From 1 August 2025, a major regulatory shift will take effect across the European Union, impacting all businesses selling radio-connected products on the EU market.
The new EN 18031 standard, introduced as part of the Radio Equipment Directive (RED) framework, will become mandatory for all relevant devices. Manufacturers and sellers who fail to meet this cybersecurity regulation will be barred from selling non-compliant products within the EU.
The new standard represents the EU’s growing emphasis on cybersecurity, privacy protection, and anti-fraud measures within connected consumer devices.
What is EN 18031?
EN 18031 is a new harmonised standard developed by the European Committee for Standardisation (CEN). It forms a crucial part of the RED Directive, which governs the compliance requirements of radio equipment sold within the EU.
EN 18031 specifically focuses on network security requirements, applying to devices that can connect to the internet either directly or indirectly. From 1 August 2025, compliance with EN 18031 will become mandatory for all applicable products entering the EU market.
The EN 18031 standard consists of three parts:
- EN 18031-1: Defines requirements to protect internet-connected devices and networks from unauthorised access and cyberattacks.
- EN 18031-2: Sets out safeguards to ensure personal data and user privacy are protected.
- EN 18031-3: Establishes controls to prevent fraud in devices handling financial transactions or exchanges.
What is affected?
The scope of EN 18031 is extensive and applies to a wide array of consumer and commercial devices. This includes:
- Connected consumer electronics such as smartphones, tablets, laptops, and smart TVs
- Wearable technology like smartwatches and fitness trackers
- Smart home and IoT devices, including smart cameras, baby monitors, voice assistants, smart locks, smoke detectors, and household appliances
- Financial transaction devices, such as smart payment terminals and crypto-enabled products
- Toys and children’s devices with wireless connectivity
Products already sold within the EU before the enforcement date may remain on the market, but all new production batches dated after 1 August 2025 must comply with EN 18031.
Exemptions
Some product categories are exempt from this standard, including:
- Medical devices governed by the Medical Device Regulation (EU 2017/745)
- Aviation and transport equipment regulated by other EU directives such as (EU) 2018/1139 and (EU) 2019/2144
- Non-connected products such as traditional hairdryers or tools that do not contain radio modules (these must still comply with other safety requirements)
Compliance should be built around a ‘secure-by-design’ approach, ensuring that cybersecurity considerations are incorporated throughout the product’s lifecycle.
This includes hardware design, firmware development, and supply chain controls. Sellers are advised to prioritise high-risk products, particularly those intended for children or for handling financial data, and work with compliance professionals to ensure readiness.
Frequently Asked Questions
Q1: Does EN 18031 require a marking separate to the CE marking?
A1: No. Devices do not need to carry a separate marking for EN 18031, but the Declaration of Conformity must clearly state that the product complies with this standard.
Q2: If I use a certified module in my product, do I still need certification?
A2: Yes. Even if the product includes an already-certified wireless module, the complete device must undergo EN 18031 compliance testing.
Q3: Do firmware updates require re-certification?
A3: Only if the update affects security-related features, such as changes to encryption algorithms. In such cases, re-evaluation by a Notified Body is required.
Q4: Are products manufactured outside the EU also affected?
A4: Yes—if they are imported to and sold within the EU, they must be compliant. However, products intended for non-EU markets are not subject to this requirement.
Ongoing compliance with TBA Global
TBA Global is a trusted provider of product safety testing and EU CE certification services.
TBA Global has supported thousands of businesses in navigating the complex process of achieving full compliance with EU requirements. Whether it’s VAT, EPR, product certification and much more, we’ve got you covered.
To ensure your products meet the upcoming EN 18031 requirements, contact us today for expert guidance and tailored compliance support.
