EN 18031-1 vs -2 vs -3: which parts apply to your radio product

The three 2024 parts were approved by CEN on 1 August 2024 and prepared by CEN/CENELEC JTC 13, Cybersecurity and Data Protection. Their references were published on 30 January 2025 through Implementing Decision (EU) 2025/138, which added restricted entries to the RED harmonised-standards list in Decision (EU) 2022/2191.

This comparison was checked against the full texts of the three standards and the official legal acts on 6 October 2026. The Commission's RED standards page and its September 2026 amendment, Decision (EU) 2026/2003, leave the EN 18031 entries and their restrictions unchanged.

Current legal position and the 2027 transition

Delegated Regulation (EU) 2022/30, as amended, activates RED Article 3(3)(d), (e) and (f) for defined categories of radio equipment from 1 August 2025. It remains applicable on the review date.

Delegated Regulation (EU) 2026/339 has already enacted its repeal with effect from 11 December 2027, when the Cyber Resilience Act's main requirements apply. This is an adopted legal change. The repeal does not remove RED market surveillance of in-scope equipment placed on the EU market between 1 August 2025 and 10 December 2027 for the cybersecurity requirements that applied to it. It also does not repeal the rest of RED.

For CRA-covered products, plan the separate requirements under Regulation (EU) 2024/2847. Its Article 14 reporting obligations have applied since 11 September 2026, subject to its scope and transitional provisions. An EN 18031 assessment is useful evidence, but the RED listing does not itself confer CRA presumption of conformity: that is governed by CRA Article 27. Compare the actual technical requirements and lifecycle duties, including Annex I Part II vulnerability handling, before reusing evidence.

Determine the applicable RED requirements

Read Articles 1 and 2 of 2022/30 together. The following steps summarise their scope; the product's actual capabilities and applicable sectoral legislation determine the result.

1. Check the derogations. Equipment to which MDR (EU) 2017/745 or IVDR (EU) 2017/746 also applies is exempt from the (d), (e) and (f) activations under Article 2(1). Article 2(2) excludes (e) and (f) for equipment also subject to aviation Regulation (EU) 2018/1139, vehicle Regulation (EU) 2019/2144 or electronic road-toll Directive (EU) 2019/520. Those exclusions do not, by themselves, exclude (d).
2. Assess (d): internet capability. Radio equipment that can itself communicate over the internet, directly or through another device, triggers network protection. A companion phone or gateway can therefore matter. A Bluetooth or NFC interface alone does not establish the scope decision.
3. Assess (e): category plus data capability. Internet-connected equipment, equipment designed or intended exclusively for childcare, radio toys covered by Directive 2009/48/EC, and equipment intended to be worn on the body or clothing trigger privacy protection if capable of processing personal data, traffic data or location data. Any one of those data categories can be sufficient; internet connectivity is not required for the childcare, toy or wearable categories.
4. Assess (f): internet capability plus transfers. Internet-connected equipment that enables its holder or user to transfer money, monetary value or virtual currency triggers fraud protection. Record the actual transfer function; the presence of NFC or the marketing label “wallet” is insufficient by itself.

The essential requirements can accumulate. If the manufacturer uses EN 18031 as its technical route, Part 1 corresponds to (d), Part 2 to (e), and Part 3 to (f). The Commission explains that harmonised standards are voluntary; RED Article 17 determines the assessment procedure when they are not applied or are applied only in part.

Product examples with explicit assumptions

The table assumes equipment falls within RED and no Article 2 derogation applies, except in the final row. “Parts” identifies the corresponding standards if the EN 18031 route is chosen.

A medical device's exclusion from these cybersecurity activations does not mean it is exempt from all of RED. CRA Article 2(2) also expressly excludes products to which MDR or IVDR applies; assess the actual regulated product and any separately supplied components against their own scope.

Part 1: network protection

EN 18031-1 addresses internet-connected radio equipment and supports Article 3(3)(d). Clause 6 contains eleven main mechanism families. The distinguishing families are resilience (RLM), network monitoring (NMM) and traffic control (TCM).

Do not require a router's monitoring and traffic-control functions on every connected endpoint merely because it is within Part 1. Clauses 6.7.1 and 6.8.1 condition NMM and TCM on the equipment being “network equipment”, a defined term in clause 3.24. RLM also has specified exceptions. Document the clause-level applicability result and its evidence.

Part 2: personal data and privacy

EN 18031-2 supports Article 3(3)(e) for the categories and data capabilities described above. It also contains eleven main mechanism families, with logging (LGM), deletion (DLM) and user notification (UNM) replacing Part 1's three network families.

Deletion addresses the user's personal data and sensitive security parameters stored on the equipment. User notification addresses changes affecting the protection or privacy of personal information, with the exception in UNM-1 for other ways of informing the user that do not involve the equipment. It is not a general requirement to notify the user of every processing operation. GEC-7, clause 6.10.7, concerns documenting privacy-related external sensing capabilities for the user.

Child-related access control is conditional

Part 2 expands ACM from two to six numbered requirements. The four additional clauses have different triggers:

It is incorrect to treat all four as automatically applicable to every childcare device. A wearable can also be a toy or childcare device; evaluate overlapping categories. The OJEU parental/guardian restriction must then be checked for the relevant clauses, as explained below.

Part 3: fraud protection

EN 18031-3 supports Article 3(3)(f) for internet-connected radio equipment enabling monetary or virtual-currency transfers. It contains nine main mechanism families. Its logging requirements address financial assets, while Part 2's logging addresses privacy assets.

