On March 3, 2026, the European Commission launched a public consultation on the draft implementation guidelines for the Cyber Resilience Act (CRA).

Click this link for the original public consultation, and the call for comments is until March 31, 2026.

On January 14, 2026, the French Minister of Finance and Industry, Energy and Digital Sovereignty issued a decree recognizing the ANFR's SAR laboratories with the ability to carry out tests provided for in article R.20-20 of the Code of Postal and Electronic Communications. In its press release, ANFR said it began construction of the SAR laboratory in 2020, which has been accredited by the French accreditation body COFRAC.

Click on this link to view the original text of the decree issued by the Ministry of the Economy, Finance and Industrial and Digital Sovereignty in the French Official Journal.

Following the European Commission's public consultation on the initiative to repeal the Cybersecurity Delegation Regulation (EU) 2022/30 on December 10, 2025, the Commission officially adopted the initiative on February 16, 2026, and the Delegation Regulation (EU) 2022/30 will expire from December 11, 2027. The Cyber Resilience Act (EU) 2024/2847 will replace the Delegated Regulation (EU) 2022/30. At present, the relevant initiative has not completed the legislative process and has not been published on the Official Journal (OJ) website.

Click this link to see the content of the initiative and the status of resolution.

On December 1, 2025, the European Commission published Commission Implementing Regulation (EU) 2025/2392, which provides a technical description of important and critical product categories that contain digital elements, in accordance with Regulation 2024/2847. The regulations will come into effect on December 21, 2025.

Click this link to view the original text of (EU) 2025/2392.

On January 15, 2026, the European Telecommunications Standards Institute (ETSI) published the following draft standards for the Cyber Resilience Act:

• EN 304 617 – Cybersecurity requirements for Browsers
• EN 304 618 – Cybersecurity requirements for password managers
• EN 304 619 – Cybersecurity requirements for software that searches for, removes, or quarantines malicious software
• EN 304 620 – Cybersecurity requirements for Virtual Private Networks (VPNs)
• EN 304 621 – Cybersecurity requirements for Network Management Systems (NMSs)
• EN 304 622 – Cybersecurity requirements for Security Information and event management (SIEM)
• EN 304 623 – Cybersecurity requirements for boot managers
• EN 304 624 – Essential cybersecurity requirements for Public Key Infrastructure and digital certificate issuance software
• EN 304 625 – Cybersecurity requirements for physical and virtual network interfaces
• EN 304 626 – Cybersecurity requirements for Operating Systems (OS)
• EN 304 627 – Essential cybersecurity requirements for routers, modems intended for the connection to the internet, and switches
• EN 304 635 – Cybersecurity requirements for Virtualisation Execution Stack (VES) and Container Execution Stack (CES), including hypervisors and container runtime systems
• EN 304 636 – Cybersecurity requirements for firewalls, intrusion detection and/or prevention systems

Click on this link to view the above draft standards. The link also includes a public consultation guide and a feedback form.

From December 16 to December 23, 2025, the French National Frequency Authority (ANFR) has successively issued three compliance rectification notices:

• BLACKVIEW SHARK 8: ANFR commissioned a certification laboratory to test the phone's SAR value, which exceeded the 2 W/kg limit set by the European Union. ANFR requested corrective action from BLACKVIEW. The company then released a software update that reduced the device's transmit power near the head to ensure compliance. ANFR verified and confirmed that the updated head SAR value had been reduced to meet the regulatory requirement of 2 W/kg. Software updates can be automatically pushed to user devices via mobile networks or Wi-Fi;
• OUKITEL WP36: In SAR value tests conducted by certified laboratories, the OUKITEL WP36 mobile phone has a limb SAR value of 5.40 W/kg, exceeding the 4 W/kg limit set by the European Union. OUKITEL then decided to reduce the transmit power of the device with a software update. 
ANFR validated and confirmed that the updated device had a reduced limb SAR value of 2.97 W/kg, meeting the regulatory requirement of 4 W/kg. Software updates can be automatically pushed to the relevant device over the data network (cellular or Wi-Fi);
• Google Pixel 9: Pixel 9 phones do not comply with the requirements of Law No. 2022-300 of March 2, 2022 for failing to provide the activation option of parental controls when the device is first activated under certain circumstances (involving the use of minors over 15 years of age). 
ANFR has officially notified Google, which released a software update on November 14, 2025, that fixes the issue. ANFR verifies that the update already provides parental control options in all cases during the initial setup process, and users can choose whether to enable them or not.

