Cybersecurity under the Radio Equipment Directive, and how EN 18031 is applied

What applies, and to which equipment

Applying EN 18031 to a specific product is the manufacturer's responsibility.

European Commission guidance on the EN 18031 restrictions

Which equipment is caught

Caught. Three separate tests, not one. Article 3(3)(d) catches radio equipment that can communicate over the internet, on its own or through a phone, gateway, or router: connected sensors, cameras, appliances, industrial gateways. Article 3(3)(e) catches equipment that can process personal, traffic or location data and is internet-connected, designed exclusively for childcare, a toy, or worn on the body or clothing. Article 3(3)(f) catches internet-connected equipment that lets its user transfer money, monetary value or virtual currency.

Still caught, often assumed otherwise. Equipment sold business-to-business, equipment behind a customer firewall, and equipment whose connectivity is provided by an integrated third-party module. Connectivity that is present but disabled by default is still connectivity.

Excluded, and narrower than often assumed. Equipment also covered by the medical device or in vitro diagnostic regulations is excluded from (d), (e) and (f). Equipment also covered by the civil aviation, motor-vehicle type-approval or electronic road toll legislation is excluded from (e) and (f) only, not from (d). Equipment with no internet communication at all is outside (d) and (f), but a childcare product, toy or wearable that processes personal, traffic or location data stays inside (e) even offline. Every exclusion needs a written determination, not an assumption.

Two things the cybersecurity file does not settle

Article 3(1)(a) health and safety, Article 3(1)(b) EMC, and Article 3(2) efficient use of spectrum remain part of the same conformity assessment, and questions about antennas, modified housings, shielding, or enabled bands ordinarily need a competent testing laboratory. No route conclusion follows from EN 18031 evidence alone.

And a CE-marked module is evidence, not cover. The object of assessment is the final radio equipment placed on the market under the manufacturer's name. A supplier declaration for an incorporated module or router is supporting evidence subject to integration conditions, and where a router leaves its original housing that evidence may no longer be representative.

The controls a good assessment finds

EN 18031 names mechanisms. Conformity is carried by the controls behind them, decided per assessment unit rather than once for the product. A control is only evidence when it is reproducible: each control needs a named implementation in the declared configuration, an artefact showing it works, and a production step that reproduces it on every unit. A control shown on an engineering sample but not enforced in manufacturing does not support the declaration.

Four gates decide whether you can sign this yourself

Annex II internal production control lets the manufacturer declare conformity alone. For Article 3(3), Article 17(3) allows it where the cited harmonised standards are applied, and Article 17(4) sends any requirement where they are absent, not applied or only partly applied to Annex III or Annex IV. Every gate must pass for each applicable requirement. One failure sends that requirement to Annex III or Annex IV.

The four Official Journal restrictions

• The password option, all three parts. Presumption is lost where clauses 6.2.5.1 and 6.2.5.2 are applied so the user may set no password at all. Commission guidance is that no third-party assessment is required on this ground if the manufacturer does not offer that option. It does not mean every product needs a user password: the clauses bite where the standard requires a password-based mechanism. Check onboarding, reset and recovery as well, because instructions that later tell the user how to remove the password trigger the restriction. This is the most common self-inflicted trigger.
• Secure update, EN 18031-3 clause 6.3.2.4. Presumption is removed for those assessment criteria, and Commission guidance states third-party conformity assessment is mandatory where the clause applies, whatever the design. Clause 6.3.2.4 is how the secure update requirement for financial assets is assessed, and that requirement has no exceptions of its own, so in practice almost every Part 3 product with updatable software needs a Notified Body for Article 3(3)(f). Signing the update does not restore presumption.
• Parental control, EN 18031-2. Presumption is lost for the specified toy and childcare clauses where parental or guardian access control is not ensured. Those clauses cover toys and childcare equipment, not wearables or ordinary connected products. A laboratory verdict on them checks access by an authorised entity, so ask for evidence that the authorised entity is actually the parent or guardian.
• Rationale and guidance sections. Those sections set no specifications and confer no presumption, so conclusions must be tied to the normative requirements. No third-party assessment follows from this restriction alone.

If a Notified Body is required, only the failing requirement goes to Annex III or IV. The rest can still run under Annex II. The body must be notified for that specific requirement, its certificate must match the declared configuration, and the Declaration of Conformity must name the procedure actually used. Under Annex III the body is named in the declaration; its number follows the CE marking only when Annex IV full quality assurance is used.

Six questions to ask first

Every answer of no or partly is a gap to close before the declaration is signed, and some of them, such as an unchecked restriction, decide the route rather than just the paperwork.

Summary and interpretation only, not a conformity assessment or legal advice. The manufacturer retains responsibility for the conformity assessment, the technical documentation, and the EU Declaration of Conformity.