Explore Cenitia’s compliance workflow and availability.Cenitia compliance workflow

How it works →
Cenitia
How it worksLibraryGlossaryRegulationsToolsAbout
Reserve your spot
How it worksLibraryGlossaryRegulationsToolsAbout

On this page

  • Conformity assessment
  • Essential requirements and exclusions
  • Evidence to keep with the product
  • Using Cenitia for this work
  • Review status
  • Primary references
← Library
reference·RED·3 min read

EN 18031 — OJ citation, restrictions and assessment checks

An overview of RED cybersecurity scope, EN 18031 citation and restriction checks, assessment routes and the 2027 delegated-act transition.

By Cenitia · 17 August 2026 · Updated 5 October 2026

Check the exact OJ citation under Decision 2025/138 and its restrictions before relying on EN 18031. Password-related clauses and relevant parental-control conditions can limit the presumption. Access to a standard’s title is not an assessment of all its licensed clauses. An EN 18031 citation under RED does not automatically establish CRA presumption.

Conformity assessment

For Article 3(1) requirements, Article 17(2) permits A, B+C or H. For Article 3(2)/(3), Article 17(3) permits A, B+C or H where applicable OJ-listed harmonised standards are fully applied; absent/partially applied standards, Article 17(4) requires B+C or H. Check exact editions, scope and OJ restrictions. EN 18031 citations under 2025/138 carry limitations; neither EN 18031 nor ETSI EN 303 645 automatically gives CRA presumption of conformity.

Essential requirements and exclusions

Article 3(1)(a) covers health/safety objectives of LVD without its voltage limits; 3(1)(b) covers EMC; 3(2) covers spectrum. RED Article 1(4) excludes standalone LVD application and EMC Article 2 excludes RED radio equipment. Other applicable acts such as RoHS remain separately assessed. Delegated Regulation 2022/30 activates selected 3(3)(d)-(f) requirements from 1 August 2025 after 2023/2444; its Article 2(1) excludes MDR/IVDR devices from those three cybersecurity requirements, not from all RED duties. Regulation 2026/339 repeals 2022/30 from 11 December 2027; RED itself continues.

Evidence to keep with the product

Record the intended purpose, responsible economic operator, target market, first placing date and exact hardware/firmware configuration. For each applicable requirement, link the actual test or assessment record, dated standard/specification, scope and reviewer decision. Proposed controls and supplier marketing statements are not evidence that the final configuration has passed an assessment.

Separate an open question from a completed assessment. A report outside the laboratory's relevant scope, a different firmware build or an unverified exemption needs a reasoned decision before it supports a declaration. Keep original evidence and the issued declaration alongside any AI-assisted working draft.

Using Cenitia for this work

Cenitia assists with a limited regulatory catalogue and draft documents. The manufacturer must confirm applicability, actual applied specifications and completed assessment procedures. AI scores are quality signals, not a probability of conformity. Source monitoring raises a review prompt when validated source text changes; it does not automatically verify amendments, update the corpus or monitor every national rule and OJ standard edition. Public QR verification records issuance, not product certification.

Review status

This guide was substantively corrected by Cenitia on 2 October 2026 using the primary references below. It is an editorial summary, not an authoritative legal quotation or an independently signed expert opinion. Product-specific and licensed-standard questions remain subject to a real technical review.

Primary references

  • Primary source 1
  • Primary source 2

FAQ

Frequently asked questions

  • Does an AI draft or QR verification prove conformity?+

    No. The manufacturer must establish scope and satisfy applicable requirements using actual evidence. QR verification records issuance, not product certification.

  • What information must be checked for this product?+

    Confirm intended use, role, market/date, final configuration, dated specifications, assessment route and evidence scope. Record unresolved questions and a real reviewer decision.

Continue reading

Related guides

  • reference

    Official Journal monitoring for hardware compliance — a quarterly review workflow

    A practical workflow for tracking EU product legislation, OJ standards citations, restrictions and transition dates, with a review record for each affected product.

    4 min read

  • guide

    CRA readiness countdown — scope, reporting, assessment and release checkpoints

    Planning checkpoints before CRA main product obligations apply on 11 December 2027, with reporting already in force, class-specific routes and release evidence.

    5 min read

  • reference

    CRA harmonised standards — citation and assessment checks

    How to check the role of harmonised standards in CRA assessment: exact citation, requirement coverage, route conditions and evidence. This is not a live OJ ledger.

    3 min read

  • tutorial

    How to Verify CE Documents from an Electronics Supplier

    Check product identity, declarations, test reports and supplier gaps before accepting CE evidence for an electronics order.

    5 min read

Put this into practice

Free tools & references

  • CRA Readiness CheckerScore your product against the Cyber Resilience Act essential requirements.Open tool →
  • EU Directive SelectorDescribe your product and find which EU directives and regulations apply.Open tool →

New to the terminology? Browse the compliance glossary — plain-English, citation-backed definitions of every term above.

Explore Cenitia’s compliance workflow

Review the supported scope and workflow

← Back to Library

Cenitia

The EU compliance engine for hardware manufacturers. Cited drafts, electronic signing, regulation watching — all in one place.

A product of Inovasense s.r.o., Bratislava, Slovakia · Data hosted in Stockholm, EU

Site

  • How it works
  • Library
  • Glossary
  • Regulations
  • By product type
  • Tools
  • About

Legal

  • Imprint
  • Privacy
  • Terms

© 2026 Inovasense s.r.o. · cenitia.com

EU sovereign · EU data residency by design · Customer data never trains models