EN 18031 and the RED delegated act: a guide for firmware teams

Last updated: 2026-10-19

EN 18031 is the set of three harmonised standards that give a presumption of conformity with the cybersecurity requirements of the Radio Equipment Directive (RED), activated by Delegated Regulation (EU) 2022/30 from 1 August 2025. EN 18031-1 covers network protection (Article 3(3)(d)), EN 18031-2 covers personal data and privacy (Article 3(3)(e)) and EN 18031-3 covers fraud protection for payments and monetary value (Article 3(3)(f)). The references were published with restrictions, so applying the standard does not always allow self-declaration.

Timeline

Date	Event	Source
29 October 2021	Delegated Regulation (EU) 2022/30 adopted	2022/30
28 January 2025	Implementing Decision (EU) 2025/138 adopted, citing EN 18031-1/-2/-3:2024 in the Official Journal with restrictions; presumption applies from publication	2025/138
1 August 2025	RED Article 3(3)(d), (e), (f) apply to the equipment categories in 2022/30 (postponed from 1 August 2024)	2023/2444
11 December 2027	Delegated Regulation 2022/30 repealed; radio equipment cybersecurity moves to the Cyber Resilience Act	2026/339

Which part covers which RED article

This is where many secondary sources disagree. The table below follows the scope of Delegated Regulation 2022/30 and the titles in Implementing Decision 2025/138.

Standard	RED essential requirement	Equipment in scope under 2022/30
EN 18031-1:2024 – Part 1: internet connected radio equipment	Art. 3(3)(d): does not harm the network or its functioning nor misuse network resources	Radio equipment that can communicate itself over the internet, directly or via other equipment
EN 18031-2:2024 – Part 2: radio equipment processing data, namely internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment	Art. 3(3)(e): safeguards to protect personal data and privacy	Equipment capable of processing personal, traffic or location data that is internet-connected, or designed for childcare, or a toy under Directive 2009/48/EC, or worn on the body or clothing
EN 18031-3:2024 – Part 3: internet connected radio equipment processing virtual money or monetary value	Art. 3(3)(f): features ensuring protection from fraud	Internet-connected radio equipment that lets the user transfer money, monetary value or virtual currency

Note that a childcare device, toy or wearable that processes personal data falls under Article 3(3)(e) even without an internet connection. A Bluetooth-only fitness band can therefore need EN 18031-2 but not EN 18031-1.

Exclusions (Art. 2 of 2022/30): medical devices (2017/745, 2017/746) are excluded from all three points; aviation (2018/1139), vehicle type-approval (2019/2144) and electronic road tolling (Directive 2019/520) are excluded from (e) and (f).

The restrictions published with the references

Implementing Decision 2025/138 attaches notices to each standard. They decide whether you may self-assess.

Standard	Restriction in the Official Journal
All three parts	The “rationale” and “guidance” sections do not confer a presumption of conformity
All three parts	No presumption if, when applying clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password
EN 18031-2	For childcare, toy and wearable categories (clauses 6.1.3–6.1.6), no presumption if parental or guardian access control is not ensured
EN 18031-3	No presumption as regards the assessment criteria in clause 6.3.2.4

If a restriction applies to your design, or you deviate from the standard, you cannot rely on self-assessment (internal production control) and need a notified body under RED Article 17 (EU-type examination or full quality assurance).

What firmware teams must implement

EN 18031 is organised around security mechanisms with requirements and assessment criteria. The full text is sold by national standards bodies, so check clause numbers against your purchased copy. In practice, the firmware work usually covers:

Access control and authentication: no shared default passwords; force the user to set credentials or ship unique ones (this is exactly where the OJ restriction bites); brute-force protection.
Secure update: authenticated, integrity-checked firmware updates, with a mechanism to deliver them.
Secure storage: protect credentials, keys and sensitive parameters at rest; no hard-coded secrets shared across devices.
Secure communication: current, authenticated encryption for network interfaces and cloud links.
Resilience and network behaviour: limit the impact of denial-of-service, avoid flooding the network, close unused services and ports.
Cryptography: use best-practice algorithms and key lengths.
Privacy functions (Part 2): user deletion of personal data, logging of access, and user notification where relevant; parental or guardian access control for children’s products.
Payment protection (Part 3): protect transactions and the data used to authorise them.

The exact mechanism names and identifiers should be (to be confirmed) against the published EN 18031 text before you cite them in your technical file.

Preparing for the test lab

Scope each SKU: internet-connected? processes personal data? childcare, toy or wearable? handles money? This tells you which parts apply.
Map every applicable requirement to a design feature and evidence (configuration, code, test).
Check the restrictions first; a “skip password” option forces a notified body.
Produce an SBOM and vulnerability scan of the firmware, so you can show known-vulnerability handling. See firmware SBOM.
Fix and re-scan before the lab visit; test labs charge for re-tests.

Looking ahead to the CRA

Because the RED cybersecurity rules end on 11 December 2027, radio products placed on the market from that day must meet the Cyber Resilience Act instead. EN 18031 work is not wasted: secure defaults, updates, storage and communication all reappear in CRA Annex I. The CRA adds vulnerability handling for the support period, an SBOM and 24-hour reporting, which already applies today. See the Cyber Resilience Act hub.

Softwsp scans your firmware, maps gaps against EN 18031 and the CRA, and fixes issues at firmware level before you go to the lab: device firmware security.

This guide is general information, not legal advice.

Frequently asked questions

Since when do the RED cybersecurity requirements apply?

Delegated Regulation (EU) 2022/30 applies from 1 August 2025. It was originally set for 1 August 2024 and postponed by Delegated Regulation (EU) 2023/2444.

Which EN 18031 part covers which RED article?

EN 18031-1 covers Article 3(3)(d) (network protection) for internet-connected radio equipment. EN 18031-2 covers Article 3(3)(e) (personal data and privacy) for internet-connected, childcare, toy and wearable radio equipment. EN 18031-3 covers Article 3(3)(f) (protection from fraud) for internet-connected radio equipment processing virtual money or monetary value.

Can I self-declare conformity with EN 18031?

Only if you apply the cited standard in full and none of the restrictions published with its reference in the Official Journal affect you. If, for example, your product lets the user skip setting any password, the standard gives no presumption of conformity and a notified body is needed.

What happens to EN 18031 when the Cyber Resilience Act applies?

Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027 by Delegated Regulation (EU) 2026/339. From then, radio equipment cybersecurity is governed by the CRA. Equipment placed on the market between 1 August 2025 and 10 December 2027 remains subject to RED market surveillance.