Tested to EN 303 645? What It Does and Doesn’t Cover in the EU
Last reviewed: 4 November 2026. General information, not legal advice.
You’ve paid a lab to test your smart device against EN 303 645, and it passed. That helps a lot in the UK, but on its own it won’t get the product through the EU’s radio security rules, which have applied since 1 August 2025. Those rules point to a different standard, and finding that out late, when a test lab or a regulator asks for the evidence, can hold up a launch.
EN 303 645 is a baseline for consumer smart-device security from ETSI, the European telecoms standards body, and it’s free to download from ETSI. EN 18031 is a set of three European standards written for the security rules of the Radio Equipment Directive (RED), the EU law for products with a radio. We couldn’t find a free copy of it, so we describe it here only from what EU law says about it.
In this article
- Two standards, two different jobs
- Diagram: which law points to which standard
- Which standard does each law name?
- Table: what each standard gives you under each law
- Where the two standards overlap
- Table: eight security topics, side by side
- Three example products
- Table: smart plug, Bluetooth toy, cellular tracker
- How many device apps publish a way to report a flaw?
- Checklist: what to do now
- For engineers: provisions, notices and versions
Two standards, two different jobs
The short answer: EN 303 645 is the standard the UK’s rules lean on, and EN 18031 is the one the EU’s radio rules list. Both cover some of the same ground, such as passwords, so why isn’t one test enough? Because a law only gives you its shortcut for the standard it names.
- In the UK, that law is PSTI, the UK’s security rules for consumer smart products, in force since 29 April 2024. Meeting named parts of the 2020 edition of EN 303 645 counts as meeting PSTI’s three requirements, though the support-period part comes with extra conditions on how you publish it.
- In the EU, a product that meets EN 18031 gets a presumption of conformity under the radio rules. That means it’s presumed to meet the requirements the standard covers, subject to three main restrictions.
Since 29 April 2024
Points to: EN 303 645 (version 2.1.1), three named provisions
Gives you: counts as meeting the three requirements (extra conditions for the support period)
Since 1 August 2025
Points to: EN 18031 parts 1, 2 and 3, with three main restrictions
Gives you: presumption of conformity. EN 303 645 isn’t on the list
In full from 11 December 2027; reporting duty since 11 September 2026
Points to: neither standard by name; no standard listed for it yet (4 November 2026)
So for a product sold in both places, plan for both: EN 303 645 evidence for the UK, and EN 18031 or an outside test body for the EU. That isn’t twice the work, because the overlap is real, as the table further down shows.
Which standard does each law name?
We checked the EU’s list of standards for the radio law, and every decision that has amended it, on 4 November 2026. EN 303 645 isn’t on it. The only entries for the security rules are the three parts of EN 18031, listed on 30 January 2025 with restrictions.
Why does that list matter? A harmonised standard is a European standard adopted at the Commission’s request to apply an EU law (Regulation (EU) No 1025/2012, Article 2). Once the EU lists it in its Official Journal for a law, meeting it gives the presumption, and under the radio rules it also lets you check the product yourself.
If you don’t apply a listed standard, or apply only part of it, a notified body (an independent test body approved by an EU country) has to take part.
| Law, and since when | EN 303 645 | EN 18031 |
|---|---|---|
| UK PSTI rules (since 29 April 2024) | Meeting provisions 5.1-1 (and 5.1-2 where relevant), 5.2-1 and 5.3-13 of version 2.1.1 counts as meeting the three requirements. For 5.3-13 (the support period), extra conditions apply: publish it in plain English, free and without asking for personal details, next to the product listing if you sell on your own website, update it if you extend it, and never shorten it | Not named |
| EU radio rules (since 1 August 2025) | Not on the EU’s list, so no presumption of conformity | Parts 1, 2 and 3 give a presumption of conformity, except where a restriction applies |
| EU Cyber Resilience Act (in full from 11 December 2027) | Not named in the law | Not named in the law |
EN 303 645 isn’t the only way to meet the UK rules: you can also meet the three requirements directly, without any standard. For the reporting requirement, set paragraphs of ISO/IEC 29147, the international standard on handling flaw reports, also count. And since December 2025, an unexpired Japanese JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme label counts for all three.
The UK names the 2020 edition
The UK rules name a specific edition: “ETSI EN 303 645 V2.1.1 (19th June 2020)”. ETSI’s current edition is version 3.1.3, which rewords some provisions, including the one on passwords. If your lab report cites the newer edition, check that it also shows you meet those provisions as the 2020 edition words them.
