Cybersecurity becomes mandatory: EU standard EN 18031 binding since August 2025

Cybersecurity is no longer just a “nice-to-have”; it has been legally required for connected products in the EU since August 1, 2025. The new EN 18031 series, developed under the Radio Equipment Directive (RED), enforces strict security requirements for connected radio and IoT devices.

The EN 18031 series consists of three harmonized standards defining specific cybersecurity requirements: EN 18031-1 for internet-enabled radio devices, EN 18031-2 for devices that process data (e.g., personal or location data), and EN 18031-3 for devices handling virtual currencies or monetary values.

The goal is to protect networks, safeguard data and privacy, and prevent fraud, key aspects that are mandatory under the RED. Without these compliance proofs, manufacturers cannot obtain CE marking. This not only poses legal risks but can also lead to sales stops, recalls, or sanctions in the EU market.

Many producers of small and medium-sized systems, from smart home gateways to connected industrial sensors, are still surprised by the breadth of the requirements. The standard requires a secure-by-design approach, risk analyses, access controls, and protection mechanisms throughout the product’s lifecycle.

For many companies, this means acting early. In addition to implementing the standard, it is important to provide proof to market surveillance authorities and, if necessary, undergo a type examination by a notified body.

This is exactly where emtrion’s free Cyber Compliance Check comes in: practical, standards-compliant, and easy to understand, it helps manufacturers assess their products for compliance with EN 18031 and other relevant regulations before costly market problems arise. Cybersecurity is no longer an add-on; it is now a central competitive factor in the connected product market.

For more information, visit our website at https://www.emtrion.de/en/services/software-development/embedded-security/ or call us at +49 (0)7244 626 94-0.