What EU Product Security Regulation Means for Academia and Industry

On August 1, 2025, new cybersecurity requirements under the EU’s Radio Equipment Directive (RED) came into force. While the RED marks the first binding security obligations for a broad range of products, it is best understood as a stepping stone toward the EU’s more ambitious Cyber Resilience Act (CRA). Together, these initiatives signal a major regulatory shift: security is no longer voluntary or limited to specific industries, but a baseline requirement for all digital products in Europe.

 

This talk will begin by examining the impact of this regulatory shift on industry, focusing on how the EU is embedding cybersecurity into product regulation and the ways overlapping instruments like RED and CRA interact. We will discuss the readiness of regulators to enforce and monitor compliance, as well as the standards currently being developed to guide manufacturers. From there, we will turn to academia’s role: cultivating skilled security professionals and supporting the upskilling of today’s workforce, conducting research to address technological gaps, and contributing to the shaping of future standards.