Click the above link to view the original ANFR related notice.

On December 11, 2025, the European Commission issued Commission Implementation Decision (EU) 2025/2499, which revises the harmonized standards for short-range devices (SRDs) and airborne mobile communication systems.

The main changes are as follows:

• Removal of the old version of the standard: EN 300 220-2 V3.1.1 for short-range devices (SRDs) in the frequency band from 25 MHz to 1 000 MHz, EN 302 480 V2.2.1 for airborne mobile communication systems (MCOBA) and EN 302 729 V2.1.1 for short-range devices using ultra-wideband (UWB) technology. The effective date of standard deletion is June 11, 2027;
• The following harmonized standards have been added: EN 300 220-2 V3.3.1, EN 302 480 V3.1.1, EN 302 729-1 V3.1.1, EN 303 659 V1.1.1 short-range devices in data networks, EN 305 550-6 V1.2.1 specific wireless measurement equipment (e.g. detection radar) in the frequency band from 40 GHz to 260 GHz.

Click on this link to view the original text of (EU) 2025/2499.

On December 10, 2025, the European Commission launched a public consultation to discuss an initiative aimed at repealing the RED Cybersecurity Delegated Regulation (EU) 2022/30. The initiative aims to repeal (EU) 2022/30 after the Cyber Resilience Act (CRA) goes into effect on December 11, 2027. This is intended to avoid overlap and ambiguity between the basic cybersecurity-related requirements of the Radio Equipment Directive and those in the Cyber Resilience Act.

Click this link to view the original public consultation, and the comment period is until January 7, 2026.

On November 12, 2025, the European Commission launched a public consultation on the new legislative framework (NLF), which aims to update the rules on conformity assessment bodies. The main body of the public consultation is a questionnaire containing information on the compliance of digital products (including the tendency of display formats such as QR codes, barcodes, NFC/RFID and other contactless technologies), digital product passports (DPPs), the regulation of refurbished products, etc.

Click this link to view the original public consultation, the deadline for comments is February 4, 2026.

On November 24, 2025, the European Commission officially promulgated the new Energy Efficiency Regulation (EU) 2025/2052 for external power supplies. The regulation sets out eco-design requirements in accordance with EU Directive 2009/125/EC and aims to significantly improve the environmental performance of energy-related products and promote Europe's transition to resource conservation and circular economy. The new regulation repeales the original Regulation (EU) 2019/1782. The new regulations not only cover external power supplies (EPS), but also include wireless chargers, wireless charging pads, universal portable battery chargers, and USB Type-C cables in the scope of ecological design controls. The new regulations have a three-year transition period, and most of the requirements will be mandatory from December 14, 2028.

Main requirements:

• USB Type-C becomes a universal interface. Unless eligible for an exemption, the AC-DC external power supply must be designed as an "interoperable EPS" and equipped with at least one USB Type-C or USB PD port (i.e., a USB Type-C interface that supports the USB PD fast charging protocol). To prevent premature device scrapping due to cable damage, interoperable EPS must support standard USB Type-C cables that can be plugged in and out and must not use fixed connection output cables;
• Universal portable battery chargers with a rated input power of up to 100W, as well as non-exempt wireless chargers and wireless charging pads, must also be equipped with a USB Type-C port at the DC input and powered via an interoperable EPS;
• Stricter energy efficiency and labeling requirements: set maximum power consumption limits for different types of EPS, such as the no-load power consumption of a single-voltage AC-DC EPS should not exceed 0.075W; introduce low load efficiency (10% load) and average active efficiency requirements (based on minimum performance at 25%, 50%, 75% and 100% load); The standby power consumption of wireless charging pads is also clearly regulated, such as wireless charging boards with non-hardened DC cables, whose DC input power consumption must not be higher than 0.5W;
• In terms of identification, interoperable EPS must be labeled as "universal charger" and clearly marked with the maximum rated output power. At the same time, USB Type-C cables must also indicate the maximum supported power on the plug, such as "60W" or "240W". An example of the "Universal Charger" logo is as follows:

Click on this link to view the original (EU) 2025/2052 regulation.