Skip to main content
euvex
Console

The cybersecurity of radio equipment

Applicable from 1 August 2025. It is the oldest of the cybersecurity obligations euvex covers, and the CRA takes over from it on 11 December 2027. What it asks, of whom, and what a harmonised standard really covers.

Who is concerned

Art. 1 and 2

Directive 2014/53/EU, known as RED, sets the essential requirements for radio equipment. Its Article 3(3) provides for three cybersecurity requirements, which the Commission makes applicable by category of equipment. Delegated Regulation 2022/30 is that act.

Point (d).

Any radio equipment that can communicate itself over the internet, directly or via other equipment.

Point (e).

Equipment that processes personal data, traffic data or location data: internet-connected equipment, equipment for childcare, toys with a radio (Directive 2009/48/EC) and equipment worn on the body.

Point (f).

Internet-connected equipment that allows the transfer of money, monetary value or virtual currency.

Exclusions.

Article 2 removes from scope medical devices (Regulations 2017/745 and 2017/746) for all three points, and, for points (e) and (f), equipment under civil aviation (Regulation 2018/1139), vehicle type-approval (Regulation 2019/2144) and electronic road tolling (Directive 2019/520). Their own legislation already deals with these risks.

In practice, a Wi-Fi, Bluetooth or cellular device that talks to the internet falls at least under point (d). If it collects personal data, under point (e) as well.

What is required

Directive 2014/53/EU, Art. 3(3)

Three essential requirements, worded as outcomes, not means. It is the harmonised standard that turns them into verifiable criteria.

(d) The network.

The equipment “does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service”.

(e) Privacy.

The equipment “incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected”.

(f) Fraud.

The equipment “supports certain features ensuring protection from fraud”.

Why this is not an SBOM

These requirements concern the device's behaviour: authentication, secure updates, network traffic, data storage. A list of dependencies measures only a fragment of them, the known vulnerabilities. The rest is declared and proven by testing.

The EN 18031 standards, and their restrictions

Implementing Decision (EU) 2025/138

Applying a harmonised standard published in the Official Journal gives a presumption of conformity with the requirements it covers. The three EN 18031:2024 standards were published on 30 January 2025, but with restrictions.

EN 18031-1.

Point (d), the network.

EN 18031-2.

Point (e), privacy.

EN 18031-3.

Point (f), fraud.

What the presumption does not cover

  • The “rationale” and “guidance” sections. They set out no specifications, according to the decision itself.
  • Optional passwords. Clauses 6.2.5.1 and 6.2.5.2 of all three standards allow a user not to set or use any password. Equipment that implements this option is not presumed to conform.
  • Parental control, EN 18031-2. For toys and childcare equipment, clauses 6.1.3 to 6.1.6 accept access control categories that may not be compatible with parental or guardian control. Without that control, no presumption.
  • Secure updates, EN 18031-3. Clause 6.3.2.4 accepts four methods, none of which is sufficient alone for financial assets.

What each of these restrictions changes for your product's assessment procedure depends on the directive and on your design choices. This page does not decide that point, and neither does euvex.

The switch to the CRA

Applicable from 11.12.2027

The Cyber Resilience Act takes over the cybersecurity of products with digital elements, radio included. Delegated Regulation (EU) 2026/339 repeals 2022/30 with effect from 11 December 2027, the date from which the essential requirements of the CRA are applicable.

Same product.

The connected device that falls under point (d) until 11 December 2027 then falls under the CRA, as a product with digital elements. The manufacturer does not change product, it changes act.

Same file.

The RED technical documentation and the EU declaration of conformity do not disappear: the file is added to, not redone. The CRA notably adds the SBOM and vulnerability handling over the support period.

Before that.

Reporting of actively exploited vulnerabilities, Art. 14 of the CRA, is applicable from 11 September 2026. It also applies to radio equipment. The Art. 14 part.

What euvex does on RED

The product

The RED part.

A structured questionnaire of the requirements a manufacturer can actually declare, attached to a product and its version, and a printable report.

The linked scan.

The CVE verdict from the software scan attached to the product is carried over as is, with no double entry.

The declaration.

The RED part feeds the single EU declaration of conformity of the product, with the reference of each act. The file and the declaration, in plain terms.

What euvex does not do

euvex does not test your device and does not apply EN 18031 for you. It structures your declaration; it does not measure it. It signs nothing: the declaration remains issued under your sole responsibility.

Sources

Read in the Official Journal on 30.09.2026, English text on 01.11.2026

Declare a radio product

The RED part is free during the beta. Create a product, attach its software scan, fill in the questionnaire. See a complete file, on a fictional product (in French).

Create an accountAll the parts