Westminster Policy News & Legislative Analysis

NI updates radio equipment cyber rules from 16 Dec 2025

The Radio Equipment (Amendment) (Northern Ireland) Regulations 2025 were made on 25 November 2025 and take effect on 16 December 2025. The instrument applies in Northern Ireland only, was approved by both Houses of Parliament, and implements Commission Delegated Regulation (EU) 2022/30 via the Windsor Framework by inserting a new regulation 6A into the 2017 Regulations.

The instrument revises the definition of “essential requirements” in regulation 2 of the 2017 Regulations so that, in addition to the existing safety, electromagnetic compatibility and spectrum-use duties, new requirements apply to internet‑connected radio equipment. The definition now signposts to regulation 6A for cybersecurity, anti‑fraud, and privacy safeguards, alongside existing provisions on emergency communications and common chargers.

Under new regulation 6A(2), any radio equipment that can itself connect to the internet must be constructed so it does not harm the network or its functioning, and does not misuse network resources in a way that causes unacceptable degradation of service. This gives domestic effect in Northern Ireland to Article 1(1) of EU 2022/30, which activates Article 3(3)(d) of the Radio Equipment Directive for internet‑connected devices.

Regulation 6A(3) requires internet‑connected radio equipment that enables the holder or user to transfer money, monetary value or virtual currency to support features that protect users from fraud. This reflects Article 1(3) of EU 2022/30, which applies Article 3(3)(f) of the Directive to such devices; ‘virtual currency’ and related terms follow the EU definitions referenced in that Regulation.

Regulation 6A(4)–(5) introduces safeguards to protect users’ and subscribers’ personal data and privacy. The duty applies to internet‑connected equipment, radio equipment designed exclusively for childcare, toys within Directive 2009/48/EC, and radio equipment intended to be worn on the body or clothing, where such products can process personal, traffic or location data. The definitions of personal, traffic and location data, and of processing, cross‑refer to EU instruments cited in EU 2022/30.

There are targeted exclusions. The network protection duty in 6A(2) does not apply where the equipment is already regulated under the medical devices frameworks. The privacy and anti‑fraud duties in 6A(3)–(4) do not apply where aviation, motor vehicle safety or European electronic tolling regimes govern the equipment. These carve‑outs mirror Article 2 of EU 2022/30 and are carried through by regulation 6A(6).

Conformity assessment is adjusted so the existing modules under regulation 41 apply to the new requirements. The Northern Ireland text of regulation 41(5) and (6) is amended to reference regulation 6A(2) to (4), meaning that where relevant harmonised standards are applied, manufacturers may use any of the modules in regulation 41(4), and where they are not, a third‑party route (EU‑type examination or full quality assurance) is required.

For market access in Northern Ireland, manufacturers follow the Radio Equipment Regulations 2017 as they apply under the Windsor Framework. Where a UK notified body is used, CE and UKNI marks must be affixed; products with both marks cannot be placed on the EEA market. Technical documentation and the EU Declaration of Conformity must be retained for 10 years and supplied to authorities on request.

In practical terms, makers of smart toys, wearables and childcare devices should evidence privacy‑by‑design controls in their technical files, and suppliers of devices that enable payments should document anti‑fraud features. For all internet‑connected radio equipment, the risk analysis should address network harm and misuse of network resources. Examples listed by the European Commission include wristwatches, rings, headsets, earphones, glasses and child monitors when they can communicate over the internet.

The Department for Business and Trade notes in the instrument’s explanatory note that no separate impact assessment accompanies this measure because it flows from the European Union (Withdrawal) Act 2018 and the Windsor Framework. The instrument was signed by the Minister for Employment Rights and Consumer Protection, Kate Dearden, on 25 November 2025. An Explanatory Memorandum is published alongside the Regulations.