EN 18031 Cybersecurity Standards for Radio Equipment
EN 18031 is the harmonized standard series for cybersecurity in radio equipment. It helps manufacturers show that their products meet the cybersecurity requirements that Commission Delegated Regulation (EU) 2022/30 added to the Radio Equipment Directive (Directive 2014/53/EU), or RED. The series has three parts: EN 18031-1, EN 18031-2, and EN 18031-3. Cybersecurity of radio equipment is one of several areas where EU cybersecurity regulation now sets binding requirements for products.
Contents
Structure of EN 18031
The Radio Equipment Directive used to deal mainly with safety and electromagnetic compatibility. Delegated Regulation (EU) 2022/30 activated the essential requirements in Article 3(3) of the RED that cover cybersecurity. Since then, internet-connected radio equipment must meet new cybersecurity requirements.
EN 18031 gives manufacturers uniform test procedures to demonstrate conformity with these requirements. Affected equipment has had to meet them since August 1, 2025.
The standard specifies the cybersecurity requirements of the RED. It has three parts:
EN 18031-1: Internet-connected radio equipment
This part sets out test procedures and conditions for checking whether internet-connected radio equipment complies with Article 3(3)(d) of the RED. That provision requires that radio equipment does not harm the network or its functioning.
EN 18031-2: Radio equipment processing data
Part 2 covers radio equipment that processes data: internet-connected equipment, childcare radio equipment, toy radio equipment, and wearable radio equipment. It checks compliance with Article 3(3)(e) of the RED on the protection of personal data and privacy.
EN 18031-3: Internet-connected radio equipment processing virtual money or monetary value
Part 3 deals with radio equipment that processes virtual currency or monetary value. It defines test procedures for Article 3(3)(f) of the RED, which requires features that protect against fraud.
Concepts in EN 18031
EN 18031 provides a flexible framework for the security of radio equipment. It takes into account how complex and varied modern devices are and gives manufacturers clear guidance for implementing effective security measures.
The standard is built on the following concepts:
Security by design
The standard stresses that security must be part of development from the start rather than added afterward. EN 18031 does not prescribe detailed development processes itself, but it refers to proven methods and standards for secure product design.
Structured threat analysis
EN 18031 recommends the STRIDE model. It helps manufacturers think systematically about possible threats by looking at six main categories: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
Categories of security measures
The standard sorts security requirements into five main categories:
- Identify: recognize security risks
- Protect: prevent or limit security incidents
- Detect: discover security incidents
- Respond: act appropriately on detected incidents
- Recover: restore normal operation after a security incident
Assets
The standard introduces the term “assets” to define what security measures must protect. Assets include network assets, security assets, privacy assets, and financial assets. This helps manufacturers target protection at the most important parts of their product.
Mechanisms
The standard uses “mechanisms” to address specific security requirements. This allows the requirements to be applied flexibly to different types of devices and use cases.
Practical assessment methods
The standard provides concrete tools for assessing conformity:
- Decision trees help determine whether a requirement applies.
- Requirements for technical documentation show which information manufacturers must provide.
- Guidance on security testing explains how to verify that the requirements are implemented.
EN 18031 aims to offer a balanced and practical way to improve the security of radio equipment. It recognizes that no single solution fits every device. Instead, it gives manufacturers a framework for choosing security measures that suit their specific products.
EN 18031 requirements
The requirements of EN 18031 cover a wide range of security topics, from basic network security to the protection of personal data and fraud prevention. They follow the principle of security by design, which keeps the approach flexible without lowering the level of security.
The requirements by category:
Access control mechanism (ACM)
These requirements call for suitable access control mechanisms that prevent unauthorized access to security and network assets. The mechanisms must be adapted to the assets concerned and to the intended operational environment.
Authentication mechanism (AUM)
This category defines requirements for authenticating entities that want to access network and user interfaces. Authentication must use at least one factor. Authenticators must be validated and must be changeable. The category also sets rules for passwords and for protection against brute-force attacks.
Secure update mechanism (SUM)
The device must have a software update mechanism that ensures the integrity and authenticity of updates. Updates must be automated or at least possible with minimal user interaction.
Secure storage mechanism (SSM)
Security and network assets that are stored persistently must be protected by suitable integrity and confidentiality mechanisms. Devices must use secure storage so that stored security and privacy assets are protected against unauthorized access. This includes encryption and other forms of data protection.
Secure communication mechanism (SCM)
When security and network assets are communicated over network interfaces, they need integrity, authenticity, confidentiality, and replay protection in line with best practices. The requirements cover secure communication protocols that protect data in transit, including protection against replay attacks.
Logging mechanism (LGM)
Devices should be able to log relevant internal activities to support privacy and security. Logs must be stored persistently and should carry timestamps so that they can help in investigations.
Deletion mechanism (DLM)
Secure deletion mechanisms must allow users or authorized entities to delete personal and private data. This matters when a device is disposed of or replaced.
User notification mechanism (UNM)
Devices should provide notification mechanisms that inform users about changes that can affect the protection of personal information or privacy.
Resilience mechanism (RLM)
The device must have mechanisms that mitigate the effects of denial-of-service attacks on its network interfaces and allow it to recover from them.
Network monitoring mechanism (NMM)
Network equipment must have mechanisms that detect signs of denial-of-service attacks in the network traffic it processes.
Traffic control mechanism (TCM)
Equipment that connects other devices to public networks must provide mechanisms to control and filter network traffic.
Confidential cryptographic keys (CCK)
These requirements cover adequate key strength, key generation, and the avoidance of static default values for confidential cryptographic keys.
General equipment capabilities (GEC)
This category covers requirements to remove known vulnerabilities, limit exposed services, document interfaces and services, remove unnecessary interfaces, and validate inputs.
