One technical file for RED and the CRA

Insights · cetome.com

One technical file for RED and the CRA

Sylvain DELAGRANGESenior product security advisor, cetome

14 September 2026 · RED and CRA · 5 min read

If your radio products have been through RED cyber security, you already own most of a CRA technical file. Since 1 August 2025, the delegated regulation on articles 3.3 (d), (e) and (f) has required a technical documentation that demonstrates how the product protects the network, personal data and against fraud, and EN 18031 has given that documentation a structure. The Cyber Resilience Act asks for the same kind of evidence, about more things, for longer. The manufacturers who treat the two files as one save months.

I write technical files with engineering teams, and the same question comes up in every RED project since the CRA was adopted: do we start again? The answer is no, provided the RED file was built properly.

What the two files have in common

Both regulations are demonstrated on paper, before the product is placed on the market, and both expect the file to be kept current. EN 18031 asks the manufacturer for required information and justifications for each mechanism, from access control to secure update, and the assessment follows those justifications. The CRA’s Annex VII asks for a description of the design, development and vulnerability handling, the cyber security risk assessment, and the evidence that each essential requirement is met.

In practice, the following parts of a good RED file transfer almost unchanged:

The product and its interfaces. Architecture, components, radio and wired interfaces, cloud services and applications. The CRA needs the same map, and the risk assessment starts from it.

The security mechanisms and their justification. Access control, authentication, secure update, secure storage, secure communication, logging, resilience and deletion mechanisms are described the same way for both. Where EN 18031 asked “which mechanism applies and why”, the CRA asks “which essential requirement applies and how it is met”. The evidence is the same, the index is different.

Test evidence. The results of the conceptual and functional assessment, and any independent test report, are evidence for the CRA too.

What RED never asked for

Three parts of the CRA file do not exist in a RED file, and they are the ones that take time.

The vulnerability handling process. Annex I Part II of the CRA requires a coordinated vulnerability disclosure policy, the handling of vulnerabilities throughout the support period, security updates and the reporting of actively exploited vulnerabilities. EN 18031 touches secure update and little else. This is a process to set up, not a chapter to write, and the file documents the process that exists.

The software bill of materials. The CRA requires an SBOM covering at least the top-level dependencies. Most RED files list the components in prose. The CRA expects a machine-readable inventory, and a way to keep it current.

The support period and what happens during it. The manufacturer determines the support period, at least five years in most cases, and documents how the product is kept secure for its whole length. RED has no such notion.

Two further differences shape the file rather than add to it. The CRA covers every product with digital elements, not only radio equipment, so a family of products with and without radio ends up under one regime. And the harmonised standards for the CRA are still being written, so the file demonstrates compliance against the essential requirements themselves, with EN 18031 and other standards as supporting evidence rather than a presumption of conformity.

Keeping one file for both

The mistake I see most often is two files maintained by two teams that drift apart within a release. The structure that works is one master file with two mapping annexes.

Where tools fit

Our free REDact toolkit structures the RED file around EN 18031, and CRAted evaluates each product against the CRA requirements and tracks the gaps. Used together, they produce the two annexes from the same product description.

Summary

If your RED documentation is due for its CRA extension, see how we approach RED and EN 18031 compliance, read why the first CRA file is the hardest, or talk to us.