From RED to the Future: How EN 18031 Shapes Cybersecurity Requirements for Wireless Products

The ETSI EN 18031 series translates RED cybersecurity requirements into technical requirements that engineering, security, and compliance teams can use during product development. Its three parts address network protection, personal data and privacy, and fraud prevention. For a broader explanation of RED scope, conformity assessment, documentation, and CE marking, read The Radio Equipment Directive Explained: A Guide to Conformity Assessment.

Establishing a Product Security Baseline with RED Article 3.3

At its core, RED applies to radio equipment placed on the EU market. The RED-DA introduces critical cybersecurity requirements through Articles 3.3(d) (Network Protection), 3.3(e) (Data & Privacy), and 3.3(f) (Fraud Prevention). These obligations apply to the categories of radio equipment covered by the RED cybersecurity provisions.

As explained in our article on Adapting to Articles 3.3(d), (e), and (f), aligning with these pillars early transforms the certification journey into a smoother, more predictable process. By leveraging RED cybersecurity assessments as a baseline, you meet your legal obligations under EU law and establish a robust product security baseline.

RED Article 3.3 introduces critical cybersecurity requirements that apply to all radio-enabled products in the EU, from consumer gadgets to industrial systems. Source: Freepik

For the detailed scope and application of Article 3.3, read What Article 3.3 Means for Connected Device Manufacturers.

The ETSI EN 18031 Series: Translating Law into Action

Legal clauses define what needs to be achieved, but they do not always explain how to demonstrate it. The ETSI EN 18031 series fills that gap by translating RED’s cybersecurity clauses into clear, measurable requirements. Manufacturers should verify the current Official Journal reference, product scope, and any restrictions before relying on a standard for presumption of conformity.

The standard is divided into three parts that mirror RED's core obligations:

• EN 18031-1: Network protection 

• EN 18031-2: Personal data security 

• EN 18031-3: Fraud prevention 

By providing specific criteria for implementation and verification, EN 18031 creates a common language for engineers, compliance teams, and Notified Bodies.

For product-specific detail, see EN 18031-1 Requirements for Internet-Connected Radio Equipment and EN 18031-3 and Fraud Protection.

The ETSI EN 18031 series translates RED’s legal clauses into testable harmonised standards for network protection, data security, and fraud prevention. Source: Freepik

Building a Secure Product Development Lifecycle

Treating RED cybersecurity implementation as a "post-test" instead of engineering it into the design from day one is a common pitfall. To avoid costly redesigns and months of delay, manufacturers must embed a secure-by-design mindset directly into their secure product development lifecycle.

As highlighted in our piece on Navigating RED Compliance Strategies, integrating EN 18031 into the development cycle dramatically reduces the likelihood of late-stage certification issues. This involves establishing clear policies for vulnerability management, such as patch frequency, secure signing, and rollback capabilities. It also means that engineering, quality assurance, compliance, and product management teams can work from the same baseline of requirements and evidence expectations.

The goal is to link EN 18031 requirements to product decisions, test coverage, technical documentation, and release evidence before the product reaches final assessment.

IoT Device Compliance and the Broader EU Cybersecurity Regulation

The work you put into RED compliance is not a sunk cost; it is the technical foundation for upcoming EU cybersecurity regulation, including the Cyber Resilience Act (CRA). RED evidence may support future CRA preparation, but RED and CRA remain separate frameworks and EN 18031 should not be treated as a confirmed CRA harmonized standard.

As noted in Why RED is the Blueprint for CRA Success, manufacturers will be responsible for patching vulnerabilities for years after the sale. By integrating EN 18031 controls into product design today, teams anticipate threats, streamline documentation, and build resilient solutions ready for global deployment. Furthermore, as explored in Navigating the RED and AI Act Overlap, if your radio device uses AI for mandatory security functions, it may soon face even stricter scrutiny under the AI Act.

For broader CRA requirements, see QIMA’s Cyber Resilience Act compliance services.

Summary

Achieving RED compliance for your wireless devices is more than a regulatory hurdle; it is a strategic advantage. By aligning with RED Article 3.3 and utilizing the ETSI EN 18031 series, manufacturers can confidently navigate conformity assessments.

How QIMA CCLab Can Help You Achieve Your Goals

QIMA CCLab supports manufacturers with RED cybersecurity scoping, EN 18031-related evaluation, technical documentation, and conformity-assessment preparation.

• Requirement and scope analysis: Help determine which RED cybersecurity requirements and EN 18031 parts may apply.

• Documentation preparation and review: Align security evidence with RED technical-file expectations.

• Cybersecurity testing: Support testing and evaluation relevant to the product and assessment route.

The formal conformity decision remains with the responsible notified body or certification organization.

Explore RED cybersecurity compliance services.

FAQ

What is the Radio Equipment Directive (RED)? 

The Radio Equipment Directive (RED) is a regulatory framework ensuring that radio equipment placed on the EU market is safe and compliant. Along with health and safety standards, its recent Delegated Act strictly enforces cybersecurity protections, safeguarding networks, personal data, and protecting against fraud.

What types of products are covered under the RED? 

The RED covers a vast array of products utilizing the radio frequency spectrum. This includes wireless devices (smartphones, laptops, smartwatches), internet-connected radio equipment, short-range devices like Wi-Fi and Bluetooth equipment, and even telecommunications terminal equipment.

How do manufacturers prove compliance with RED? 

Manufacturers must create and maintain technical documentation demonstrating conformity with RED's essential requirements. While certain devices allow for self-declaration (if fully utilizing harmonised standards), products with higher risks or specific characteristics legally require the mandatory involvement of a Notified Body.