As part of its broader safety and spectrum requirements, RED has been extended to include explicit cybersecurity obligations for internet-connected radio devices. These provisions were introduced under Delegated Regulation (EU) 2022/30, effective 1 August 2024.
Legal basis The amended Articles 3(3)(d), (e), (f) require that: • (d) radio equipment must not harm networks or misuse network resources; • (e) devices, especially internet-connected devices, wearables and toys, must protect personal data and privacy; • (f) radio equipment used for monetary transactions must include anti-fraud safeguards.
Harmonised standard EN 18031 The EN 18031 series was published in the Official Journal of the European Union on 30 January 2025, and will be applicable as of 1 August 2025. It comprises: • EN 18031-1: network protection (Article 3(3)(d)); • EN 18031-2: personal data and privacy protection (Article 3(3)(e)); • EN 18031-3: fraud protection (Article 3(3)(f)). According to guidance from various notified bodies, the application of the harmonised standard grants presumption of conformity. However, certain restrictions apply regarding password enforcement, parental controls, and update mechanisms; if unmet, an assessment by a
notified body is required.
Timeline == Reception ==