This article is a practical engineering overview, not legal advice. Which parts of the standard apply depends on your product and its intended use.
Since 1 August 2025, radio equipment that can communicate over the internet must meet the cybersecurity requirements of the RED delegated act (EU) 2022/30. The harmonised standards are EN 18031-1, -2 and -3. They were published in the Official Journal with restrictions. In some configurations, conformity cannot be presumed from the standard alone and a notified body has to be involved.
Which part applies?
| Standard | Requirement (RED Art. 3(3)) | Typical products |
|---|---|---|
| EN 18031-1 | (d) – no harm to the network | Every internet-connected radio product |
| EN 18031-2 | (e) – protection of personal data and privacy | Products processing personal data; toys, childcare, wearables |
| EN 18031-3 | (f) – protection against fraud | Products that transfer money or virtual currency |
The checklist
The standard is organised into security mechanisms with decision trees. In engineering terms, these are the questions to answer for each product:
- Access control and authentication – Are all network and local interfaces (Wi-Fi set-up, app, USB, service port) protected? Are there universal default passwords anywhere – including service and production tools?
- Secure update – Can every firmware component be updated, including the radio module? Are updates authenticated and protected against rollback?
- Secure storage – Where are keys, certificates and credentials stored, and who can read them?
- Secure communication – Is traffic to the cloud and the app encrypted and authenticated with current cryptography?
- Resilience – Does the device survive malformed input, floods and lost connectivity without unsafe behaviour?
- Exposed services – Are only necessary ports and services open? Are debug interfaces disabled in production?
- No known vulnerabilities – Are the libraries and stacks in the firmware up to date and monitored?
- Personal data (EN 18031-2) – Logging, deletion of user data and user notification where personal data is processed.
Typical findings
In assessments of connected devices, the same issues come up again and again. A shared service password is written in the manual. A radio module runs firmware that can't be updated in the field. Secrets travel unencrypted over an internal UART or USB link. A production tool has more privileges than the device itself. None of these is exotic, but each takes engineering time to fix.
From EN 18031 to the CRA
Most of this work carries straight over to the Cyber Resilience Act, which applies in full from December 2027. If you fix authentication, updates and secure storage for EN 18031 now, you have done much of the CRA homework too.
EN 18031 pre-assessment
We go through the decision trees with your engineers and deliver a list of gaps with concrete firmware and tooling measures.
CRA series: Part 1 – What manufacturers must do and when · Part 2 – Article 14 reporting · Part 3 – EN 18031 checklist