.2 - Efficient Use of Radio Spectrum: Radio equipment must use the radio spectrum effectively to avoid harmful interference. This is the European equivalent of the FCC's Part 15 interference rules. Devices must operate within their assigned frequency bands, stay within power limits defined by ETSI (European Telecommunications Standards Institute) standards, and not cause interference to other radio services.

Article 3.3 - Additional Essential Requirements: This section allows the European Commission to add requirements for specific product categories. Originally covering features like emergency calling (E112) and accessibility, this section gained significant new scope in 2022 with the addition of cybersecurity requirements.

The 2022 Cybersecurity Additions

In January 2022, the European Commission published Delegated Regulation (EU) 2022/30, adding three new cybersecurity requirements to Article 3.3 of the RED. These requirements, which become mandatory in 2025, represent a major shift in how the EU regulates radio equipment.

Article 3.3(d) - Network Protection: Radio equipment must not harm the network or its functioning, and must not misuse network resources. This means devices must be designed so they cannot be easily exploited to launch attacks against network infrastructure.

Article 3.3(e) - Personal Data Protection: Radio equipment must include safeguards to ensure the protection of personal data and privacy. Default passwords are prohibited. Devices must implement proper authentication mechanisms.

Article 3.3(f) - Fraud Protection: Radio equipment must support features that minimize the risk of fraud. This includes secure software update mechanisms and protection against unauthorized firmware modification.

These additions were motivated by the rapid growth of IoT devices with poor security practices - devices shipping with default passwords like "admin/admin," lacking encryption, and having no mechanism for security updates.

graph TD
    subgraph "2022 Cybersecurity Requirements"
        A[Delegated Regulation EU 2022/30] --> B[Article 3.3d - Network Protection]
        A --> C[Article 3.3e - Privacy Protection]
        A --> D[Article 3.3f - Fraud Prevention]
        B --> E[No Network Harm]
        B --> F[No Resource Misuse]
        C --> G[No Default Passwords]
        C --> H[Proper Authentication]
        D --> I[Secure Updates]
        D --> J[Firmware Protection]
        E --> K[Mandatory 2025]
        G --> K
        I --> K
    end

The three cybersecurity pillars added to the RED in 2022

How the RED Affects Security Tools

The RED's spectrum use requirements (Article 3.2) have direct implications for wireless security tools sold in the EU. A device that actively transmits on frequencies it does not control - such as sending deauthentication frames on someone else's WiFi channel - raises compliance concerns under Article 3.2's requirement to avoid harmful interference.

Active interference techniques like WiFi deauthentication involve transmitting management frames on channels occupied by other access points. From the RED's perspective, this is a device causing interference to other radio equipment's normal operation. While the FCC's approach to deauthentication is somewhat ambiguous, the EU's regulatory framework treats active interference more strictly.

Passive operations like WiFi scanning and BLE scanning do not raise RED concerns because they involve receiving signals, not transmitting interference. The distinction between active transmission and passive reception is central to RED compliance for security tools.

The cybersecurity additions (Articles 3.3d/e/f) add another layer. Security tools that could be used to misuse network resources must demonstrate that they include appropriate safeguards. This does not mean the tools cannot exist - it means they must be designed with controls that prevent misuse.

The BLEShark Nano and EU Compliance

The BLEShark Nano addresses RED compliance through regional firmware variants. The EU firmware version makes specific modifications to ensure compliance with the directive:

Deauthentication disabled: The WiFi deauthentication feature is disabled in EU firmware. Because deauthentication involves active transmission on frequencies controlled by other operators, disabling it removes the Article 3.2 compliance concern.

Handshake capture is passive-listen only: WiFi handshake capture in EU firmware operates exclusively in passive monitoring mode. The device listens for handshake packets that naturally occur when devices connect to access points. It does not transmit any frames to force handshakes. This keeps the operation within the bounds of passive reception.

These firmware modifications demonstrate a practical approach to regional compliance. The hardware is identical worldwide - the same ESP32-C3 chip, the same antenna, the same radio characteristics. The firmware determines which features are available based on the regulatory requirements of the target market.

CE Marking as the Compliance Indicator

CE marking on a device indicates that the manufacturer declares compliance with all applicable EU directives, including the RED. For the BLEShark Nano, the CE mark confirms that the device - with its EU firmware - meets the RED's requirements for safety, spectrum use, and the applicable cybersecurity provisions.

The CE mark is not a government approval stamp. It is the manufacturer's declaration, backed by test reports from accredited laboratories. However, market surveillance authorities in EU member states can and do check products for compliance. Non-compliant products can be pulled from the market, and manufacturers face penalties.

graph LR
    subgraph "RED Compliance Path"
        A[Manufacturer] --> B[Test Against EN Standards]
        B --> C[Accredited Lab Reports]
        C --> D[Technical Documentation]
        D --> E[Declaration of Conformity]
        E --> F[CE Mark Applied]
        F --> G[Legal to Sell in EU/EEA]
        G --> H[Market Surveillance]
        H -->|Non-Compliant| I[Product Recall]
        H -->|Compliant| J[Continued Sale]
    end

The path from testing to CE marking and market access

RED vs FCC - Key Differences

The RED and FCC regulatory systems share the same goal - managing radio spectrum use and preventing harmful interference - but they differ in several important ways:

Authorization model: The FCC requires government-issued certification (FCC ID). The RED uses manufacturer self-declaration with CE marking. Both require accredited lab testing, but the approval authority differs.

Power limits: ETSI standards (used under the RED) generally set lower power limits than the FCC. For 2.4 GHz, the EU allows 100 mW (20 dBm) EIRP compared to the FCC's 4W (36 dBm) EIRP. This tenfold difference affects wireless range.

Cybersecurity requirements: The RED now includes explicit cybersecurity requirements (Articles 3.3d/e/f). The FCC has no equivalent cybersecurity mandate for radio equipment.

Scope: The RED covers all radio equipment including receivers. The FCC's Part 15 primarily focuses on transmitters and unintentional radiators.

Conclusion

The EU Radio Equipment Directive establishes the regulatory framework for every wireless device sold in Europe. Its 2022 cybersecurity additions represent a significant expansion of what "radio equipment compliance" means - moving beyond spectrum management into network security, privacy, and fraud prevention.

For wireless security tools, the RED's requirements create clear boundaries. Active interference techniques like deauthentication conflict with Article 3.2's interference prevention mandate. Passive operations like scanning remain unaffected. The BLEShark Nano's EU firmware reflects these boundaries directly - disabling features that would conflict with RED requirements while maintaining full passive analysis capabilities.