What happened
Commission Delegated Regulation (EU) 2026/339 of 16 February 2026 repeals Delegated Regulation (EU) 2022/30, the act that activated the cybersecurity requirements of the Radio Equipment Directive. The repeal takes effect from 11 December 2027, the day the CRA applies in full, so that the two sets of requirements do not overlap.
What it means for machine builders
If your machines contain radio modules, wireless HMIs, remote access gateways or other radio equipment, their cybersecurity today is assessed under the Radio Equipment Directive. From 11 December 2027 the CRA essential requirements take over for products placed on the market from that date. Plan one transition, not two: technical files prepared for the RED cybersecurity requirements should be rebuilt on the CRA Annex I structure for products you will place on the market after that date.
Official source EUR-Lex, Commission Delegated Regulation (EU) 2026/339
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.