Which EN 18031 Evidence Carries Over to the CRA

Manufacturers of radio equipment have just finished their work on EN 18031: mechanisms identified, applicability justified, evidence filed. From December 11, 2027, the Cyber Resilience Act (CRA) applies, and the EN 40000 series is being developed as its own set of standards. Part 1-4 of that series decides which of your EN 18031 evidence you can take with you.

To answer that question, you need to know what EN 18031 consists of. It is a European standard series in three parts that secures radio equipment. It covers the three cybersecurity requirements that Commission Delegated Regulation (EU) 2022/30 activated under the Radio Equipment Directive (RED): protection of the network, protection of personal data and privacy, and protection from fraud.

Contents

1. Where EN 18031 comes from
2. Why the CRA picks up EN 18031
3. What changed in the requirement families
4. The real break is in applicability
5. What the four new families require
6. How much of your RED work counts for the CRA
7. For many radio products, an ETSI standard will apply in the end
8. What this means for your planning

Where EN 18031 comes from

Part	Essential requirement under Article 3(3) of the RED	Mechanism families
EN 18031-1	Point (d), protection of the network from harm and misuse of network resources	ACM, AUM, SUM, SSM, SCM, RLM, NMM, TCM, CCK, GEC, CRY
EN 18031-2	Point (e), protection of personal data and privacy	Families from Part 1 without RLM, NMM, and TCM, plus LGM, DLM, and UNM
EN 18031-3	Point (f), protection from fraud	Subset of the families from Parts 1 and 2

Everything that follows depends on how each family is built. It starts with an applicability requirement, which settles whether the mechanism applies to the product at all. Only then come the requirements on appropriateness. If you answered the applicability question with “no” and documented your reasoning, you were done with that family.

Why the CRA picks up EN 18031

Recital 30 of the CRA states that the CRA's essential cybersecurity requirements include all the elements of the three RED requirements. It also asks for the standardization work under Commission Implementing Decision C(2022) 5637 to be taken into account. The EN 18031 series came out of that request.

CRA standardization runs under a separate standardization request from the Commission dated February 2025, which the standardization bodies track as mandate M/606. Under that request, EN 40000-1-4 is being developed as the horizontal standard for the technical requirements. It currently exists as a draft, working status July 2026.

EN 40000-1-4 makes the link to EN 18031 explicit. It takes over the EN 18031 identifiers and has an annex that marks every old requirement as unchanged in name, renamed, merged, deleted, or new. Unchanged in name does not mean unchanged in content: those requirements were also adapted to the CRA. Our article on the horizontal standards of the EN 40000 series covers their status.

What changed in the requirement families

EN 40000-1-4 has 18 control families. Fourteen come from EN 18031, four are new. The number of individual requirements grows from 44 to 65.

What happened to the family	Families	Requirements, EN 18031 to EN 40000-1-4
New	data minimization (DTM), monitoring (MON), protection of processed data (SPD), limiting the impact on other systems (LIM)	0 to 11
Taken over and extended	general equipment capabilities (GEC), updates (SUM), resilience (RLM), logging (LGM), cryptography (CRY)	GEC 8 to 14, SUM 3 to 7, RLM 1 to 6, LGM 4 to 6, CRY 1 to 2
Applicability removed	access control (ACM), authentication (AUM), communication (SCM), storage (SSM)	ACM 6 to 1, AUM 6 to 5, SCM 4 to 3, SSM 3 to 2
Applicability rewritten	deletion (DLM), user notification (UNM), network monitoring (NMM), traffic control (TCM)	5 to 5 in total
Taken over unchanged	cryptographic keys (CCK)	3 to 3

The drop in the third group is misleading. No requirement on the product has gone. What has gone is the preliminary question of whether the family applies at all. Only access control also loses real content: the four requirements on toys and childcare from EN 18031-2 have been deleted. The preliminary question also disappears in two families of the second group, logging and resilience, but there it is hidden by the overall growth.

The real break is in applicability

EN 40000-1-4 sees itself as a catalog. It describes what a technical control must achieve, but it does not require every product to implement every control. The “shall” applies only once the cybersecurity risk assessment has selected the control. For one product the catalog therefore stays short, for another it is long.

The two-step logic of EN 18031 disappears in two ways. Four applicability requirements are dropped as separate requirements; for access control, their content moves into the substantive requirement. Seven more are rewritten as substantive requirements. For example, the applicability of update mechanisms becomes the requirement that all software components that are not immutable must be updatable. The CRA now requires the decision itself elsewhere. Under Article 13(3) of the CRA, the cybersecurity risk assessment must indicate whether and how the requirements in Annex I, Part I, point 2 apply to the product.

In conformity assessments, applicability was the most convenient part of the whole standard. If you declared a family not applicable, you did not have to implement its requirements. You only had to explain why they did not apply. The explanation went into the documentation, and the point was closed. Word got around: manufacturers quickly claimed non-applicability and never touched the requirements behind it.

When applicability follows from the risk assessment, this shortcut no longer works. Take the operator panel of a machine. Until now, you could argue that nobody can reach the device during operation, so it needs neither access control nor authentication. If the machine stands in a hall where visitor groups regularly walk through, the risk assessment looks different. You then need a password on the panel that you did not need before. The need for access control and authentication does not go away. The argument for skipping them simply no longer covers the operating environment.

