EN 18031 has been mandatory for a year now, but many Chinese exporters still have not fully grasped the latest dynamics. Interpretations circulating online mix draft versions with the final release. Some do not mention the critical restriction clauses at all. This article reorganizes the official position as of July 2026 and walks through the most common misconceptions.
On January 30, 2025, the EU Implementing Decision (EU) 2025/138 was published in the OJEU. EN 18031-1/-2/-3 were officially added to the RED Directive harmonized standards list, with attached restriction clauses.
On August 1, 2025, enforcement began. New wireless connected devices shipped to the EU must include EN 18031 assessment reports in their CE-RED technical files. One easily overlooked detail: finished products with RED certificates obtained before August 1 can clear existing inventory. Only batches produced after that date must supplement EN 18031 assessment.
From December 15, 2025, Amazon EU began mandatory verification. Wireless IoT, wearable, and vehicle connectivity accessories without EN 18031 certificates face direct delisting. Temu and SHEIN also tightened enforcement in 2026.
Four Restriction Clauses Determine Your Path
The restriction clauses attached to (EU) 2025/138 are the most critical compliance fork in 2026. Among the companies I have worked with, more than half still cannot figure out whether their product should self-assess or go through a notified body.
1. Standard Annex Pitfalls
The Rationale and Guidance chapters in EN 18031 are reference only. Compliance determination looks exclusively at the normative clauses in the main text. Gap analysis and NB review do not accept guidance content as evidence. Do not bring annex material to argue with the reviewing body.
2. Password Login Devices
This catches the most people. Devices that ship allowing blank password login without forcing a first-time password change have the self-declaration path closed. They must go through NB third-party assessment. Devices that enforce a first-login password change and permanently disable blank login can take the self-assessment path. Devices using hardware keys or Bluetooth pairing keys without a username-password system are not subject to this clause.
3. Children's Toys and Monitoring Devices
Products under EN 18031-2 that have not fully implemented parental control provisions 6.1.3 through 6.1.6 are forced into the NB path. Even with full parental controls implemented, EU regulators recommend third-party assessment for high-risk products to reduce the probability of being rejected during market surveillance.
4. Financial Payment Devices
No room for negotiation. Connected POS terminals, payment charging stations, and similar products cannot rely on OTA security updates alone to meet anti-fraud and transaction traceability requirements. All must go through NB. The self-assessment channel is not available.
14 Security Mechanism Categories and CRA Transition
EN 18031-1 covers 14 major security mechanism categories. TLS encryption is just one piece. Access control, full key lifecycle management, secure firmware updates, comprehensive logging, secure boot, and vulnerability reporting must all pass item by item. Lab data tells a clear story: firmware upgrades over plaintext HTTP, no key rotation, and logs missing failed operation records, these three items combined account for the majority of rejection cases.
The CRA (Cyber Resilience Act), regulation number (EU) 2024/2847, reaches full enforcement on December 11, 2027. Its scope is far broader than EN 18031, covering wired devices, software, and cloud platforms. The transition period has a bidirectional exemption arrangement. Products that have completed full CRA compliance can be exempted from RED's EN 18031 cybersecurity clauses. Products that have completed EN 18031 can reuse their security architecture and penetration testing documentation for CRA compliance, saving some duplicated effort.
After December 11, 2027, the RED Directive deletes all cybersecurity clauses, consolidating them under the CRA. EN 18031 will no longer serve as a mandatory harmonized standard. But during the intervening 18 months, getting EN 18031 done first means the product can legally ship.
Consequences of Non-Compliance and How to Implement
Customs holds, full-channel delisting and recall, and fines up to 4% of global annual revenue, the same tier as GDPR. Importers and distributors face joint liability. In 2026, offline auto parts, retail, and online platforms generally require certificates or complete test reports upfront. Non-compliant suppliers face terminated partnerships.
Implementation in five steps:
1.Product scope determination: clarify which sub-standard, -1, -2, or -3, applies.
2.Pre-gap analysis with an NB-recognized lab. Do not try to interpret standard clauses yourself. Getting it wrong is more expensive.
3.Product security remediation: TLS encryption, firmware signature OTA, key rotation, logging. Hardware and software both need work, typically 1 to 3 months.
4.Lab testing and compliance assessment: self-assessment path takes 3 to 4 months. NB path starts at 6 months.
5.Update full RED technical documentation: security architecture, threat model, penetration test report, DPIA privacy assessment. Store at the EU representative's office for 10 years, ready for review at any time.
Exemptions and Common Cognitive Biases
Exemption boundaries need to be clear. Factory-installed OEM T-Boxes and head units fall under the UN R155/EU 2019/2144 framework, not EN 18031. Aftermarket third-party 4G modules, head units, and wireless GPS assemblies are independent RED devices and cannot escape EN 18031. Pure local Bluetooth earbuds without OTA, cloud connectivity, or data uploads can be exempted.
Misconceptions I hear repeatedly:
1.A RED certificate obtained before 2025 is not permanently valid. Batches produced after August 1 without EN 18031 supplementation cannot ship.
2.EN 18031 does not become void immediately when the CRA takes effect. Both run in parallel until the end of 2027.
3.Vehicle devices are not universally exempt. Aftermarket wireless accessories cannot escape.
4.TLS encryption does not equal secure communication compliance. Key management and certificate validation are equally mandatory. Missing either means failure.
BlueAsia Testing is a Huawei HiCar authorized certification organization, recognized with the "Excellent Certification Organization" award in 2025. We track EN 18031 official developments and help exporters navigate the latest compliance requirements.
For EN 18031 latest policy consultation, contact BlueAsia Testing: 13632500972 (Benson)
相关新闻