What the Cyber Resilience Act changes
The Cyber Resilience Act (CRA), the EU’s wider security law for connected products, takes over from the radio security rules on 11 December 2027. One part already applies. Since 11 September 2026, you must report actively exploited flaws and severe incidents in products it covers, and that duty applies “to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027” too.
The Commission has asked the European standards bodies for harmonised standards to support it.
When we checked on 4 November 2026, none had been listed. So neither EN 303 645 nor EN 18031 gives you a presumption under the CRA today. Our page on PSTI, the CRA and EN 18031 and when each applies compares the three laws themselves.
Where the two standards overlap
Most of the work you did for EN 303 645 isn’t wasted in the EU. Both standards deal with passwords, and EN 303 645 also covers ground the EU’s radio rules care about, such as protecting personal data. But since we couldn’t find a free copy of EN 18031’s text, we can only show its side where a public source describes it.
So the EN 18031 column below says only what the EU’s listing decision says about it. A blank there means the listing doesn’t say, not that the standard is silent.
| Topic | EN 303 645 (version 3.1.3) | EN 18031 (what the EU listing says) | UK PSTI rules |
|---|---|---|---|
| No shared default passwords | Required (5.1-1): unique per device or set by the user | Clauses 6.2.5.1 and 6.2.5.2 deal with default passwords; no presumption if users can skip setting any password | Required |
| A way to report security flaws | Required (5.2-1): a published disclosure policy with a contact and response times | Not stated | Required |
| Publish how long you’ll provide security updates | Required (5.3-13) | Not stated | Required |
| Secure software updates | Required (5.3-2) unless a resource constraint set by its use case prevents it | Part 3, clause 6.3.2.4: those update criteria give no presumption | Not one of the three requirements |
| Store keys and secrets securely | Required (5.4-1) | Not stated | Not one of the three requirements |
| Communicate securely | Required (5.5-1) | Not stated | Not one of the three requirements |
| Protect personal data | Required for sensitive personal data in transit (5.8-2), and you must tell users what data you process (6-1) | Part 2 is written for the personal data and privacy requirement | Not one of the three requirements |
| Parental controls on toys and childcare products | Given as an example under 5.1-4, not required | Part 2: no presumption if parental or guardian access control isn’t ensured | Not one of the three requirements |
Two rows matter most for a maker who’s done EN 303 645:
- Passwords. If your design lets a user skip setting a password, EN 18031 gives no presumption for that. In our reading, that means planning for a notified body or changing the design.
- Toys and childcare products. Parental or guardian control has to be in place for the presumption to hold.
Our self-check on whether EN 18031 applies to your device walks through which parts reach your product. If it comes with a phone app or a cloud service, the checklist on whether EN 18031 covers your companion app and cloud covers that side.
Three example products
What does this look like for a real product? Here’s how we’d read the rules for three common designs. Each row is a typical product, not a ruling on yours, and every one assumes it’s sold to consumers in the EU and Great Britain.
| Product | EU radio rules (now) | UK PSTI rules (now) | EU Cyber Resilience Act |
|---|---|---|---|
| Wi-Fi smart plug with a phone app and a user account | Network protection, as it’s online: EN 18031 part 1. Personal data too if the plug can handle any, such as account or usage data: part 2 | Applies, as it connects to the internet: EN 303 645’s three provisions are one way to show it | Its reporting duty now; its other requirements for plugs placed on the market from 11 December 2027 |
| Bluetooth toy that records a child’s voice and plays it back through a phone app, with nothing sent online | Personal data, because it’s a toy that handles personal data, even offline: EN 18031 part 2, with parental control in place for the presumption | Depends on its connections: in scope if, for example, it can connect over Bluetooth to two or more devices at the same time, and directly to an internet-connected one such as a phone | Its reporting duty now; its other requirements for toys placed on the market from 11 December 2027 |
| Cellular GPS tracker for bags or pets | Network protection, and personal data because it sends location data online: EN 18031 parts 1 and 2 | Applies, as it connects to the internet | Its reporting duty now; its other requirements for trackers placed on the market from 11 December 2027 |
In our reading, the CRA covers all three. So its reporting duty already applies to them: since 11 September 2026, you must report flaws attackers are using and severe incidents, even for units already sold.
None of the three moves money, so EN 18031 part 3, the part for payments, doesn’t come in.
In Great Britain, a radio product sold on its CE marking, the mark that says it meets EU law, has to meet the EU radio rules as well as PSTI. So a CE-marked plug or tracker needs both. In Northern Ireland, the EU radio rules apply and radio products are excepted from PSTI.
For the full scope of the EU rules, including what’s excluded, see our guide to whether the RED delegated act covers your wireless product.
