The evidence for the RED directive

Annex V lists what the technical documentation shall contain, “wherever applicable”, at least. Among its points, those that call for evidence:

The text does not define the form of evidence. What follows is what makes evidence easy to find and reread, years later:

• It names a version. That of the product and of the firmware it concerns: a test report on version 2.0 says nothing about 2.1.
• It is dated, and says who produced it. Your team, a laboratory, a radio module supplier.
• It can be found again. A title, a reference, a version, and where the document is kept in your technical documentation.
• A requirement set aside comes with its reason. “Ne s'applique pas” (does not apply) with no justification does not say why.

In euvex, evidence is a text you write, requirement by requirement: the reference of the document and what it establishes. Nothing is uploaded as a file, and euvex does not judge what you cite. The report, for its part, says what is missing:

The themes and their titles are euvex's own, worded by euvex. They are not clauses of EN 18031, and none corresponds to one term for term in this guide. The questionnaire currently has six questions on point (d), one question on point (e). Point (f), fraud, has no question yet: if your product falls under it, its evidence is kept in your documentation, outside euvex.

Secure updateArt. 3(3)(d)

Does the device check the integrity and authenticity of its software updates before applying them?

What you can cite: Firmware signatures, chain of trust, documented rollback procedure.

Access controlArt. 3(3)(d)

Is access to sensitive functions and data restricted to authorised entities?

What you can cite: Rights matrix, separation of roles, deny by default.

AuthenticationArt. 3(3)(d)

Are users and services authenticated before accessing protected resources?

What you can cite: No shared default password, strength policy, attempt limiting.

Secure storageArt. 3(3)(d)

Is sensitive data (secrets, keys, personal data) stored in a protected way?

What you can cite: Encryption at rest, hardware key storage, controlled access to storage.

Secure communicationArt. 3(3)(d)

Are the device's communications protected in confidentiality and integrity?

What you can cite: Up-to-date TLS, strong cipher suites, certificate validation.

Resistance to denial of serviceArt. 3(3)(d)

Does the device withstand denial-of-service attempts and return to a safe state?

What you can cite: Rate limiting, controlled degradation, safe restart.

User notificationArt. 3(3)(e)

Is the user informed of changes affecting the protection of their privacy?

What you can cite: Notification of configuration changes, consent, transparency.

What it keeps. Your answers, linked to the product and its version, and a printable report that sets them out with their status. The RED section feeds the product's EU declaration of conformity.

What it brings itself. If a software scan is linked to the product, its SBOM lists the software's components and their versions, and its verdict on known vulnerabilities is carried over as is into the RED report. It is a measurement, not a declaration. It does not replace the description of versions Annex V expects; it can support it.

The scope of RED and its requirements, read from the text · A complete file, on a fictional productFR (in French)

With harmonised standards. When the manufacturer has applied harmonised standards whose references have been published in the Official Journal, it chooses between three procedures: internal production control (Annex II), EU-type examination followed by conformity to type (Annex III), or full quality assurance (Annex IV). Art. 17(3).

Without them, or in part. When it has not applied them, or only in part, or none exist, only the last two remain, in which a notified body examines the design or assesses the quality system. Art. 17(4).

The three EN 18031 standards were published in the Official Journal with restrictions, which remove the presumption of conformity in certain cases: which ones. What one of them changes for your product's procedure is a question for your notified body or adviser: this guide does not settle it, nor does euvex.

• Directive 2014/53/EU of 16 April 2014. Article 10(4); Article 17(3) and (4); Annexes III, IV and V.
• Implementing Decision (EU) 2025/138 and its restrictions, Delegated Regulation (EU) 2022/30 and its scope: the sources of the RED page.
• The questionnaire: seven questions, read in euvex's code on the day of the review.