What is the Cyber Resilience Act (CRA)?
The CRA is Regulation (EU) 2024/2847. It applies to hardware and software with a direct or indirect data connection to a device or network, and to the remote services the product needs. In practice, a PoC radio fits that wording, and so do its app and cloud backend when the maker provides them.12
For a radio maker this adds a security duty on top of the Radio Equipment Directive. The product must be secure when it is sold, stay patchable, and carry a CE mark that also confirms CRA compliance.1 The wider picture is in radio regulations by region.
What are the key dates of the Cyber Resilience Act?
The Act entered into force on 10 December 2024. Its duties arrive in three steps: notified bodies from 11 June 2026, reporting from 11 September 2026, and everything else from 11 December 2027. Check the Commission's CRA page for the current text and dates.13
| Date | What happens |
|---|---|
| 10 Dec 2024 | The CRA enters into force12 |
| 11 Jun 2026 | Rules for conformity assessment bodies (notified bodies) apply1 |
| 11 Sep 2026 | Makers must report actively exploited vulnerabilities and severe incidents; the ENISA reporting platform opens16 |
| 11 Dec 2027 | The CRA applies in full: Annex I requirements, support period, CE marking under the CRA1 |
| 11 Dec 2027 | Delegated Regulation 2022/30 under the RED is repealed9 |
| 11 Jun 2028 | Last day that EU type-examination certificates issued under other harmonization law stay valid under the transition rule1 |
Which radios does the Cyber Resilience Act cover?
The test is a data connection. In practice, a radio that connects to a network, to a phone over Bluetooth, or to a computer over USB for programming or updates fits the scope. An analog PMR446 radio with no data interface does not.145
| Radio type | Fits the CRA wording? | Why |
|---|---|---|
| PoC or LTE radio (Android or RTOS) | Yes | Network connection; the PoC app and the maker's cloud are part of the product1 |
| Radio with Bluetooth (headset, app pairing) | Yes | The Commission FAQ names Bluetooth as a physical data connection4 |
| DMR or other radio with a USB programming port | Yes | A USB data connection for programming or firmware45 |
| Radio programmed by a PC app or proprietary cable | Yes | A data connection; the programming software sold by the maker is itself a product with digital elements5 |
| USB port that only charges | No, by itself | A signal that only powers a function carries no encoded data; once the port carries data it is in scope5 |
| Analog PMR446 walkie-talkie with no Bluetooth, USB data or app | No | It has no data connection to a device or network; it stays under the RED15 |
The special classes in Annex III and IV list items such as operating systems, routers, modems and secure elements, and the category depends on the product's core function.110 No line names a two-way radio. In practice a finished radio is a standard product that the maker assesses with internal control, while a cellular modem or Bluetooth module sold on its own can fall under those lists.
See PMR446 for the analog class and 4G LTE walkie-talkies for the network class.
What must makers do under the Cyber Resilience Act?
From 11 December 2027 a maker must meet the Annex I requirements, run a vulnerability-handling process, keep technical documentation, sign an EU declaration of conformity and affix the CE mark. Security updates must be free of charge for the whole support period, and users get advice with each update.1
Annex I in plain words:
- No known exploitable vulnerabilities when the radio is sold.
- Secure default settings and a way to reset to them.
- Security updates, automatic by default, with an option to postpone.
- Access control and authentication; encryption of data at rest and in transit.
- Data minimization, a limited attack surface and protection against denial of service.
- Security logging and a simple way for the user to erase data.
Vulnerability handling (Annex I, Part II) adds a software bill of materials (SBOM) in machine-readable form, fixes "without delay", regular security testing, a public disclosure policy and one contact address for reports.1
How long must a maker support a radio?
The support period must reflect how long the radio is expected to be used, and it is at least five years. The end date, with month and year, must be clear when you buy. Each security update stays available for at least 10 years or for the rest of the support period, whichever is longer.1
Five years is the floor. A radio that fleets run for seven or eight years calls for a longer commitment.15 The technical documentation and the declaration of conformity are kept for 10 years or for the support period, whichever is longer.1
How do makers report vulnerabilities to ENISA?
A maker reports an actively exploited vulnerability in three steps: an early warning within 24 hours, a notification within 72 hours and a final report within 14 days after a fix or mitigation is available. The report goes through ENISA's single reporting platform.16
| Step | Deadline for an actively exploited vulnerability |
|---|---|
| Early warning | 24 hours after the maker becomes aware |
| Vulnerability notification | 72 hours |
| Final report | 14 days after a corrective or mitigating measure is available |
A severe incident that affects the product's security follows 24 hours, 72 hours and a final report within one month. The platform sends the report to the national CSIRT of the maker's main EU establishment and to ENISA at the same time. Makers also inform affected users.16 Since 11 September 2026 this duty covers products already on the market.1
What must importers and distributors do?
