Services: Electrical testing and certification, environmental or chemical testing

language
- English
- 中文

400-9269-886

NEWS CENTER

Industry News

Company News

Knowledge

Implemented on August 1, 2025, products that do not comply with the RED Directive Network Information Security EN 18031 standard will not be able to enter the EU market

Time：

2025-05-26

Implemented on August 1, 2025, radio products that do not comply with the RED Directive Network Information Security EN 18031 standard will not be able to enter the EU market.

The European Commission issued the RED Directive Supplementary Authorization Act (EU) 2022/30 in 2022, which sets clear requirements for network security, privacy protection, and anti fraud of wireless equipment. The bill will officially come into effect on August 1, 2025, at which time radio equipment must comply with the network information security requirements of Article 3 (3) (d), (e), and (f) of the RED Directive in order to enter the EU market for sale.

Standard Interpretation

01. Standard coordination

The EN 18031 series standards are divided into three parts, namely EN 18031-1, EN 18031-2, and EN 18031-3, which correspond to the requirements of Article 3 (3) of the RED Directive (d), (e), and (f), respectively. Some chapters of the EN 18031 series standards are not considered coordinated in some cases, and in the absence of coordination, products must be certified by a designated notified body (NB) before they can be put on the market.

RED Directive related clauses	Coordinate standards	Restrictive conditions
Article 3: Section 3.3 (d): Radio equipment will not harm the network or its functions, nor will it abuse network resources, resulting in unacceptable service degradation.	EN 18031-1:2024 Common security requirements for radio equipment - Part 1: Internet connected radio equipment	Require users to set and use passwords. If users are allowed not to set passwords, the EN 18031-1/2/3 standards will lose coordination.
Article 3: Section 3.3 (e): Radio equipment includes protective measures to ensure that the personal data and privacy of users and subscribers are protected.	EN 18031-2:2024 Common security requirements for radio equipment - Part 2: radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment	It is required to ensure access control for parents or guardians. If incompatible modes such as "autonomous access control" are used, the EN 18031-2 standard will lose coordination.
Article 3: Section 3.3 (f): Radio equipment supports certain functions to ensure fraud prevention.	EN 18031-3:2024Common security requirements for radio equipment - Part 3: Internet connected radio equipment processing virtual money or monetary value	Require security updates to be implemented through multiple mechanisms. If a single method (such as digital signature or access control) is used to implement security updates, it will not be sufficient to meet financial security requirements, and the EN 18031-3 standard will lose coordination.

02. Scope of application

According to the requirements of the RED Directive Supplementary Authorization Act (EU) 2022/30, the new regulations apply to the following three categories of products:

1. Wireless equipment directly or indirectly connected to the Internet;

2. Devices involved in processing user privacy data, such as child care devices, toys, wearable devices, etc;

3. Internet currency payment, transfer and transaction equipment.

Be careful:

① The requirements of Section 3.3 (d), (e), and (f) of the RED Directive do not apply to medical devices and equipment within the scope of MDR regulations.

② The requirements of Section 3.3 (e) and (f) of the RED Directive do not apply to aviation or road traffic related equipment within the scope of Regulation (EU) 2018/1139, Regulation (EU) 2019/2144, and Directive (EU) 2019/520.

03. Testing requirements

In order to ensure consistency in testing requirements among the three parallel standards (EN 18031-1/2/3), the new standard introduces the concept of "assets" as the main testing object and classifies "assets" according to different standard testing requirements.

Standard	EN 18031-1	EN 18031-2	EN 18031-3
RED Directive related clauses	3.3.(d)	3.3.(e)	3.3.(f)
Security asset	√	√	√
Network asset	√	_	_
Privacy asset	_	√	_
Financial asset	_	_	√

The test contents of the EN 18031 series standards are shown in the table below, requiring "Conceptual assessment", "Functional completeness assessment", and "Functional sufficiency assessment" to be conducted on these test contents.

Standard	General requirements	Special requirements
EN 18031-1	Access Control Authentication Secure Update Secure Storage Secure Communication Confidential Cryptographic Keys General Equipment Capabilities Password Best Practices- Cryptographic Best Practice	For security and network assets: Resilience Network Monitoring Traffic Control
EN 18031-2		For security and privacy assets: Parental Control Logging Deletion User Notification External Sensing Capabilities
EN 18031-3		For safety and financial assets: Logging Equipment Integrity (Secure Boot)