EN 18031 Certification
EN 18031 Consultancy for Compliance with the Radio Equipment Directive
The EN 18031 series establishes the cybersecurity requirements and assessment criteria applicable to radio equipment. Its application helps manufacturers demonstrate compliance with the essential requirements set out in Articles 3.3(d), 3.3(e) and 3.3(f) of Directive 2014/53/EU on radio equipment (RED).
These requirements, activated by Commission Delegated Regulation (EU) 2022/30, have applied since 1 August 2025 and affect a wide range of wireless products placed on the European Union market.
Digital Cubes helps manufacturers and developers determine which requirements apply to their products, identify potential non-compliances, prepare technical and documentary evidence, and address the conformity assessment process.
What is EN 18031?
EN 18031 is a series of European standards developed to demonstrate compliance with the cybersecurity requirements of the Radio Equipment Directive. It consists of three parts:
- EN 18031-1:2024: Protection of networks and prevention of harm to or misuse of network resources
- EN 18031-2:2024: Protection of personal data, traffic data, location data and privacy
- EN 18031-3:2024: Protection against fraud in equipment that enables the transfer of money, monetary value or virtual currency.
Depending on the product’s functions and characteristics, one or more parts may apply simultaneously.
Which products does it apply to?
In general terms, the standards affect products that incorporate a radio interface, such as Wi-Fi, Bluetooth, Zigbee, Thread, LTE/5G or similar technologies, and have one or more of the following characteristics:
- They provide Internet connectivity, either directly or through other equipment, and may affect the security or operation of communication networks.
- They process, store or transmit users’ personal data, traffic data or location data.
- They enable, authorise, store or facilitate financial transactions, or manage electronic money or virtual currency assets.
The presence of Wi-Fi, Bluetooth, NFC, mobile networks or another wireless technology does not, by itself, determine which parts of EN 18031 apply. The product’s intended purpose, interfaces, processed data, assets and provided functions must be analysed.
Which security requirements does EN 18031 cover?
The assessment examines the applicability and adequacy of the security mechanisms implemented by the product. The main areas assessed include access control, authentication, credential management, secure communications and storage, cryptography, software updates, personal data protection, secure deletion of information, resilience, network monitoring and attack surface reduction.
Not every mechanism applies to every product. The standards include decision trees and assessment criteria for determining which requirements must be analysed and what evidence the manufacturer must provide.
The assessment is structured in two stages. First, it is determined whether each mechanism applies to the product. Its implementation is then assessed to establish whether it is appropriate and sufficient to meet the corresponding requirement.
Harmonised standards and presumption of conformity
The EN 18031 series was published as a harmonised standard through Commission Implementing Decision (EU) 2025/138, although its publication includes certain restrictions.
When the manufacturer fully applies the relevant part of EN 18031 and the product is not affected by these restrictions, it may benefit from a presumption of conformity with the corresponding essential requirement of the Radio Equipment Directive.
The involvement of a Notified Body may be necessary when the standard is not applied in full, other technical specifications are used, or a restriction prevents the manufacturer from benefiting from the presumption of conformity.
Digital Cubes analyses these circumstances during the initial stage of the project and helps the manufacturer define the most appropriate conformity assessment route.
EN 18031 and the Cyber Resilience Act
EN 18031 and the Cyber Resilience Act (CRA) belong to different regulatory frameworks, although they share many security principles.
Applying EN 18031 can provide a useful foundation for meeting CRA requirements related to secure design, access control, the protection of data and communications, vulnerability management, security updates and attack surface reduction.
However, compliance with EN 18031 does not automatically mean compliance with all CRA obligations. The CRA introduces additional requirements concerning the product lifecycle, vulnerability management and reporting, the support period, technical documentation and the information provided to users.
Digital Cubes can coordinate both frameworks to reuse evidence and avoid duplicated activities.
Our EN 18031 consultancy services
Digital Cubes offers a comprehensive service that adapts to the product’s level of maturity, ranging from the initial applicability analysis to guidance and support throughout the formal evaluation. The main activities are described below.
Scope and applicability analysis
We analyse the product, its configuration, functions, communication technologies and processed data to determine whether it falls within the scope of the RED cybersecurity requirements.
The analysis identifies which parts of EN 18031 apply, which assets must be protected, which mechanisms must be assessed and whether any harmonisation restrictions affect the product. It also determines whether the product can follow a conformity assessment route based on the presumption of conformity or whether a Notified Body must be involved.
The resulting deliverables include a scope and applicability report, a requirements matrix and an initial conformity assessment strategy.
Documentation preparation and review
Digital Cubes prepares or reviews the documentation required to demonstrate compliance with the applicable requirements.
