Three parts and restricted presumption
EN 18031 is a three-part 2024 series developed by CEN-CENELEC/JTC 13. Part 1 addresses network protection under RED Article 3(3)(d), Part 2 privacy and personal-data protection under (e), and Part 3 fraud protection under (f). Decision 2025/138 cites the series with restrictions, including specified password, parental-control and financial-asset assessment cases. The presumption of conformity is limited accordingly: check the exact OJ notice and product assessment rather than treating the citation as unconditional. The law’s requirements are mandatory for equipment in scope; purchasing or applying every part of EN 18031 is not universally mandatory. This overview uses public legal notices and does not reproduce or assert unverified clauses from the paid standard text.
Assess the three cybersecurity scopes separately
Under 2022/30, Article 3(3)(d) concerns internet-connected radio equipment. Paragraph (e) concerns internet-connected equipment, childcare equipment, toys and wearables capable of processing the specified personal, traffic or location data. Paragraph (f) concerns internet-connected radio equipment enabling transfers of money, monetary value or virtual currency. Article 2 provides exclusions; assess each subparagraph separately.
Adoption, publication and application
Delegated Regulation 2022/30 was adopted on 29 October 2021, published on 12 January 2022 and entered into force on 1 February 2022. Its requirements have applied since 1 August 2025, following the date amendment in 2023/2444. Regulation 2026/339 repeals 2022/30 from 11 December 2027; this is not a repeal of the whole Radio Equipment Directive.
Standards and their limits
Harmonised standards are generally voluntary. Applying an OJ-cited standard can provide a presumption of conformity only for the requirements it covers and subject to published restrictions. Under RED Article 17, missing or partly applied relevant standards for Article 3(2)/(3) require B+C or H for those requirements. Standards, accredited test laboratories and notified bodies have different roles.
Practical checklist
- Identify the product, intended use, market and applicable legal scope.
- Record the exact legal provisions, dates and applicable standard editions, including restrictions.
- Select the permitted assessment route and document the evidence needed.
- Link risk assessment, tests, product versions and declarations in the technical documentation.
- Assign responsibility for changes, support and responses to authorities.
This checklist supports planning; the applicable legal requirements determine the final assessment.