The short answer
EU rules now treat cybersecurity as a design requirement for connected hardware, not an afterthought. Radio products must meet the Radio Equipment Directive's cybersecurity requirements today, and the Cyber Resilience Act adds reporting duties now and full product requirements from December 2027. To Be Named Labs, a hardware product studio in Mumbai, designs connected devices to these rules from the first schematic.
German hardware teams — Mittelstand engineering groups and DeepTech startups alike — face two pressures at once: a tight market for embedded engineers, and a regulatory bar for connected products that rose sharply between 2025 and 2027. This post covers what changed, what it means at the circuit and firmware level, and how an external studio fits into a German compliance process.
| Date | What applies | Who it hits |
|---|---|---|
| 1 August 2025 | Cybersecurity requirements under the Radio Equipment Directive, shown through the EN 18031 series of harmonised standards | Most internet-connected radio equipment placed on the EU market |
| 10 December 2024 | Cyber Resilience Act entered into force | Starts the clock |
| 11 September 2026 | CRA reporting duties: actively exploited vulnerabilities and severe incidents must be reported, on 24-hour and 72-hour clocks | Products with digital elements already on the EU market — including older ones |
| 11 December 2027 | Full CRA application: essential requirements, conformity assessment, CE marking | Products placed on the market from that date |
The Commission has signalled that the RED cybersecurity act will be repealed once the CRA applies in full, to avoid two overlapping regimes. Until then, keep meeting EN 18031.
The key point for product planning: anything you start designing now will likely ship after December 2027. Design it for the CRA today.
Regulations read like policy. They land as engineering decisions.
Secure boot and signed firmware. Devices must reject unauthorised software. That means a bootloader that verifies signatures, a key-management process, and decisions about who holds signing keys.
No default credentials. Unique per-device credentials, generated and injected at the factory, or set by the user on first use.
A real update pipeline. Security updates over the device's support period, delivered safely — A/B partitions, rollback on failed boot, resumable downloads on unreliable networks.
Minimal attack surface. Close debug ports in production. Disable unused services. Expose only the network interfaces the product needs.
Data protection by design. Store only what the product needs. Encrypt sensitive data at rest and in transit. GDPR obligations already apply to personal data your devices collect.
A software bill of materials. You need to know every component and library in your firmware to assess and report vulnerabilities.
A vulnerability handling process. Under the CRA, someone must monitor, assess, fix and report. That's an operational commitment that outlives the design project.
Every cloud connection is an attack surface and a dependency. A device that makes its decisions locally and syncs only what it needs exposes less, sends less personal data, and keeps working during an attack on the backend.
We design connected hardware offline-first by default. Draper, our offline-capable digital signage platform, plays content from local storage and syncs when the network allows. The same pattern — local control, store-and-forward queues, signed updates — reduces both your compliance surface and your support load.
Germany's Electrical and Electronic Equipment Act requires producers to register with the national register, stiftung ear, before placing electrical equipment on the German market. Registration covers take-back and recycling obligations. Foreign producers selling directly into Germany typically need an authorised representative. Battery-powered products bring separate battery obligations.
Build these into your launch plan early. Registration is administrative, but missing it can block sales.
Compliance responsibility sits with the manufacturer placing the product on the market — usually your company. The studio's job is to make compliance achievable:
Germany runs 3.5 to 4.5 hours behind India, depending on daylight saving. The German morning meets the Indian afternoon, which makes daily engineering reviews easy.
German teams often worry about engineering rigour from external partners. The fair test: ask the studio to walk through its threat model, its key management, and its OTA failure handling. Specific answers show rigour. Generic ones don't.
It entered into force in December 2024. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026. Full requirements apply from 11 December 2027.
A series of harmonised standards used to show compliance with the Radio Equipment Directive's cybersecurity requirements, which apply to in-scope radio equipment from 1 August 2025.
Yes. The reporting obligations from September 2026 cover in-scope products already placed on the EU market, not only new ones.
Producers of electrical and electronic equipment must register under ElektroG with stiftung ear before placing products on the German market.
A studio designs and documents the security features compliance needs. Legal responsibility stays with the manufacturer that places the product on the market.
Send us the one-line version of your product. We'll come back with a technical read: the hard parts, what to cut for v1, and a realistic path from prototype to field.
Consumer electronics architects. End-to-end.