The European Union is introducing three important pieces of legislation that affect machinery and connected products: the Radio Equipment Directive (RED), the Machinery Regulation, and the Cyber Resilience Act (CRA). Below, we explain what these regulations are, why they matter to Allgon Group, and what our customers can expect.
1. What are RED, the Machinery Regulation, and the Cyber Resilience Act?
The Radio Equipment Directive (RED) already requires connected wireless equipment to meet cybersecurity provisions under Article 3(3), mandatory since 1 August 2025.
The Machinery Regulation (EU) 2023/1230 replaces the current Machinery Directive (2006/42/EC) and will become mandatory across the EU from 20 January 2027. It sets out the health and safety requirements that machinery and related products — including components like radio remote controls — must meet before they can be sold in the EU. Compared to the previous directive, it puts much greater emphasis on digitalization, software-based safety functions, and, for the first time, cybersecurity, requiring that control systems be protected against tampering and unauthorized access.
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the EU’s first horizontal cybersecurity law covering “products with digital elements” — essentially any hardware or software that connects to a device or network. It requires manufacturers to build security into products from the design stage, manage vulnerabilities throughout the product’s lifecycle, and report serious incidents. Its main obligations apply from 11 December 2027, though some reporting requirements start as early as September 2026.
Together, these three regulations form a progressively broader framework — from wireless equipment, to machinery, to any product with a software element — for how connected products must be secured across the EU.
