Radio Frequency Testing

The EU Cyber Resilience Act is now law, and the compliance countdown is accelerating. For wireless product exporters, the most pressing question is not "what is the CRA" but "how do I actually get my product certified?" This guide is built around practical execution — from risk assessment to documentation, from testing standards to conformity assessment pathways — walking through the full process of obtaining CRA certification for wireless products.

1. Three Pre-Application Confirmations

Before launching CRA compliance work, manufacturers should complete three essential confirmations:

Confirm product scope　The test: does the product contain digital elements (firmware/software/app/cloud backend) AND data connectivity (Bluetooth/Wi-Fi/cellular)? If both are true, the product falls within CRA scope. Consider a Wi-Fi smart plug: it has firmware, a companion app, a cloud backend, and Wi-Fi connectivity — a textbook CRA-regulated product.

Identify the conformity assessment pathway　The CRA conformity assessment model offers two primary routes: internal production control (Module A) and third-party conformity assessment. For critical and important product categories, Notified Body involvement may be required. The pathway depends on the product's risk classification.

Map overlaps with existing certifications　Wireless products typically already require RED, EMC, and LVD compliance. CRA compliance must integrate with existing certification frameworks — not operate in parallel. Audit your current technical documentation to identify what can be reused and what needs to be created from scratch.

2. The Five-Step CRA Certification Process

The CRA certification process for wireless products can be broken into five practical steps:

Step 1 — Cybersecurity Risk Assessment　This is the starting point and core of CRA compliance. Manufacturers should use established methodologies (STRIDE, ISO 27005, NIST SP 800-30) to systematically analyse the product's entire attack surface. The assessment should cover: wireless protocol security (Bluetooth/Wi-Fi encryption and authentication implementations), firmware integrity protection, data storage and transmission security, cloud interface security, and physical interface security (debug ports, USB interfaces).

Step 2 — Security Design Remediation and Verification　Based on risk assessment findings, implement necessary security design changes. Typical remediation items include: strengthening default password policies, enabling transport encryption (TLS 1.2+), implementing secure boot chains, disabling unnecessary debug ports, and adding firmware signature verification. After remediation, confirm results through penetration testing or security functional verification.

Step 3 — CRA Technical Documentation　The CRA requires comprehensive technical documentation including: risk assessment reports, secure design specifications, vulnerability management policies, security update plans (minimum 5-year support period), third-party component SBOM and due diligence records, and conformity assessment procedure descriptions. Technical documentation must be retained for at least 10 years after the product is placed on the market.

Step 4 — EU Declaration of Conformity　The manufacturer signs an EU Declaration of Conformity (EU DoC) confirming the product meets all applicable CRA requirements. The declaration must reference applicable harmonised standards and include manufacturer details, product identification, and a description of the conformity assessment procedure followed.

Step 5 — CE Marking and Market Placement　Upon completing the above steps, the product can bear the CE marking and be sold in the EU market. The CE marking must indicate the CRA regulation number. Manufacturers must also ensure the product is accompanied by essential security information, including the security support period and vulnerability reporting channels.

3. CRA Technical Documentation Checklist

CRA documentation requirements are more stringent than traditional CE certification. Below is the core checklist for wireless products:

• Product description　Functionality overview, digital element inventory (firmware/software/app/cloud), communication interface list
• Cybersecurity risk assessment report　Threat model, attack surface analysis, risk rating, residual risk statement
• Secure design specification　Evidence of encryption implementation, authentication mechanisms, access controls, secure boot, and secure default configuration
• Vulnerability management policy　Discovery and response processes, coordinated disclosure policy, CVE tracking mechanism
• Security update plan　Update distribution mechanism, support period commitment (minimum 5 years), update signing and verification process
• Third-party component SBOM and due diligence records　Software Bill of Materials, component compliance verification records
• Conformity assessment procedure records　Applicable assessment module, test reports (if any), internal audit records
• EU Declaration of Conformity　Referencing the CRA regulation number, applicable harmonised standards, manufacturer signature

4. Applicable Standards and Conformity Assessment Pathways

CRA conformity assessment pathways depend on the product category. Below are the key standards and assessment models wireless product manufacturers should be aware of:

CRA horizontal standards　Expected to be finalised by August 2026, these will provide a unified baseline security framework for all applicable digital products. This is the core reference standard for CRA compliance.

CRA vertical standards　Sector-specific or product-type-specific standards, with timelines slightly later than horizontal standards. Wireless products may need to meet both horizontal and relevant vertical standards.

EN 18031 series　As the cybersecurity standard under the RED, it can partially cover CRA technical requirements. Completing EN 18031 testing provides useful technical evidence for CRA compliance but does not replace CRA's lifecycle risk management requirements.

ETSI EN 303 645　The baseline cybersecurity standard for consumer IoT products, serving as an important reference for CRA compliance. This standard has been designated as the presumption-of-conformity standard under the UK PSTI Act.

5. Compliance Timeline Planning

With the CRA compliance deadline advancing phase by phase, wireless product manufacturers should adopt a staged approach:

Now through June 2026　Complete cybersecurity risk assessments, establish vulnerability management mechanisms, compile SBOMs, and finish security design remediation and verification.

July – September 2026　Launch vulnerability reporting channels, complete EN 18031 testing (if applicable), finalise CRA technical documentation, and prepare for the September 2026 vulnerability reporting obligation.

October 2026 – June 2027　Conduct compliance gap analysis against CRA horizontal standards (expected August 2026), complete conformity assessment procedures, and sign the EU Declaration of Conformity.

July – November 2027　Complete final compliance validation, ensuring all products are fully compliant before the 11 December 2027 full application date. A 3–4 month buffer is recommended to accommodate regulatory interpretation adjustments or standard updates.

6. Common Practical Questions

This article was generated with AI assistance. Content is for reference only and does not constitute any certification commitment or legal advice. Please refer to the latest official EU regulations.

Contact: net04@gtggroup.com