Hi @Jesuqq !

Thanks for your question.

Regarding the text "no requirements of Directive 2014/53/EU make a distinction between the radio and non-radio functions of the radio equipment and therefore all aspects and parts of the equipment should comply with the essential requirements": Our interpretation is that, if your equipment is in scope of the RED, the essential requirements apply to all parts of the equipment regardless of the parts being "radio" or not. In the context of the RED DA, this means that the requirements of EN 18031 apply to the equipment as a whole. For example, the requirements on secure communication of assets (SCM) apply to any type of interfaces, whether wireless or not. Some of our customers ask whether they should document non-wireless interfaces such as Ethernet. In this light, the answer is always yes.

The scopes of the RED and RED DA are slightly different.

• In the context of the RED, radio equipment are in scope (as stated in the excerpt you provided: "Directive 2014/53/EU applies to products that meet the definition of ‘radio equipment’ in Article 2").
• In the context of the RED DA which "activated" 3 essential requirements of the RED, namely Article 3(3)(d), (e) and (f), radio equipment having certain characteristics are in scope and would have to fulfil one or more of these essential requirements. I like to summarize these characteristics as below. For example, if your radio equipment is Internet-connected and processes personal data, it has to fulfil (d) and (e).

Note on what constitutes "Internet connected": We like to refer to the definition of the TIC Council (industry association of the Testing, Inspection and Certification sector) provided in their position paper.

Regarding the critical systems you mentioned like cloud components, they are simply not in scope of the RED DA. Demonstrating RED DA compliance is to be done per radio equipment. Therefore you do not have to also demonstrate compliance for the cloud backend used (which is likely a server sitting in a data center, not even a radio equipment itself in the first place). And even if it was, the demonstration of its compliance should be done by its manufacturer (which, I assume, is not you).

If you apply EN 18031 to demonstrate compliance with the RED DA, you have to make sure that your equipment communicates assets securely to the other systems (regardless of being cloud-based or not). Maybe my reply of yesterday regarding SCM-1 can shed some light on the standards' expectations for SCM. Regarding the OTA update servers, you will need to demonstrate that the update mechanism(s) on the equipment are secure, which may involve the documentation of some information of those update servers (eg, how updates are distributed, how they allow for automatic update, ...). But again, the servers themselves are not in scope of the RED DA.

PS: The situation will be different under the CRA, which covers products with digital elements and their integrated remote data processing solution. See (11) in the CRA: "Such remote data processing solutions should be defined as data processing at a distance for which the software is designed and developed by or on behalf of the manufacturer of the product with digital elements concerned, the absence of which would prevent the product with digital elements from performing one of its functions. That approach ensures that such products are adequately secured in their entirety by their manufacturers, irrespective of whether data is processed or stored locally on the user’s device or remotely by the manufacturer. At the same time, processing or storage at a distance falls within the scope of this Regulation only in so far as it is necessary for a product with digital elements to perform its functions. Such processing or storage at a distance includes the situation where a mobile application requires access to an application programming interface or to a database provided by means of a service developed by the manufacturer. In such a case, the service falls within the scope of this Regulation as a remote data processing solution."

The EC should publish guidance on the topic of remote data processing solution (Art. 26.2(a)) sometime soon.

I hope this helps. Do not hesitate if you have further questions or comments!

Guillaume