Depending on the product and the selected assessment route, this documentation may include the product description and configuration, security architecture, asset inventory, applicability matrix, applicability and non-applicability rationales, descriptions of security mechanisms, interfaces and communication flows, update procedures, test evidence, and instructions for secure installation, configuration, operation and maintenance.
The documentation is prepared consistently with the product under assessment and may be used to support the technical documentation required by the Radio Equipment Directive.
Pre-assessment and internal testing
Before submitting the product to a laboratory or Notified Body, we conduct a pre-assessment to determine its level of readiness.
During this stage, we review the responses to the decision trees, applicability evidence, implementation of security mechanisms, test cases and results, and consistency between the product and its documentation.
This process identifies potential non-compliances in advance and determines whether the product is ready to begin the formal assessment.
Coordination with laboratories and Notified Bodies
Digital Cubes can act as the manufacturer’s technical point of contact during the assessment process.
The service includes preparing the initial evidence package, coordinating with the laboratory or Notified Body, reviewing requests for information, preparing technical responses, participating in meetings and monitoring corrective actions.
Digital Cubes is an independent consultancy and does not act as an assessment laboratory or Notified Body. This independence allows us to focus on product preparation and technical support for the manufacturer.
Resolution of observations and non-compliances
Receiving questions, observations or findings is a normal part of a security assessment.
When a non-compliance is identified, we help the manufacturer analyse its root cause, determine whether technical or documentary changes are needed, define the solution, update the evidence and prepare a consistent response for the evaluator.
Our objective is to facilitate the closure of observations and prevent unnecessary delays or repetition of assessment activities.
Frequently asked questions
When did the RED cybersecurity requirements become applicable?
The requirements activated by Commission Delegated Regulation (EU) 2022/30 have applied since 1 August 2025. Products within its scope must demonstrate conformity before being placed on the European Union market.
Does EN 18031 apply to every product with Wi-Fi or Bluetooth?
ot necessarily. The product must fall within the scope of the Radio Equipment Directive and the Delegated Regulation. Whether EN 18031-1, EN 18031-2 or EN 18031-3 applies depends on the product’s connectivity, the data it processes and the operations it enables.
What is the difference between the three parts of EN 18031?
EN 18031-1 addresses network protection; EN 18031-2 addresses the protection of personal data and privacy; and EN 18031-3 addresses protection against fraud in products that enable transfers of money, monetary value or virtual currency.
A single product may be subject to more than one part.
Does EN 18031 always require third-party certification?
No. When the relevant harmonised standard is applied in full and the product is not affected by the published restrictions, the manufacturer may benefit from the presumption of conformity.
When the standard is not applied in full, other specifications are used or relevant restrictions apply, the involvement of a Notified Body may be necessary.
What is the presumption of conformity?
It is the legal effect associated with the correct application of a harmonised standard. It allows the product to be presumed compliant with the essential requirements of European legislation covered by that standard.
The presumption only extends to the requirements covered by the standard and is subject to the restrictions published in the Official Journal of the European Union.
Does Digital Cubes perform certification or official testing?
Digital Cubes provides consultancy, documentation preparation, pre-assessment and technical support. When formal testing or the involvement of a Notified Body is required, we coordinate the process with independent entities authorised to perform those activities.
What documentation does the manufacturer need?
This depends on the product and the applicable requirements. It will normally be necessary to document the architecture, protected assets, interfaces, security mechanisms, applicability decisions, update procedures, tests performed and secure usage instructions.
This documentation forms part of or supports the technical documentation required by the Radio Equipment Directive.
Can the process begin while the product is still under development?
Yes. Starting during the design stage allows security requirements to be incorporated before the architecture is finalised and reduces the cost of subsequent corrections.
Products that have already been developed can also be assessed through a gap analysis and remediation plan.
Does using a certified radio module guarantee compliance of the final product?
No. Assessments performed on the module may provide useful evidence, but the manufacturer remains responsible for demonstrating the conformity of the complete equipment, including its integration, configuration, software, interfaces and associated services.
Can a mobile application or cloud service form part of the assessment?
Yes. They may be relevant when they are involved in authentication, configuration, updates, data processing or the provision of security functions. Their role must be analysed within the product’s complete architecture.
Does EN 18031 replace ETSI EN 303 645?
No. ETSI EN 303 645 remains an important reference for the cybersecurity of consumer IoT products. However, EN 18031 is the series of harmonised standards specifically linked to the cybersecurity requirements of the Radio Equipment Directive.
What happens if the laboratory identifies non-compliances?
Digital Cubes helps analyse each observation, define corrective actions, update the documentation and prepare the new evidence or testing needed to resolve the issues raised by the evaluator.