Cryptography (CRY)
The cryptographic methods used must follow best practices.
Which EN 18031 requirements apply to your product?
Not every EN 18031 requirement is relevant to every product. What matters is which radio interfaces, data processing, and functions your product has, and which mechanisms you therefore have to demonstrate. We help you classify the requirements and derive the technical and documentary evidence you need.
Because the requirements serve different protection goals, not every part of the standard contains every requirement.
| Requirement | EN 18031-1 | EN 18031-2 | EN 18031-3 |
|---|---|---|---|
| Access control mechanism (ACM) | x | x | x |
| Authentication mechanism (AUM) | x | x | x |
| Secure update mechanism (SUM) | x | x | x |
| Secure storage mechanism (SSM) | x | x | x |
| Secure communication mechanism (SCM) | x | x | x |
| Logging mechanism (LGM) | x | x | |
| Deletion mechanism (DLM) | x | ||
| User notification mechanism (UNM) | x | ||
| Resilience mechanism (RLM) | x | ||
| Network monitoring mechanism (NMM) | x | ||
| Traffic control mechanism (TCM) | x | ||
| Confidential cryptographic keys (CCK) | x | x | x |
| General equipment capabilities (GEC) | x | x | x |
| Cryptography (CRY) | x | x | x |
Testing and assessment
EN 18031 uses a system of mechanisms to assess and improve the cybersecurity of radio equipment. These mechanisms are the backbone of the standard. They are structured to address both whether a security measure applies and whether it is adequate.
Mechanisms
Each mechanism starts with an applicability check. It establishes whether a security measure is relevant for the device or for a specific component at all. Not every security measure makes sense or is necessary for every device. The applicability check keeps manufacturers from investing in security features that do not matter for their product.
If a mechanism applies, its adequacy is assessed next. This step checks whether the implemented measure meets the requirements of the standard and is effective enough to address the identified risks. A poorly implemented security measure may not offer enough protection and can even create new vulnerabilities.
Most mechanisms also have supporting requirements. They specify aspects of the main requirements in more detail or cover additional points needed to implement the mechanism in full.
Assessment
To check compliance with these mechanisms, EN 18031 defines three main types of assessment: conceptual assessment, functional completeness assessment, and functional sufficiency assessment.
The conceptual assessment reviews the documentation. It shows how the manufacturer interprets the security requirements and plans to implement them. This confirms that the manufacturer has understood the requirements in full.
The functional completeness assessment checks whether all relevant aspects of the device and its security functions are documented and taken into account. For example, network scanners can be used to confirm that all external interfaces have been identified correctly.
The functional sufficiency assessment goes one step further and examines how the security measures are actually implemented. It often involves practical tests, such as fuzzing to test how well network interfaces withstand malformed input.
The standard uses decision trees to structure and guide these assessments. They lead assessors step by step through the process and make sure that no relevant aspect is missed.
This approach covers both the design and the practical implementation of security. It checks that security measures are not only present but also effective and adequate.
Current status of EN 18031
On January 30, 2025, EN 18031 was published as a harmonized standard for the Radio Equipment Directive. Commission Implementing Decision (EU) 2025/138 lists the EN 18031 series as a means of meeting the requirements of Article 3(3)(d), (e), and (f) of the RED.
However, the presumption of conformity has significant restrictions:
- Passwords: If the device allows the user not to set or use any password (clauses 6.2.5.1 and 6.2.5.2 of EN 18031), there is no presumption of conformity.
- “Rationale” and “guidance” sections: These sections of the standards only support the reader. They do not confer a presumption of conformity.
- Toys (EN 18031-2): For products classified as toys, there is no presumption of conformity if the access control methods (RBAC, DAC, MAC) do not ensure that only parents or guardians control access.
- Secure updates (EN 18031-3): The assessment criteria for secure updates (SUM-2, clause 6.3.2.4) do not confer a presumption of conformity with Article 3(3)(f) of the RED.
If the presumption of conformity does not apply, you must involve a notified body.
Despite these restrictions, the harmonization of EN 18031 is a significant step. It gives companies a standardized basis for meeting the cybersecurity requirements of the RED. Manufacturers must still check carefully whether their products meet the requirements in full or whether an additional assessment by a notified body is required.
This presumption of conformity is limited in time. Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from December 11, 2027. After that date, EN 18031 no longer gives a presumption of conformity under the RED, and the cybersecurity requirements follow from the CRA. Our article on the repeal of the RED delegated act has the details.
EN 18031 as a basis for EN 40000
EN 18031 is the technical starting point for the EN 40000 series, which is being developed for the Cyber Resilience Act (CRA). The responsible working group, CEN/CLC/JTC 13/WG 9, develops the generic security requirements for products with digital elements. It builds on the EN 18031 series and adds further security controls.
EN 40000-1-4 adopts the identifier scheme of EN 18031. It has, however, revised the requirements it took over and aligned them with the essential cybersecurity requirements of the CRA. For certain CRA requirements, such as secure default configuration, data minimization, or reducing the impact of attacks, it adds new requirements. The mapping between the two standards is in an informative annex. EN 40000-1-4 does not list EN 18031 as a normative reference.
If you already apply EN 18031 for the RED, part of your technical groundwork remains useful for CRA conformity under EN 40000. It does not replace a separate assessment against EN 40000-1-4.
Use EN 18031 as a basis for the RED Delegated Act and the CRA
If you implement EN 18031 for your radio equipment, much of the technical evidence can also be relevant for your CRA preparation. We help you assess your products and compare them with the requirements of the RED Delegated Act. Together we decide which measures you can reuse for the CRA and EN 40000 and which you need to add.