The additional GEC-8 requirement in clause 6.8.8 concerns cryptographic verification of software integrity and authenticity during boot for equipment processing financial data, using the specified root of trust. Clause 6.8.7, GEC-7, is intentionally blank. Numbering from GEC-1 through GEC-8 therefore does not mean eight substantive GEC requirements.

Boot integrity and firmware tampering also matter to other connected products. Part 3's financial-asset requirement does not make those threats irrelevant to cameras or bulbs. Secure-update assessment criteria in Part 3 have a separate OJEU restriction that manufacturers must address.

Mechanism-family comparison and clause references

The entries give clause locations in the 2024 editions. They describe the standards' structure, not the number of controls applicable to a particular product.

The shared labels are ACM, AUM, SUM, SSM, SCM, CCK, GEC and CRY. Their requirements and assessments must still be read in each selected part. For example, ACM-1 protects security and network assets in Part 1, security and privacy assets in Part 2, and security and financial assets in Part 3. A common implementation can support multiple assessments, but matching labels alone do not prove equivalent coverage.

Informative mappings in all three parts

Each part includes the following informative annexes:

• Annex A: rationale for the standard's terms and concepts.
• Annex B: mapping to EN IEC 62443-4-2:2019.
• Annex C: mapping to ETSI EN 303 645.
• Annex D: mapping to the Security Evaluation Standard for IoT Platforms (SESIP).
• Annex ZA: relationship with the relevant RED essential requirement and Delegated Regulation 2022/30.

The SESIP mapping exists in Parts 1, 2 and 3. Use the mappings to identify candidate evidence, then verify the product, evaluated platform, scope, configuration and requirements covered. A SESIP evaluation or assessment against another framework does not automatically establish EN 18031 conformity or remove an OJEU restriction.

OJEU restrictions and the notified body route

The operative notices in the Annex to Decision (EU) 2025/138 define the restrictions. The recitals explain the reasons but do not replace those notices.

Reading a rationale section to understand a requirement does not itself force notified body involvement. Likewise, a passwordless design is not automatically unlawful; the listing determines when the EN 18031 route fails to confer presumption, and the manufacturer must demonstrate legal compliance through the appropriate procedure.

Under RED Articles 16 and 17, presumption covers the essential requirements actually covered by the cited standards or their parts. Where the manufacturer has not applied, or has only partly applied, the relevant harmonised standards, or none exist, Article 17(4) requires assessment of those essential requirements through Annex III, EU-type examination followed by conformity to type (Module B+C), or Annex IV, full quality assurance (Module H). Both involve a notified body.

For an applicable requirement left outside the presumption because of an OJEU restriction, additional technical evidence is necessary; a manufacturer's own extra test does not by itself restore the Annex II route. Identify the affected requirement and agree the assessment scope with a notified body designated for the relevant RED requirements. Do not assume that simply combining the Part 3 secure-update implementation categories removes Notice 3.

Record the scope and evidence in the technical file

A defensible assessment records:

• The product's internet communication capabilities, including companion-device paths, intended use, data-processing capabilities, payment functions and applicable derogations.
• The (d), (e) and (f) scope conclusions and their legal basis, including justified negative conclusions.
• The selected standard editions, each clause's applicability result, asset inventory, implementation and assessment evidence.
• Each OJEU restriction, its impact on presumption and the selected RED conformity-assessment procedure.
• Any separate CRA scope and requirements analysis, with evidence gaps, vulnerability-handling processes and relevant transition dates.

National standards bodies can clarify standard content and notified bodies can assess conformity within their designation. Their guidance does not amount to a generally binding interpretation of EU legislation. Product-specific conclusions must remain supported by the applicable legal text and assessment evidence.

For the broader RED process see the RED delegated act and EN 18031 walkthrough, the RED Annex IV path, and RED and CRA overlap.

Using Cenitia for this work

Cenitia helps prepare evidence-linked working drafts within its supported regulatory catalogue. Confirm the product scope, actual applied standards and completed assessments, and review the result before issuance. Source-change alerts prompt a review; they do not certify conformity, automatically reissue a signed declaration or guarantee monitoring of every national rule and standard edition.

Related from the Library

• RED delegated act and EN 18031 walkthrough
• RED Annex IV path for radio equipment
• RED and CRA overlap for connected radio products
• Conformity assessment modules A to H
• When you need a notified body

Primary sources checked

• RED 2014/53/EU, consolidated text: Articles 3, 16 and 17.
• Delegated Regulation 2022/30, consolidated text: Articles 1–3.
• Implementing Decision 2025/138: EN 18031 references and operative restrictions.
• Implementing Decision 2022/2191, consolidated to 11 December 2025: entries 164–166, read with Decision 2026/2003 and the Commission's current RED standards index.
• Delegated Regulation 2026/339: repeal from 11 December 2027 and recital 5 on earlier equipment.
• CRA 2024/2847: Articles 2, 27, 69 and 71, and Annex I.
• EN 18031-1:2024, full text made available by NEK (PDF): clauses 1, 3 and 6; annexes A–D and ZA.
• EN 18031-2:2024, full text made available by NEK (PDF): clauses 1, 6.1.3–6.1.6, 6.7, 6.8 and 6.10; annexes A–D and ZA.
• EN 18031-3:2024, full text made available by NEK (PDF): clauses 1, 6.3.2.4, 6.8.7 and 6.8.8; annexes A–D and ZA.