图片名称

be careful! The EN 18031 series standards have officially become the coordination standards of the RED directive

Author.

LCS

Source:

Post time:

2025-03-24

On January 30, 2025, the European Commission officially included the EN 18031 series of standards in the list of coordinated standards for the Radio Equipment Directive (RED) in the Official Journal of the European Union (OJ), marking that this series of standards has become an important basis for network security compliance of radio equipment within the EU. The new regulations will be enforced from August 1, 2025, undoubtedly posing an urgent requirement for manufacturers to take immediate action.

New regulations content

RED directive strengthens network security requirements

According to the European Union's Radio Equipment Directive (RED), all radio equipment sold in Europe must meet mandatory requirements such as network security and privacy protection. The newly added Article 3 (3) in 2022 specifies three core requirements:

Preventing network attacks and service interruptions (clause d)

Personal Data and Privacy Protection (Clause e)

Preventing virtual currency fraud (clause f)

Interpretation of New Regulations

The three major restrictive clauses of EN 18031 series

The EN 18031 series standards provide specific technical specifications for the above requirements. With the inclusion of the EN 18031 series in the OJ, companies are allowed to use self declaration or third-party conformity assessment methods to meet compliance requirements. But manufacturers need to pay special attention to their official restriction clauses, otherwise they may not be able to pass the compliance declaration:

Limitation 1: The "Background" and "Guidelines" sections in the standard are invalid

The "rational" and "guidance" sections in EN 18031-1/2/3 are for reference only and do not serve as a basis for compliance.

Restriction 2: Allow users to not set a password (including PIN code)

If the device uses authenticated passwords for user authentication and allows users to use the product without setting or using any passwords (including PIN codes), it cannot be declared compliant in the form of a self-assessment statement.

For example, if mobile phones and tablets allow "password free use", a third-party qualification assessment path must be used.

However, please note that if the device pairing uses a key for identity authentication instead of a password, it can be compliant in the form of a self-assessment statement.

Limitation Three: Additional Requirements for Special Scenarios

A. For children's toys and monitoring equipment (applicable to EN 18031-2):

If the device adopts role-based, autonomous, or mandatory access control, but does not support parental/guardian control management permissions, a self-assessment statement cannot be used to claim compliance, and a third-party qualification assessment method must be used.

For example, the products involved include children's toys, wearable devices, and wireless devices for infant monitoring.

However, due to the relatively high risks associated with children's toys and monitoring equipment, it is highly recommended that companies adopt a third-party qualification assessment pathway.

B. Financial functional equipment (applicable to EN 18031-3):

The products involved include wireless devices that support virtual currency transactions (such as payment terminals, cryptocurrency hardware wallets). If only meeting the "security update" clause in the standard (such as digital signatures, secure communication, and other single measures) is not enough to prevent financial risks, multiple protection mechanisms need to be combined. Third party qualification assessment method must be adopted.

In summary, if a company falls under the three restrictions mentioned above, it cannot adopt a self-assessment statement and must use a third-party qualification assessment method to ensure compliance.

Compliance Path

Manufacturers must follow four steps

Given that the new regulations will be enforced from August 1, 2025, manufacturers must initiate the following work as soon as possible:

1. Confirm the scope of application of the product

Determine whether the equipment categories classified according to EN 18031-1/2/3 are subject to the new regulations.

2. In depth interpretation of EN 18031 standard clauses

Fully understand the applicable terms and limitations of the standard.

3. Compliance gap analysis

Compare the standard requirements and evaluate whether the existing design meets the restriction clauses, especially checking the password mandatory setting, parental control and other functions.

4. Self declaration or third-party agency intervention evaluation

Collaborating with third-party organizations is not only a compliance requirement (if using alternative solutions outside of standards), but also a key factor in ensuring compliance.

The EN 18031 series standards provide a clear path for RED compliance, simplifying the compliance process, but their restrictive clauses also emphasize market access requirements. It is clear that if the device is subject to restrictive clauses, the participation of a third-party organization (notified body) is still required to issue an EU Type Examination certification certificate.

The urgent task is for manufacturers to prioritize the investigation of high-risk areas such as password strategies, child device permissions, and financial function protection. At the same time, they should collaborate with third-party organizations to conduct assessments to avoid delays in product market access due to misinterpretation of standards.

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor