ZVEI Issues Paper on EU Radio Equipment Directive
The German Electrical and Electronic Manufacturers’ Association (ZVEI) has released a new position paper on the EU's Radio Equipment Directive (RED), which governs wireless products including smart luminaires. The paper calls for harmonized standards and a lifecycle perspective to ensure compliance as lighting products become increasingly connected.
- New mandatory cybersecurity rules for all radio equipment, including wirelessly controlled luminaires, will be enforced starting August 1, 2025, under the RED. These requirements focus on protecting network integrity, ensuring user privacy and personal data, and preventing fraud. - The ZVEI's paper highlights a critical bottleneck: a shortage of harmonized standards and third-party "Notified Bodies" to certify products. This could create significant delays in bringing new products to market, as manufacturers may be unable to get the required conformity assessments for their internet-connected devices. - The directive's lifecycle approach means compliance is not a one-time event at launch. It extends through the product's operational life, impacting how software and firmware updates are managed to ensure the device remains secure and compliant long after installation. - These regulations add a new security layer on top of existing lighting control protocols like DALI and IoT integration standards such as Zhaga. This ensures that as luminaires become data points in larger building automation ecosystems, they do not introduce vulnerabilities to the network. - The RED's cybersecurity articles are a precursor to the broader EU Cyber Resilience Act (CRA). Understanding RED compliance offers a strategic advantage in preparing for the CRA, which will impose similar cybersecurity requirements across a wider range of digital products. - Compliance is verified through the CE mark, a legal requirement for market access in the EU. For architects and specifiers, the updated CE marking will provide greater assurance of a product's cybersecurity resilience, interoperability, and data protection capabilities.
