With the rapid development and wide adoption of wireless and IoT technology, more and more connected devices are used in daily life and work, and information security has become a global focus.

On 12 January 2022 the European Commission published Delegated Regulation 2022/30/EU supplementing the Radio Equipment Directive, making it mandatory for manufacturers of relevant products to meet points (d), (e) and (f) of Article 3.3 of the RED in design and production. The act was due to become mandatory on 1 August 2024, but because the corresponding standards were not ready in time, application was postponed by one year to 1 August 2025.

Why the standards matter

The EN 18031 series was developed to address this practical problem, using mandatory cybersecurity standards to push manufacturers to improve device security and thereby protect the stability of the EU digital single market and consumer privacy. The publication of the EN 18031 series marks an important step for the EU in IoT device cybersecurity.

Basic requirements

RED cybersecurity requirements:

Article 3.3(d): radio equipment shall not harm the network or its functioning, nor misuse network resources in a way that causes unacceptable degradation of service.

Article 3.3(e): radio equipment shall incorporate safeguards to ensure that the personal data and privacy of the user and subscriber are protected.

Article 3.3(f): radio equipment shall support features ensuring protection from fraud.

Product scope

The requirements apply to most internet-connected wireless terminal equipment, such as routers, cameras, smart locks, smart appliances, wearables, smartphones, tablets, children's toys and child monitoring devices.

Article 3.3(d) applies to any radio equipment that can communicate over the internet by itself, whether directly or indirectly through any other equipment.

Article 3.3(e) applies to any radio equipment with the capability to process personal data, traffic data or location data in the following categories:

(1) Radio equipment designed specifically for child care.

(2) Children's toys.

(3) Wearable devices.

(4) Internet-connected radio equipment other than the devices listed in (1) to (3).

Article 3.3(f) applies to any radio equipment that allows the transfer of money, monetary value or virtual currency to the owner or user.

Products not covered include medical devices under Regulation (EU) 2017/745 and in vitro diagnostic medical devices under Regulation (EU) 2017/746.

Articles 3.3(e) and 3.3(f) do not apply, with only 3.3(d) applying, to civil aviation equipment under Regulation (EU) 2018/1139, automotive electronic equipment under Regulation (EU) 2019/2144 and electronic road toll systems under Directive (EU) 2019/520.

Applicable standards

EN 18031-1, Common security requirements for radio equipment, Part 1: Internet connected radio equipment.

EN 18031-2, Common security requirements for radio equipment, Part 2: Radio equipment processing data, namely internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment.

EN 18031-3, Common security requirements for radio equipment, Part 3: Internet connected radio equipment processing virtual money or monetary value.

The EN 18031 series was cited in the Official Journal as harmonised standards under the RED on 30 January 2025. Where the harmonised standards and their restrictions are met, no notified body certificate is required.

Restrictions in the harmonised standards

1. The rationale and guidance clauses of EN 18031-1/2/3 are for reference only and are not a basis for compliance.

2. Users must not be allowed to set and use no password at all.

3. Where role-based, discretionary or mandatory access control is used, parental or guardian control of administrative rights must be supported (applies to EN 18031-2).

4. Security updates must use multiple protection mechanisms such as digital signatures and secure communication (applies to EN 18031-3).

Technical requirements of the EN 18031 series

NTEK services

NTEK has a dedicated cybersecurity project team and works with well-known EU notified bodies to provide technical support and certification services at every stage, from preliminary assessment and testing through to certification and issue of the certificate.