Cybersecurity of radio equipment: EN 18031-1, -2 and -3:2024 in the list of harmonised standards with restrictions — no presumption of conformity where the user may set no password (clauses 6.2.5.1–6.2.5.2), where parental control is missing and for the secure-update criteria of clause 6.3.2.4
Commission Implementing Decision (EU) 2025/138, published on 30 January 2025, adds rows 164–166 to the list of harmonised standards for Directive 2014/53/EU (Implementing Decision (EU) 2022/2191): EN 18031-1:2024, EN 18031-2:2024 and EN 18031-3:2024 for the essential requirements of Article 3(3), first subparagraph, points (d), (e) and (f), activated by Delegated Regulation (EU) 2022/30. Each of the three standards enters with notes restricting the presumption of conformity.
- Scope of the three parts: EN 18031-1 — internet-connected radio equipment (point (d)); EN 18031-2 — radio equipment processing data: internet-connected, childcare, toy and wearable radio equipment (point (e)); EN 18031-3 — internet-connected radio equipment processing virtual currency or monetary value (point (f)). The standards were drafted by CEN and CENELEC under standardisation request C(2022)5637 of 5 August 2022.
- Restrictions common to all three: the “Rationale” and “Guidance” sections confer no presumption of conformity (they are not specifications, and “Guidance” refers to documents of national standardisation bodies); there is also no presumption if, when applying clauses 6.2.5.1 and 6.2.5.2 on default passwords, the user is allowed not to set and use any password — the authentication-related risks are then considered not addressed.
- Specific restrictions: in EN 18031-2, for the classes covered by clauses 6.1.3–6.1.6 (access control in toy and childcare radio equipment) there is no presumption if clauses 6.1.3.4.2, 6.1.4.4.2, 6.1.5.4.2 and 6.1.6.4.2 do not ensure parental or guardian access control — the assessment categories (role-based, discretionary, mandatory or other access control) do not always provide for it. In EN 18031-3 the secure-update assessment criteria of clause 6.3.2.4 (digital signature, secure communication, access control or other) give no presumption at all, as none of these methods alone suffices for financial assets.
- According to the records in the Estonian EVS catalogue, EN 18031-1:2024 and EN 18031-2:2024 have been valid since 2 September 2024, and their records already quote the notes from Decision 2025/138. The scope of EN 18031-2 excludes 5G network equipment used by providers of public electronic communications networks and services within the meaning of Directive (EU) 2018/1972. For laboratories this means that in these three variants testing to the standard does not suffice for a presumption of conformity. The decision entered into force on the day of publication.