RED cybersecurity and EN 18031 — scope and assessment overview

For devices first placed under the 2022/30 regime, identify which Article 3(3)(d), (e) or (f) requirement is activated and whether an exclusion applies. Regulation 2026/339 repeals 2022/30 from 11 December 2027; it does not repeal RED or erase the obligations attached to products placed earlier.

Essential requirements and exclusions

Article 3(1)(a) covers health/safety objectives of LVD without its voltage limits; 3(1)(b) covers EMC; 3(2) covers spectrum. RED Article 1(4) excludes standalone LVD application and EMC Article 2 excludes RED radio equipment. Other applicable acts such as RoHS remain separately assessed. Delegated Regulation 2022/30 activates selected 3(3)(d)-(f) requirements from 1 August 2025 after 2023/2444; its Article 2(1) excludes MDR/IVDR devices from those three cybersecurity requirements, not from all RED duties. Regulation 2026/339 repeals 2022/30 from 11 December 2027; RED itself continues.

Conformity assessment

For Article 3(1) requirements, Article 17(2) permits A, B+C or H. For Article 3(2)/(3), Article 17(3) permits A, B+C or H where applicable OJ-listed harmonised standards are fully applied; absent/partially applied standards, Article 17(4) requires B+C or H. Check exact editions, scope and OJ restrictions. EN 18031 citations under 2025/138 carry limitations; neither EN 18031 nor ETSI EN 303 645 automatically gives CRA presumption of conformity.

Evidence to keep with the product

Record the intended purpose, responsible economic operator, target market, first placing date and exact hardware/firmware configuration. For each applicable requirement, link the actual test or assessment record, dated standard/specification, scope and reviewer decision. Proposed controls and supplier marketing statements are not evidence that the final configuration has passed an assessment.

Separate an open question from a completed assessment. A report outside the laboratory's relevant scope, a different firmware build or an unverified exemption needs a reasoned decision before it supports a declaration. Keep original evidence and the issued declaration alongside any AI-assisted working draft.

Using Cenitia for this work

Cenitia assists with a limited regulatory catalogue and draft documents. The manufacturer must confirm applicability, actual applied specifications and completed assessment procedures. AI scores are quality signals, not a probability of conformity. Source monitoring raises a review prompt when validated source text changes; it does not automatically verify amendments, update the corpus or monitor every national rule and OJ standard edition. Public QR verification records issuance, not product certification.

Review status

This guide was substantively corrected by Cenitia on 2 October 2026 using the primary references below. It is an editorial summary, not an authoritative legal quotation or an independently signed expert opinion. Product-specific and licensed-standard questions remain subject to a real technical review.

Primary references

• Primary source 1
• Primary source 2