Does EN 18031 Apply to Your Device? A Self-Check for Makers

Last reviewed: 30 October 2026. General information, not legal advice.

If your device has a radio and goes online, regulators in EU countries can pull it from sale when your paperwork can’t show it meets the security rules. Those rules have been part of EU radio law since 1 August 2025, and EN 18031, a set of three European standards, is the standard the EU has listed for meeting them.

Which of the three parts you need depends on what your device does. But here’s the catch: one design choice the standard allows, letting users skip setting a password, means the standard no longer counts as proof on its own. Below you’ll find a four-question self-check, what each part asks for, the proof to have ready, and what changes on 11 December 2027.

Does EN 18031 apply to your device?

The law behind it is the Radio Equipment Directive (RED), the EU law that products with a radio, from a smart plug to a fitness band, have to meet before they’re sold in the EU. A 2022 add-on to the RED switched on three security requirements, labelled (d), (e) and (f). Each EN 18031 part matches one of them.

Work down the table. The words in quotes are the law’s own; where we say how a rule applies to a particular design, that’s our reading of it.

Does your device get online only through your phone app or a hub? That usually still counts as internet-connected under question 2. Civil aviation equipment, vehicle type-approval and electronic road-toll equipment are outside (e) and (f), though (d) can still apply.

A device that links to a user’s account, records sound or video, or knows where it is will usually process personal data. So if yours does any of these, expect Parts 1 and 2 together. Part 3 is only for devices that move money or virtual currency.

What does each part ask for?

Follow one of these standards in full and, subject to the restrictions below, your device is presumed to meet the requirement it covers. That’s because on 30 January 2025 the Commission listed all three in the Official Journal (OJ), the EU’s official record of its laws, as harmonised standards, meaning standards written at the EU’s request to support a law. Listing them there is what gives that presumption legal force.

EN 18031 was written by CEN and CENELEC, the European standards bodies, at the Commission’s request. The standards aren’t free: CEN and CENELEC don’t sell them themselves, and you buy them through national standards bodies, their members in each country. So we describe them only as far as CEN-CENELEC and the Commission do in public.

The Commission’s decision that lists the standards starts with recitals. These are the numbered reasons an EU law gives for itself. Here they show a little of what’s inside: rules on default passwords, access control for toys and childcare products, and secure updates for devices that handle money.

Those same three topics are where the EU restricted the standards, and that’s where a design can come unstuck.

Will you pass first time? Check the restrictions

Here’s where makers get caught out. The standards weren’t listed in full. The Commission attached notices that switch off the presumption in set cases, and if your design hits one, the standard alone won’t prove your device meets the law.

• Users can skip the password. In all three parts, there’s no presumption if the device lets the user “not to set and use any password” under the standards’ default-password rules. The Commission’s reason is that the login risks “will not be properly addressed” if users can skip it.
• A toy or childcare device without parental control. EN 18031-2 gives no presumption where “parental or guardian access control is not ensured”.
• A payment device relying on the update rules. EN 18031-3’s criteria for secure updates give no presumption, because none of its four methods “alone are sufficient for the treatment of financial assets”.
• The “rationale” and “guidance” sections of all three parts don’t give a presumption either.

What happens if you hit one? Where you haven’t applied a listed standard, or have applied it only in part, the RED sends that requirement to a notified body, an independent test body that an EU country has approved and reported to the Commission. It examines your device’s technical design and attests that it meets the requirements.

In our reading, that’s what a restriction means in practice. So either change the design so it doesn’t apply (for example, make users set a password), or book a notified body early. If no restriction applies and you follow the standards in full, you can assess these security requirements yourself.

What proof will you need?

Whichever route you take, the proof sits in your technical documentation, the file you must draw up before the device goes on sale and keep up to date. If it’s missing or incomplete and you don’t fix it, a regulator can restrict sales or have the product withdrawn or recalled.

The RED’s list of what the file holds includes these, wherever they apply:

• the versions of software or firmware that affect compliance;
• the harmonised standards you applied, in full or in part, and which parts; where you didn’t apply one, a description of what you did instead;
• test reports, and the results of design calculations and examinations;
• a copy of your EU declaration of conformity, the signed statement that the device meets the law;
• if a notified body examined the design, its certificate.

Then comes the CE marking, the logo by which you indicate that the device meets the EU rules that apply to it.

Much of the security behaviour these rules cover, such as pairing, logins and updates, often runs through your phone app and cloud. Our checklist on whether EN 18031 covers your companion app and cloud walks through those parts.

What changes on 11 December 2027?

The radio rules’ security requirements are on a timer. In February 2026, the Commission adopted a regulation that repeals the 2022 act that switched them on, “with effect from 11 December 2027”.

That’s the day the Cyber Resilience Act (CRA), the EU’s security law for software and connected products, applies in full. The Commission says the CRA’s requirements already “include all the elements” of (d), (e) and (f), so the CRA takes over that job.

Two points matter for planning. Devices placed on the EU market between 1 August 2025 and 10 December 2027 that were subject to the radio rules can still be checked against them after the switch. And the CRA asks for things the three radio requirements don’t mention, such as “a contact address for the reporting of the vulnerabilities” found in your product.

Not every maker publishes one yet. The box below shows how often we couldn’t find one.

One CRA duty is already live. Since 11 September 2026, makers of products the CRA covers must report flaws that attackers are actively exploiting in them. Our guide to what the Cyber Resilience Act asks of app teams, and by when covers the dates and duties in full.

Selling in the UK too?

