CRA & RED readiness for radio products
For manufacturers of radio and connected products: we test your product against the cybersecurity requirements of the Radio Equipment Directive (EN 18031) and the Cyber Resilience Act, help your team fix what fails, and prepare the technical evidence.
- You sell radio equipment in the EU: Wi-Fi, Bluetooth, cellular, LoRa, sub-GHz, mmWave and others
- Your product must meet the RED cybersecurity requirements (since 1 August 2025)
- You are preparing for the Cyber Resilience Act
- You need evidence for a notified body or for your own declaration
How it runs
We keep you informed during the work. Serious findings are reported the same day.
Scoping
Which requirements apply to your product (RED category, CRA class), and what we need from your side.
Gap assessment
Your product and its documentation against EN 18031 and CRA Annex I: what is met and what is missing.
Testing
Radio, firmware and hardware tests that back each requirement with evidence, done the way an attacker would.
Fixes and evidence
We help your team fix what fails, retest it and assemble the technical evidence.
Deliverables
What you need for your technical file, and for your team's next steps.
- Requirement matrix
- Each EN 18031 and CRA requirement, its status and the evidence behind it
- Test report
- Findings with their impact, reproduction steps and fixes
- Remediation plan
- Prioritised, with effort estimates
- Retest report
- Confirmation of what was fixed
| Target | What that involves |
|---|---|
| Wi-Fi and Bluetooth devices | Pairing, provisioning, updates, local interfaces |
| Cellular modules and gateways | 2G to 5G, remote management, firmware updates |
| LoRa and sub-GHz products | Join procedures, keys, command authentication |
| Wearables, toys and childcare products | Personal data, pairing, access control |
| Firmware and hardware | Secure boot, signed updates, debug ports, secrets at rest |
Frequently asked questions
Are you a notified body?
No. Penthertz tests your product and prepares the evidence; the formal assessment is made by your notified body or under your own declaration of conformity. We deliberately keep that separation, because a notified body cannot assess work it also performed. Our role is to get you ready: we test the radio and firmware against the RED and CRA requirements, document what passes and what needs work, and hand you, or your notified body, a clear evidence package. That makes the formal step faster and far less likely to come back with surprises.
When do these rules apply?
The RED cybersecurity requirements apply to radio equipment placed on the EU market since 1 August 2025. Under the Cyber Resilience Act, reporting of actively exploited vulnerabilities has applied since 11 September 2026, and the full set of requirements applies from 11 December 2027. Penthertz recommends starting well before that date, because testing and fixing take time and a certification slot is not instant. If you have a product launch or a certification date in view, tell us early and we will work back from it to a realistic plan.
Can you work with our test lab?
Yes. Penthertz is happy to work alongside your existing test lab or notified body rather than replace them. We can hand our results and evidence to them in a form they can use, run the radio and hardware testing they are not equipped for, or fill a specific gap in their coverage. Where responsibilities overlap we agree who does what at the start, so nothing is tested twice and nothing falls between the two of us. The goal is one coherent evidence package, not competing reports.
Talk to us about your product
We scope the work in a first call, then send a fixed-price proposal. We can put a mutual NDA in place before discussing details.