Cybersecurity rules for connected robots: the Cyber Resilience Act and RED explained

Two EU laws now set cybersecurity rules for robots that connect over Wi-Fi, Bluetooth or mobile networks. Since August 2025, a delegated act under the Radio Equipment Directive (RED) has set security requirements for internet-connected wireless equipment. Since 11 September 2026, the Cyber Resilience Act (CRA) has required manufacturers to report actively exploited vulnerabilities and severe incidents. On 11 December 2027 the CRA takes over completely.

This article explains what each law asks for, how they fit together, and what changes for people who hire or operate robots at events. It is general information, not legal advice.

Why robots fall under these rules

Modern humanoids, robot dogs and service robots are networked machines. They connect to a tablet or remote control over Wi-Fi or Bluetooth, download firmware updates, and often talk to cloud services for speech, mapping or fleet management. Many also carry cameras and microphones.

That makes them targets in the same way as any other connected device. Someone who takes over a robot's control link could do more than steal data, because the robot can move in a room full of people. For that reason, cybersecurity sits alongside the physical safety rules covered in our article on the EU Machinery Regulation and humanoid robots.

The EU handles this in two layers. The RED covers products that use radio. The CRA covers almost any product with software and a data connection.

The RED delegated act: security for wireless equipment

The Radio Equipment Directive (2014/53/EU) has always contained optional security requirements that only apply once the Commission switches them on. It did so with Delegated Regulation (EU) 2022/30. The Commission announced the act on 29 October 2021, giving examples such as mobile phones, smart watches, fitness trackers, tablets and connected toys.

The act covers three areas:

• Network protection: devices must not harm communication networks or be misused to disrupt services.
• Personal data and privacy: devices need safeguards against unauthorised access to, or transmission of, personal data, with particular attention to children.
• Fraud: where a device handles money, it needs safeguards such as stronger user authentication.

The 2021 announcement gave manufacturers 30 months to comply. The start date was later pushed back, and the Commission's Radio Equipment Directive page confirms that the act entered into application in August 2025. In practice, this means a wireless robot placed on the EU market since then, and bearing the CE mark, should meet these requirements if it falls within the act's scope.

The RED act ends when the CRA takes over

The two laws overlap, so the Commission has scheduled the end of the RED act. According to the same Commission page, it adopted Delegated Regulation (EU) 2026/339 on 16 February 2026. That regulation repeals the RED cybersecurity act with effect from 11 December 2027, the date when the CRA's main obligations begin. Until then, wireless products still have to meet the RED requirements.

The Cyber Resilience Act: what it covers

The CRA entered into force on 10 December 2024. It applies to hardware and software it calls "products with digital elements". According to the Commission's summary of the legislative text, a product is covered if it has a direct or indirect logical or physical data connection to a device or network. Products already covered by certain other EU laws are excluded.

A connected robot, its control app and its cloud software can all meet that definition. The Commission's summary does not mention robots specifically, however. Whether a particular model falls into a stricter category depends on the lists in the regulation's annexes, and the manufacturer has to assess that.

The CRA's main obligations, which apply from 11 December 2027, include:

• Security by design: products must meet essential cybersecurity requirements when they are designed, built and used as intended.
• Vulnerability handling: manufacturers must deal with vulnerabilities throughout a support period they set themselves.
• A stated support period: the end date of that period, including month and year, must be given clearly at the time of purchase.
• Conformity assessment and CE marking: most products can be self-assessed. Products the CRA lists as "important" (Classes I and II) or "critical" have fewer options and may need assessment by a notified body.

The provisions on notified bodies started to apply on 11 June 2026, which gives assessment bodies time to be designated before the main deadline.

Reporting duties since 11 September 2026

The first operational part of the CRA started on 11 September 2026. From that date, manufacturers must report two types of event, as set out on the Commission's CRA reporting obligations page:

• actively exploited vulnerabilities in their products
• severe incidents affecting the security of their products

Reporting happens in stages:

1. An early warning within 24 hours of becoming aware.
2. A notification with more detail within 72 hours.
3. A final report: for a vulnerability, no later than 14 days after a fix or other corrective measure is available; for a severe incident, within one month of the 72-hour notification.

Reports go to the national Computer Security Incident Response Team (CSIRT) in the country of the manufacturer's main establishment, and to ENISA, the EU cybersecurity agency, at the same time. That CSIRT then passes the report to the CSIRTs of the other countries where the product is sold.