The UK has its own rules. Since 29 April 2024, the UK’s PSTI rules, its security law for consumer connectable products, have set requirements for makers on passwords, on how people can report security issues, and on telling buyers how long security updates will last.

Some products are excepted, each with conditions, such as smart meters, electric-vehicle charge points, and desktop and laptop computers. Computers made only for children under 14 are not excepted (Schedule 3 of the PSTI Regulations).

The regulations also set what a product’s statement of compliance must say (regulation 7 and Schedule 4). Our guide to the UK PSTI statement of compliance explains what goes in it.

Where to go next

• Run the self-check above with whoever owns your device’s compliance, and note any restriction you hit.
• See what your product shows from outside. Search for it in our connected-device readiness explorer, which shows what a buyer or auditor can see on your public website, such as whether you publish a way to report a flaw.
• Check your app testing. If your device has a phone app, our map of OWASP MASVS against the CRA and EN 18031 shows what your existing mobile app testing already covers. MASVS is a free checklist of security controls for mobile apps from OWASP, a non-profit that publishes open security guides.

If you’d like an outside check of your evidence before it goes to a lab, we do that as a paid review. Email support@securebydesignlabs.com.

For engineers

Scope

Delegated Regulation (EU) 2022/30, Article 1(1) to (3), applies points (d), (e) and (f) of Article 3(3) of the RED (Directive 2014/53/EU). Article 1(2) covers internet-connected equipment, equipment “designed or intended exclusively for childcare”, equipment covered by Directive 2009/48/EC (toys) and wearables.

For (e), the equipment must be capable of processing personal data “or traffic data or location data”. That “or” is the wording as corrected by Delegated Regulation (EU) 2023/2444, Article 2. Article 1(3) ties (f) to Directive (EU) 2019/713’s definition of virtual currency.

Article 2(1) excludes equipment under Regulations (EU) 2017/745 and 2017/746 from all three points. Article 2(2) excludes equipment under Regulation (EU) 2018/1139, Regulation (EU) 2019/2144 and Directive (EU) 2019/520 from (e) and (f).

The original application date was 1 August 2024. Delegated Regulation (EU) 2023/2444, Article 1, replaced it: “It shall apply from 1 August 2025.”

The listing and its notices

Implementing Decision (EU) 2025/138 of 28 January 2025 (OJ 30.1.2025) adds rows 164 to 166 to Annex I of Implementing Decision (EU) 2022/2191:

• Notice 1, all parts: the “rationale” and “guidance” sections “do not confer a presumption of conformity”.
• Notice 2, all parts: no presumption if, when applying clauses 6.2.5.1 and 6.2.5.2, “the user is allowed not to set and use any password” (recital 6).
• EN 18031-2, notice 3: clauses 6.1.3 to 6.1.6, where “parental or guardian access control is not ensured” (recital 7).
• EN 18031-3, notice 3: no presumption for the assessment criteria in clause 6.3.2.4, on secure updates (recital 8).

We checked the later acts amending Annex I of 2022/2191, Implementing Decisions (EU) 2025/893, 2025/1741, 2025/2499 and 2026/2003, on 30 October 2026, and none of them mentions EN 18031.

Conformity routes and evidence

RED Article 16 gives the presumption of conformity. Article 17(3) allows internal production control (Annex II), EU-type examination (Annex III) or full quality assurance (Annex IV) where listed harmonised standards are applied. Article 17(4) requires Annex III or IV where they are “not applied or … applied only in part”.

In Annex III, Module B, “a notified body examines the technical design”. Article 22 covers how Member States notify these bodies.

Article 21 sets the technical documentation rules, and Annex V lists its contents; points (a)(ii), (d), (e), (f), (g) and (h) are summarised above. Article 18 and Annex VI cover the EU declaration of conformity, and Articles 19 and 20 the CE marking.

Article 43 lets a Member State act on formal non-compliance, including technical documentation that is “either not available or not complete”. If that persists, Article 43(2) requires measures to “restrict or prohibit” the equipment being made available, or to have it withdrawn or recalled.

The handover to the CRA

Delegated Regulation (EU) 2026/339 of 16 February 2026, Article 1: “Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027.” Recital 3 gives the reason, and recital 5 keeps market surveillance for equipment placed on the market from 1 August 2025 to 10 December 2027.

The CRA, Regulation (EU) 2024/2847, applies from 11 December 2027, with Article 14 from 11 September 2026 (Article 71(2)). The contact-address requirement is Annex I, Part II, point 6.

Sources and limits

• Legal texts: Directive 2014/53/EU, Delegated Regulations (EU) 2022/30, 2023/2444 and 2026/339, Implementing Decision (EU) 2025/138 and Regulation (EU) 2024/2847, as published in the Official Journal of the European Union, read on 30 October 2026. UK: the PSTI Regulations 2023, regulations 1, 6 and 7 and Schedules 1, 3 and 4.
• Standards: CEN-CENELEC, “New Cybersecurity Standards Support Compliance with RED Directive”, posted 15 February 2025. We describe EN 18031 only through that page and the Commission’s notices; the standards themselves are sold through national standards bodies, not by CEN and CENELEC, and aren’t reproduced here.
• Our figure: SecureByDesignLabs measurement of connected-device apps and their makers’ websites, checked 21 October 2026; the method and limits are in the linked study.
• Lists of harmonised standards change. Check the Official Journal for a later listing before relying on the restrictions above.
• Where we say “in our reading” or “usually”, that’s our interpretation, not a statement of the law.

Last reviewed 30 October 2026. This is general information, not legal advice.