An importer places only compliant radios on the EU market. It checks that the conformity assessment was done, the technical documentation exists, the CE mark and the EU declaration are present, and the maker's name and contact details are on the product. A distributor checks the same CE mark and papers with due care.1
Importers add their own name and address to the product and keep the declaration for 10 years or the support period. Both tell the maker about vulnerabilities they learn of and stop supplying a non-conforming radio.1
A shop that sells a radio under its own brand or substantially modifies it counts as the manufacturer and carries the maker's duties.1
How does the CRA relate to RED Delegated Regulation 2022/30?
Until 10 December 2027, internet-connected radios sold in the EU follow the RED security rules in Delegated Regulation 2022/30, which applies since 1 August 2025. From 11 December 2027 the CRA covers those risks, and Delegated Regulation 2026/339 repeals 2022/30 from that date.789
| Placed on the EU market | Security rules that apply |
|---|---|
| 1 Aug 2025 to 10 Dec 2027 | RED Art. 3(3)(d)(e)(f) under Delegated Regulation 2022/30, usually shown with EN 18031 standards711 |
| From 11 Dec 2027 | The CRA, with CE marking and the declaration of conformity under the CRA19 |
The CRA covers more than the delegated act: vulnerability handling, data minimization and attack surface are CRA topics, so a RED certificate alone does not show full CRA compliance. The Commission guidance lets makers rely on a valid RED certificate for these cyber risks until 11 June 2028.5
The RED itself stays: radio spectrum use, safety and EMC continue to apply. See the Radio Equipment Directive.
What does the Cyber Resilience Act mean for companies buying PoC fleets?
The CRA binds suppliers, not users. A company that buys radios for its own staff does not become a manufacturer. Before you buy, ask the supplier for the support end date, the update policy, a security contact and the CE mark with the declaration of conformity.1
Radios bought before 11 December 2027 stay in use. The Act requires nothing more of those units unless they are substantially modified, and makers still report exploited vulnerabilities in them.15
A short buying checklist:
- Support end date (month and year) stated at purchase.
- How updates are delivered, and whether they are free.
- A published way to report a vulnerability.
- The declaration of conformity (RED now, CRA for units sold from December 2027).
- The importer's name and address on the radio or its packaging.
More buying help is in how to choose a two-way radio.
What does the Cyber Resilience Act mean for older Android PoC radios?
Placing on the market is judged for each unit. This means a radio first sold in the EU from 11 December 2027 must meet Annex I, including security updates for at least five years. A unit sold before that date stays outside Annex I unless it is substantially modified later.15
For a model built on an older Android release, such as Android 9, the maker has in practice three routes for units sold after that date: patches for the existing base, a newer platform, or a hardened vendor system with a patch commitment that covers the support period.1 Components from third parties and open source, the operating system included, fall under the maker's due-diligence duty.1
Units sold earlier keep the reporting duty: from 11 September 2026 the maker reports an actively exploited vulnerability in them within 24 hours.1 A firmware update that changes the intended purpose or affects compliance can count as a substantial modification and then brings the unit under the CRA.1
What are the penalties under the Cyber Resilience Act?
Breaking Annex I or the maker duties can cost up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Importer, distributor and CE marking breaches go up to EUR 10 million or 2%. Wrong information to authorities goes up to EUR 5 million or 1%.1
Authorities weigh the size of the company. Micro and small enterprises are not fined for missing the 24-hour early warning, while the 72-hour and later deadlines stay.1 Market surveillance is run by national authorities, which can be the same ones that supervise the RED.1
Questions
Is a PMR446 walkie-talkie covered by the Cyber Resilience Act?
In practice, an analog PMR446 radio with no Bluetooth, USB data port or app has no data connection and falls outside the Act. It stays under the RED.15
Does the CRA require me to stop using radios I already own?
No. The Act sets rules for products placed on the market, not for owners. Units sold before 11 December 2027 only follow the CRA if they are substantially modified later.1
What is an SBOM?
A software bill of materials is a machine-readable list of the software components inside a product. The maker keeps it as part of vulnerability handling.1
Who is the manufacturer if a shop sells a Chinese radio under its own brand?
The shop. A distributor or importer that sells under its own name or trademark takes on the manufacturer's duties.1
Sources
- Cyber Resilience Act policy page · European Commission
- CRA implementation timeline and status · European Commission
- CRA implementation FAQ · European Commission
- Commission guidance on the Cyber Resilience Act, 27 July 2026 · European Commission