How many device apps publish a way to report a flaw?
A published way to report a security flaw is one thing EN 303 645 and the UK rules both require, and the CRA will too. So it’s worth knowing how often makers already publish one.
A way to report a security flaw: often missing from makers’ websites
- Across the makers behind 550 connected-device apps on Google Play, our study of connected-device apps found: “For 306 of the 438 apps whose result we could determine (69.9%), we found none.” That’s about 7 in 10.
- Recognised device brands sold in Europe did better, but close to half their apps still had no route we could find: “For 137 of their apps, 75 (54.7%) have a route and 62 (45.3%) don’t.”
Source: SecureByDesignLabs check of connected-device makers’ websites, 21 October 2026. Each figure counts apps, so a maker with two apps counts twice. Method and limits are on the linked page.
That route is what a security researcher needs when they find a flaw in your product. A route we couldn’t find doesn’t mean a maker is breaking a law, though, as it might be published somewhere we didn’t look. Our connected-device readiness explorer lets you look up a maker; its figures come from its own monthly run, so they can differ from the study’s.
What to do now
- List where each product is sold: EU, Great Britain, Northern Ireland. That tells you which standard each market points to.
- For the EU, plan around EN 18031, not EN 303 645. Get the parts that apply and check how much of your existing test evidence maps onto them.
- Check the three main EN 18031 restrictions: users who can skip a password, parental control on toys and childcare products, and secure updates on anything that moves money. If one applies, book a notified body early.
- For Great Britain, check your PSTI evidence against the 2020 edition of EN 303 645, and make sure each product comes with its statement of compliance, the document PSTI asks for (or a summary of it). Since 4 December 2025, an unexpired JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme label counts instead. If you rely on EN 303 645 for the support period, publish it in plain English, next to the product listing if you sell on your own site. Our guide to the PSTI statement of compliance covers what goes in it.
- Publish a way to report flaws and your support period now, if you haven’t. EN 303 645 and the UK rules ask for both, and the CRA will too.
- Be ready to report under the CRA today: since 11 September 2026, actively exploited flaws and severe incidents in products it covers must be reported, including products already on the market.
We also do this as a paid readiness review: an outside check of which rules reach each product, and of your evidence before a lab or a regulator sees it. Email support@securebydesignlabs.com.
For engineers
EN 303 645 versions
- Current version: ETSI EN 303 645 V3.1.3 (2024-09), adopted 11 September 2024 (free from ETSI: EN 303 645 V3.1.3, read on 4 November 2026). Clause 4: the standard “does not define a testing or certification method”; ETSI TS 103 701 specifies a way to assess conformance. Annex B marks each provision M (mandatory) or R (recommendation). The provisions in the overlap table are all M in V3.1.3 (some only where the feature exists, F, or a condition is met, C); the 5.1-4 parental item is an example only. 5.3-2 applies “unless the device has a resource constraint determined by the use case that prevents the implementation”.
- Version the UK names: ETSI EN 303 645 V2.1.1 (2020-06), adopted 19 June 2020 (free from ETSI: EN 303 645 V2.1.1). V2.1.1 5.1-1: “Where passwords are used and in any state other than the factory default, all consumer IoT device passwords shall be unique per device or defined by the user.” V3.1.3 5.1-1 narrows this to passwords “used to authenticate users against the device or for machine-to-machine authentication”. 5.2-1 and the first sentence of 5.3-13 are the same in substance in both.
UK PSTI
- Regulations: S.I. 2023/1007, in force 29 April 2024, as amended by S.I. 2025/211 and S.I. 2025/1267 (legislation.gov.uk’s list of changes, checked on 4 November 2026, names no other amending instrument). Regulation 2(1) defines “ETSI EN 303 645” as “ETSI EN 303 645 V2.1.1 (19th June 2020)”. Schedule 1: the three requirements (passwords; “at least one point of contact” for reporting security issues, with when the reporter will receive an acknowledgment and status updates; “The defined support period must be published”). Schedule 2: deemed compliance, Condition A, via provision 5.1-1 “and, where relevant, provision 5.1-2” (passwords), 5.2-1 or ISO/IEC 29147 paragraphs 6.2.2, 6.2.5 and 6.5 (reporting), and 5.3-13 (support period, with the conditions below); Conditions B and C, JC-STAR STAR-1 and Singapore CLS labels, inserted from 4 December 2025.
- Act: PSTI Act 2022, section 5: an internet-connectable product uses the Internet Protocol suite; a network-connectable product meets the first or second connectability condition, the second being that it can connect directly to two or more products at the same time by a non-IP protocol and directly to an internet-connectable product.