The duty also covers robots already on the market

The reporting duty is not limited to new products. The Commission's summary states that it applies to all products with digital elements made available on the EU market, including those placed on the market before 11 December 2027. A robot model sold in 2024 is therefore covered if its manufacturer finds that a vulnerability in it is being exploited today.

The summary also notes two concessions. Microenterprises and small enterprises cannot be fined for missing the 24-hour deadline. Stewards of open-source software have their own reporting start date of 11 December 2027 and face no CRA penalties.

ENISA's Single Reporting Platform

Notifications are made through the Single Reporting Platform, which ENISA builds and runs. According to ENISA's platform page, the platform launched with initial operating capability on 11 September 2026. Manufacturers report once, and the platform sends the information on to the relevant authorities. ENISA released version 1.2.1 on 20 October 2026.

The platform is new, so procedures and guidance may still change. Manufacturers outside the EU that sell robots into Europe should check how they will meet the 24-hour deadline in practice.

The timeline in one place

• 29 October 2021: Commission announces the RED cybersecurity delegated act.
• 10 December 2024: CRA enters into force.
• August 2025: RED cybersecurity requirements enter into application.
• 16 February 2026: Commission adopts Delegated Regulation (EU) 2026/339, which repeals the RED act from December 2027.
• 11 June 2026: CRA provisions on notified bodies apply.
• 11 September 2026: CRA reporting obligations and ENISA's platform go live.
• 11 December 2027: CRA applies in full, and the RED cybersecurity act is repealed.

If a robot uses AI to interact with visitors, the AI Act may apply as well. Our AI Act timeline for robots covers those dates.

What this means for event organisers

The legal duties described here fall mainly on manufacturers, not on companies that hire a robot for a day. Still, the rules give organisers useful questions to ask:

• Ask about updates. Ask the supplier whether the robot runs current firmware and whether the manufacturer still supports the model. Once the CRA applies in full, the support period end date has to be stated at the time of purchase, so suppliers should increasingly be able to give it. Add the question to your brief to the robot supplier.
• Keep the robot off the guest network. Agree with the venue and supplier how the robot connects. A separate, protected network for the robot and its control devices is common practice; see our venue checklist for space, power and Wi-Fi.
• Treat cameras and microphones as a data question. The RED rules are partly about personal data. Your own GDPR duties as organiser still apply, as explained in our guide to cameras, microphones and visitor privacy.
• Agree what happens if a vulnerability is announced. Ask suppliers how they would respond if a manufacturer warns of an exploited flaw shortly before your event, for example by applying a patch or switching the robot to an offline mode.
• Remember the timeline. Wireless robots on the EU market should already meet the RED requirements. The full set of CRA requirements applies to products placed on the market from 11 December 2027.

Frequently asked questions

Does the Cyber Resilience Act apply to robots?

The CRA applies to products with digital elements: hardware and software with a direct or indirect data connection to a device or network. Connected robots, their control apps and their cloud software can fall under that definition. The Commission's summary does not mention robots by name. Whether a model needs a third-party assessment depends on whether it appears in the regulation's lists of important or critical products, and the manufacturer has to assess that.

What must robot manufacturers report under the CRA, and how quickly?

Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents. They must send an early warning within 24 hours, a notification within 72 hours, and a final report. For a vulnerability, the final report is due within 14 days of a fix being available; for a severe incident, within one month. Reports go to the national CSIRT and to ENISA through its Single Reporting Platform.

Do the reporting rules apply to robots sold before 2027?

Yes. The European Commission's summary of the CRA states that the reporting obligations cover all products with digital elements made available on the EU market, including those placed on the market before 11 December 2027. A robot model sold years ago is therefore covered if its manufacturer finds that a vulnerability in it is being actively exploited.

What is the RED cybersecurity delegated act and is it still in force?

Delegated Regulation (EU) 2022/30 switched on security requirements in the Radio Equipment Directive. They cover network protection, personal data and privacy, and fraud prevention for certain wireless devices, and they have applied since August 2025. In February 2026 the Commission adopted Delegated Regulation (EU) 2026/339, which repeals the act from 11 December 2027, when the Cyber Resilience Act's main obligations take over.

Do event organisers who hire a robot have duties under these laws?

The CRA's reporting and design duties are aimed mainly at manufacturers, not at companies that hire a robot for an event. Organisers still have their own obligations, such as data protection duties when a robot records visitors. It is sensible to ask suppliers about firmware updates and network setup. This answer is general information, not legal advice.

How this article was made: written by the humanoid4rent editorial team with AI assistance; every factual statement was checked against the sources listed below on 2026-11-01. Spotted an error? Write to info@humanoid4rent.com.