RED Directive 3.3 and Cybersecurity: What Changes in 2025

Why the RED 3.3 Directive matters

If your company develops or sells devices that connect via Wi-Fi, Bluetooth, or mobile networks, there’s an important deadline to know: starting from August 1, 2025, the RED 3.3 regulation will come into effect, imposing new requirements related to cybersecurity, data protection, and fraud prevention.

This article clearly explains what the directive requires, which devices are affected, and how Abinsula can help you become compliant.

What is RED Directive and what does article 3.3 say?

The RED Directive (2014/53/EU) regulates devices that use radio waves to communicate: smartphones, routers, smart devices, wearables, POS systems, and more.

Article 3.3, activated by Delegated Regulation (EU) 2022/30, introduces three mandatory obligations starting August 1, 2025:

  • 3.3(d): the device must not harm or overload networks (e.g., excessive traffic or interference);
  • 3.3(e): it must protect users’ personal data (e.g., encryption, privacy by design);
  • 3.3(f): it must prevent fraud and unauthorized access (e.g., strong authentication, secure updates).

Which devices are affected

All radio-connected devices are involved, including both consumer and industrial devices. Examples include:

Smartphones & Tablets

Mobile phones, tablets, and portable computers with wireless connectivity.

Routers & Modems

Wi-Fi routers, modems, and access points for home or office use.

Smart Home Devices

Thermostats, bulbs, intercoms, and other connected home equipment.

Wearables & Health Tech

Smartwatches, fitness bands, and connected healthcare devices.

POS & Payment Devices

Terminals and devices used for financial transactions.

IoT & Industrial Sensors

Sensors and devices for smart cities, industry 4.0, and automation.

What happens if you don’t comply?

If a device is not compliant with RED 3.3 by August 1, 2025:

  • it cannot be sold in the EU market;
  • it may be withdrawn from the market during inspections;
  • the company may face fines and reputational damage;
  • even a software update can trigger the compliance requirement on existing products.

What Abinsula can do for you

We support companies that need to comply with the RED 3.3 Directive. Our services include:

  • Technical and regulatory consulting for your product line;
  • Gap analysis on existing devices;
  • Support in secure firmware/software development;
  • Preparation of the technical file and declaration of conformity;
  • Assistance with Notified Bodies and certification partners.

The RED 3.3 Directive is a major step forward in regulating connected devices. Compliance is not just a legal requirement—it’s a mark of security, quality, and trust for your customers.

Contact us today for a free evaluation and learn how we can support your transition with confidence.