s a continuation of our article Preparing for the EU’s New RED Cybersecurity Requirements from the June issue of In Compliance Magazine, this article will concentrate on the EN 18031-X series that was harmonized and published in the Official Journal of the European Union in January 2025, after our previous article was written.
Since our previous article covered the Radio Equipment Directive (Directive 2014/53/EU, known as the RED), plus other acts and directives referring to cybersecurity and why cybersecurity rules are necessary, we will not repeat them in this article.
The EN 18031-X series of standards was developed to provide manufacturers of radio equipment with a harmonized framework to meet the European Union’s (EU’s) cybersecurity requirements that became mandatory on August 1, 2025.
Harmonized standards are a much easier way to go and are generally highly preferred. This series of standards combines the requirements for manufacturers and the requirements for testing laboratories into one standard, requiring less time to cross-reference documents when a better understanding of a requirement is needed.
The standard series is divided into three heavily overlapping standards, each of which has requirements consisting of an identifying code of three letters, a dash, and a number. For example, ACM-1 is the code for one of the requirements. EN 18031-1 has 31 requirements, EN 18031-2 has 40 requirements, and EN 18031-3 has 34 requirements.
Twenty-eight of the requirement codes are common to all three standards, making it appear that they are exactly the same. However, there are some differences in the text, and they do not necessarily all have the same section numbers, which can make the organization of the standards confusing. We will give examples of these differences later in this article.
To understand the organization of the standards better, it can help to know that they are divided into three parts to make it clear that they are covering 3(3)(d), 3(3)(e), and 3(3)(f) of the RED. More precisely:
- EN 18031–1 specifically addresses Article 3(3)(d), i.e., “radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service”;
- EN 18031–2 specifically addresses Article 3(3)(e), i.e., “radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected”;
- EN 18031–3 specifically addresses Article 3(3)(f), i.e., “radio equipment supports certain features ensuring protection from fraud”.
Early in the required risk assessment, manufacturers need to determine which essential requirements of RED, as well as requirements in other Directives, apply to their product. A good reference to the application of the risk assessment can be found in the EU “Blue Guide” on the implementation of EU product rules (2022/C 247/01):
While you may already be familiar with the safety portion of your risk assessment, you may be less familiar with the cybersecurity portion, which is a bit different. To read an explanation of cybersecurity risk assessment in the context of the RED (as well as the Cyber Security Act, and the Cyber Resilience Act), download the free Technical Report ETSI TR 103 935 at: https://www.etsi.org/deliver/etsi_tr/103900_103999/103935/01.01.01_60/tr_103935v010101p.pdf.
Since the EMC requirements have been active for much longer than the cybersecurity requirements, the guidance for the EMC portion of a risk assessment is more mature. Understanding risk assessment guidance in the context of something you already know can be potentially helpful. Guidance for the EMC portion of a risk assessment can be found in Technical Report ETSI TR 103 879. A free download can be obtained at: https://www.etsi.org/deliver/etsi_tr/103800_103899/103879/01.01.01_60/tr_103879v010101p.pdf.
After you begin your risk assessment by deciding which essential requirements of RED and other directives apply to your product, you will need to try to apply harmonized standards to your product. For RED 3(3)(d), 3(3)(e), and 3(3)(f), that will be the harmonized EN 18031-X standards.
Once it has been determined which EN 18031-X standard(s) apply to your product, each of the applicable standards provides details of its own part of the cybersecurity risk assessment for its associated RED essential requirement. Details can be found in each standard, starting with Section A.2.3, which is called “Threat modelling and security risk assessment.”
EN 18031-X uses “STRIDE,” which is a threat model to identify and enumerate specific types of possible threats to determine what important parts of your product need to be addressed. Additional details about STRIDE can be found at https://owasp.org/www-community/Threat_Modeling_Process#stride. Information on putting STRIDE into context can be found in Technical Report ETSI TR 103 935, section 8.4.2 (see previously provided link) in a section named “STRIDE.”
What follows is information that is currently available, in order of precedence:
- Directive 2014/53/EU 3(3)(d) basically states that the “goal” for EN 18031-1 is “radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service”.
- Delegated regulation 2022/30 Article 1(1) says “The essential requirement set out in Article 3(3), point (d), of Directive 2014/53/EU shall apply to any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment.”
- The EN 18031-X standards themselves introduce the phrasing “Internet connected radio equipment.”
Not all cases lead to a consensus. This is understandable given the complexity and how new the requirement is. As the industry gains experience with these issues, it would be reasonable to expect a convergence toward consensus. This means in your product’s risk analysis, you should probably add an “interpretation risk” for “internet connected” during the risk identification stage.
To understand the intention of Part 2, several terms need to be defined:
- “Personal data” is defined as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;” 1
- “Traffic data” is defined as:
“any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof” 2
- “Location data” is defined as:
“any data processed in an electronic communications network, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;” 3
Virtual currency is defined as:
Table 1 shows which of the three standards has at least one requirement in each group (mechanism).
- Wherever ACM-1 in EN 18031-1 mentions the word “network,” EN 18031-2 mentions the word “privacy,” and EN 18031-3 mentions the word “financial.”
- ACM-1 in 18031-1:
“Do the physical or logical measures in the targeted operational environment limit to authorized entities?”
- Whereas in ACM-1 in 18031-2 and 18031-3:
“Do the physical or logical measures in the targeted environment ensure that its accessibility is limited to authorized entities?”
- ACM-1 in 18031-1 and 18031-3:
“The verdict FAIL for the assessment case is assigned if: a path through the decision tree documented in E.Info.DT.ACM-1 ends with ‘FAIL’ …”
- Whereas in ACM-1 in 18031-2:
“The verdict FAIL for the assessment case is assigned if: all path through the decision tree documented in E.Info.DT.ACM-1 ends with ‘FAIL’ …”
- ACM-1 in 18031-2 and 18032-3, but not in 18031‑1:
“If the equipment relies on the access control given by the intended operational environment, it is to be ensured that this access control is appropriate as described in ACM-2.”
- ACM-1 18031-2 but not in 18031-1 or 18032-3:
“In general, full public accessibility to privacy assets cannot be considered as a reasonable intended equipment functionality, especially concerning children’s privacy and childcare. However, specific scenarios involving public accessibility to privacy assets may be considered as intended equipment functionality if part of clearly advertised functionality or is communicated (to non‑child users) via UNM.”
However, in the Restrictions, it says:
We are not providing a link to EN 18031-X:2024 as there is no single source for the standards since they are distributed through the standards organizations of the various EU countries.
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng, Article 4(1)
- https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng, Article 2(b)
- https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng, Article 2(c)
- https://eur-lex.europa.eu/eli/dir/2019/713/oj/eng, Article 2 (d)
- https://ec.europa.eu/docsroom/documents/64474/attachments/1/translations/en/renditions/native