What the four new families require

There is no groundwork from the RED for the four new families. Together they contain 11 requirements and cover four points that the CRA requires in Annex I, Part I, point 2, but that the RED did not address:

• Data minimization. The product processes only what its intended purpose requires, already in the default configuration. This affects the industrial IoT sensor that routinely sends its serial number, firmware version, and location data along with the measured value.
• Monitoring of security-relevant activities. The standard treats logging and monitoring as two separate families. For an embedded controller with a web interface, the existing log is therefore not enough.
• Protection of processed data. This covers not only stored and transmitted data, but also data that is being processed.
• Limiting the impact on other systems. This targets products that could themselves become a tool for an attack: limit outgoing traffic, and switch to a restricted network mode if an attack is suspected. In a machine, this affects the integrated switch and the cell firewall.

The growth in the extended families is also where the CRA goes beyond the RED: secure default and startup configuration, reset to the original state, removal of software components that are not needed, the behavior of automatic updates, and recovery after incidents.

How much of your RED work counts for the CRA

Article 69(1) of the CRA governs the transition. EU-type examination certificates issued for cybersecurity requirements under other Union harmonization legislation remain valid until June 11, 2028. This applies to RED certificates, but with two catches. A certificate covers only the risks it examined, and Article 13(2) of the CRA requires your own risk assessment in any case. Above all, the transition applies only if you hold a certificate at all. An EU-type examination certificate is issued by a notified body. If you applied EN 18031 and declared conformity yourself, there is nothing to carry over.

This lets you sort your existing evidence. Take the evidence on access control, authentication, storage, communication, and cryptographic keys with you, but review its content. Relabeling the identifiers is not enough. You must build three things from scratch: the four new families, the additional update and resilience requirements, and the entire vulnerability handling under Annex I, Part II of the CRA. EN 18031 has no counterpart for the last one. You must also rewrite every applicability justification based on the old two-step model. Our article on the repeal of the RED delegated act explains how the transition from the RED to the CRA works as a whole.

For many radio products, an ETSI standard will apply in the end

Before you check your evidence against the horizontal catalog, clarify whether EN 40000-1-4 is the right standard for your product at all. Routers, modems, and Wi-Fi access points are among the radio equipment tested against EN 18031 today. The CRA lists them in Annex III as important products of class I. Commission Implementing Regulation (EU) 2025/2392 provides the technical description, and ETSI EN 304 627 is being developed as a separate standard for exactly this category. It names wired and wireless routers as well as bridges, and so Wi-Fi access points. If you build such a product, you will probably demonstrate conformity through this standard rather than EN 40000-1-4, once it is cited in the Official Journal.

The scope contains two restrictions. Devices without a management function are excluded, and the standard explicitly excludes products for industrial OT. For those, it refers to the OT profile of the EN 50770 series. Firewalls and intrusion detection and prevention systems (IDS and IPS) are covered by ETSI EN 304 636, but the CRA classifies these products as class II.

The vertical standards also speak their own language. None of the vertical standards we reviewed references EN 18031 or EN 40000-1-4 normatively, and each uses its own requirement scheme. From the EN 40000 series, they cite only the vocabulary standard. The common denominator remains Annex I of the CRA, which each standard maps back to in its own annex. In return, they provide what the horizontal standard leaves open: ETSI EN 304 627 contains a worked-out threat model with an assessment framework. The horizontal standard gives you the catalog and leaves the threat analysis to you.

The standardization request explains why the two strands diverge. It asks for 41 standardization deliverables, but it requires consistency only with the framework standard and with the vulnerability handling standard. Alignment with the other horizontal standards is named only as a goal to be taken into account. Then there is the timetable. Under the original request, the framework standard and the vulnerability handling standard were due by August 30, 2026. All 26 vertical standards were due by October 30, 2026, and the 13 other horizontal standards only by October 30, 2027. A draft amendment by the Commission from July 2026 would move the first two deadlines to October 31 and December 31, 2026; as of mid-October 2026, it had not been adopted. The vertical standards are therefore scheduled a year ahead of most of the horizontal requirements.

The request expects the two strands to converge over the regular revision cycles. We think that is too optimistic. Alignment would mean replacing the requirement scheme in 26 standards and sending each one through the vote again, for a benefit that only standardization experts would notice. Expect the vocabularies to remain side by side.

For machinery and plant manufacturers, there is a second strand: the EN 50770 series is developing OT profiles based on IEC 62443. The two strands at least know about each other: the ETSI standards exclude the industrial domain and refer to the OT profiles. Our overview of the ETSI draft standards for the CRA covers the vertical standards in more detail.

What this means for your planning

Do not wait for the standards to mature before you start. The catalog exists, the additional requirements are known, and the effort for data minimization, update behavior, and resilience falls on development, not on documentation. If you wait until the standards are cited in the Official Journal, you lose the time you need for design changes.

Test in parallel so that you see the real risk. A control that fits on paper is not necessarily implemented correctly. This applies especially to the new families, where there is neither testing experience nor established evidence formats.

We are skeptical about the timetable. The standardization request sets October 30, 2027 for the last horizontal standards. After that, the Commission must still assess each standard and cite it in the Official Journal before it gives a presumption of conformity. That leaves six weeks until December 11, 2027. Plan a route that works without a presumption of conformity: your own risk assessment, from which you must derive which requirements apply to your product anyway.

The statements on EN 40000-1-4 are based on a non-public working draft by CEN and CENELEC from July 2026. The information on the standardization status reflects August 2026.