Until now, the Radio Equipment Directive mainly regulated safety aspects and electromagnetic compatibility of radio equipment. In EU legislation, however, the focus is increasingly shifting towards the topic of cybersecurity. The new EN 18031 series of standards, consisting of EN 18031-1, EN 18031-2 and EN 18031-3, has been officially recognized as a harmonized standard for the Radio Equipment Directive since the end of January 2025 and specifies the requirements of the Radio Equipment Directive with regard to cybersecurity.
However, there are significant restrictions on the presumption of conformity. This does not apply to the following products or circumstances, which means that the involvement of a notified body to issue an EU-type examination certification is mandatory:
- devices that offer the option of not setting or using a password
- children's toys where it is not ensured that only parents or legal guardians exercise access control
- Secure updates do not automatically lead to a presumption of conformity according to Article 3(3)(f) of the Radio Equipment Directive
- The “Rationale” and “Guidance” sections are only supportive and do not establish a presumption of conformity
Manufacturers of internet-enabled radio equipment are thus facing major challenges. From August 1, 2025, affected devices are legally bound to meet these requirements. Manufacturers must carefully check whether their products fully meet the requirements or whether an additional assessment by a notified body is required.