- Northern Ireland and Great Britain: GOV.UK, Regulation (EU) 2022/30: factsheet: radio products in the RED’s scope made available in Northern Ireland are excepted from PSTI; “CE marked radio equipment placed on the GB market will need to meet these requirements”, and PSTI’s where in scope.
UK PSTI: the support-period conditions
- Schedule 2 paragraph 3(2): the 5.3-13 route is “subject to sub-paragraphs (3), (5) and (6) of paragraph 3 of Schedule 1 and to sub-paragraphs (3) and (4)” of Schedule 2 paragraph 3: an extended period “must be published as soon as is practicable” (Sch 1 para 3(3)); on your own website it “must be published alongside or otherwise given equal prominence to” the invitation-to-purchase information (3(5)); the requirement is “not met if the defined support period is shortened” (3(6)); and the information must be available “without prior request”, “in English”, “free of charge”, “without requesting the provision of P’s personal information” and “in such a way that is understandable by a reader without prior technical knowledge” (Sch 2 para 3(4)).
- The other routes: the password (5.1-1, 5.1-2) and reporting (5.2-1) routes carry no such extra conditions.
EU radio rules: presumption and procedures
- Presumption and procedures: Directive 2014/53/EU, Article 16 (presumption from harmonised standards “the references of which have been published in the Official Journal”); Article 17(3) (internal production control allowed where those standards are applied for Article 3(2) and (3)); Article 17(4) (where they are “not applied or … applied only in part”, or don’t exist: EU-type examination or full quality assurance, both with a notified body).
The EN 18031 listing
- The list: Implementing Decision (EU) 2022/2191, Annex I, the seven decisions amending it (2023/2392, 2023/2669, 2025/138, 2025/893, 2025/1741, 2025/2499, 2026/2003), and the Publications Office’s latest consolidated text of the list, searched on 4 November 2026 for “303 645”: no match.
- The EN 18031 rows: Implementing Decision (EU) 2025/138 (published 30 January 2025) adds EN 18031-1:2024, -2:2024 and -3:2024.
- The restrictions: all three parts: no presumption if, under clauses 6.2.5.1 and 6.2.5.2, “the user is allowed not to set and use any password”; the “rationale” and “guidance” sections confer none.
- Parts 2 and 3: EN 18031-2 Notice 3: none for equipment covered by clauses 6.1.3 to 6.1.6 if “parental or guardian access control is not ensured”. EN 18031-3 Notice 3: none as regards the assessment criteria in clause 6.3.2.4, which recital 8 of the Decision describes as criteria “for secure updates”.
Scope and dates
- Who the rules reach: Delegated Regulation (EU) 2022/30, Article 1: Article 3(3)(d) for internet-connected radio equipment; (e) where it can process personal, traffic or location data and is internet-connected, a toy, childcare-only or wearable; (f) where it lets the user transfer money, monetary value or virtual currency. Applies from 1 August 2025 (Delegated Regulation (EU) 2023/2444); repealed with effect from 11 December 2027 (Delegated Regulation (EU) 2026/339).
The CRA
- Law: Regulation (EU) 2024/2847, Article 71(2): applies from 11 December 2027, “However, Article 14 shall apply from 11 September 2026”; Article 69(3): Article 14 applies “to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027”. The text names neither EN 303 645 nor EN 18031.
- Standards: Commission FAQs on the CRA implementation, version 1.4 (4 September 2026), section 6.10: standardisation request M/606 to CEN, CENELEC and ETSI, and assessment under Article 27(6) before a reference is published in the Official Journal. A Publications Office title search on 4 November 2026 found no decision publishing harmonised standards under Regulation (EU) 2024/2847.
Sources and limits
- EN 303 645: ETSI’s free PDFs of V3.1.3 and V2.1.1, read on 4 November 2026. We quote only provision numbers and short passages, and don’t reproduce the standard.
- EN 18031: we haven’t read it, as we couldn’t find a free copy. Everything we say about it comes from Implementing Decision (EU) 2025/138 and the radio law.
- EU and UK legal texts as published by the Publications Office and legislation.gov.uk, checked for later amendments on 4 November 2026. The GOV.UK factsheet on Regulation (EU) 2022/30.
- Our figures: SecureByDesignLabs check of connected-device makers’ websites, 21 October 2026. We measured what’s published on websites only, not whether any product meets any of these laws.
- The example products are our reading for typical designs, not a statement of the law for your product.
Last reviewed 4 November 2026. This is general information, not legal advice.
Responses