EN18031 is widely misunderstood – most notably, many treat it as the EU version of UN R155. That is fundamentally wrong. They govern different products, under different legal frameworks. This article sets the record straight on scope, applicability, and deadlines.

1. What EN18031 Really Is – Not UN R155

·UN R155 is a UN WP.29 vehicle regulation for whole‑vehicle M/N/O/L categories – it mandates CSMS and type approval for the entire vehicle lifecycle.

·EN18031 is a harmonised standard under the EU RED (Radio Equipment Directive 2014/53/EU). It applies only to stand‑alone radio equipment sold at retail – e.g., aftermarket T‑Boxes, Bluetooth speakers, dashcams, independent modules.
There is no “conversion” between them. They are completely separate legal systems. Calling EN18031 the EU version of R155 is a category error.

1.1 Whole Vehicles Are Exempt from EN18031

OEM‑supplied, non‑retail ECUs and T‑Boxes – those that go only to carmakers – are exempt. They fall under UN R155. Only aftermarket wireless devices sold separately in the EU must comply with EN18031. Example: a dashcam with Wi‑Fi/4G sold in a retail box – yes. A pre‑installed front‑end ECU – no.

1.2 Device Risk Level Determination

The core criterion: does the device have radio‑transmission capability and can it independently connect to the public internet or remote servers?

·Devices with only local Bluetooth audio, no cloud interaction, no OTA – are low‑risk, but they still require a basic security assessment – not a full exemption.

  2. EN18031 Official Timeline

EN18031 was published in the EU Official Journal on 30 January 2025 and became mandatory on 1 August 2025. There is no “2024 new vehicle first, 2026 all vehicles” schedule – that belongs to UN R155. From 1 August 2025, all stand‑alone wireless devices entering the EU must comply, and customs are already checking.

2.1 UN R155 Timeline – Separate

UN R155 deadlines were July 2022 for new types and July 2024 for all production vehicles – completely unrelated to EN18031.

  3. Who Needs a Notified Body (NB) vs. Self‑Declaration

Under RED:

·Financial‑payment devices (POS terminals, crypto wallets) – mandatory NB EU‑type examination.

·Ordinary aftermarket T‑Boxes, dashcams – allowed to use manufacturer’s DoC (self‑declaration).

There is no vague “high‑risk connected devices must use NB” – the boundary is clear: only financial‑payment products. NB fees are not as frightening as rumoured – EUR 5,000–12,000 for financial devices. Most automotive aftermarket products need only lab test fees, no NB charge.

3.1 CSMS Is Not Required for EN18031

CSMS (Cybersecurity Management System) is a UN R155 requirement for whole‑vehicle type approval. EN18031 only requires a product‑level TARA (Threat Analysis and Risk Assessment) – no organisational‑level system audit. Confusing the two raises the bar unnecessarily by 6–8 months.

  4. Boundary with ISO 21434

ISO/SAE 21434 is a process standard for vehicle development, aligned with UN R155. EN18031 is a product test standard for wireless terminals. They are not parallel verification exercises; they cover different layers and cannot substitute each other.

4.1 Boundary with GB44496

GB44496 is a Chinese national standard for OTA security of whole vehicles. EN18031 is an EU standard for wireless devices. Different markets, different products – no legal connection.

4.2 Only the 2024 Edition Exists

EN18031’s only official version is the 2024 edition – no 2026 revision. RED and EN18031 recognise only SOG‑IS‑certified international crypto suites (AES, ECC) – SM2/SM3/SM4 are not accepted. Exporters to the EU cannot substitute national Chinese algorithms for EU‑required suites.

  5. Log Retention Period

EN18031 does not mandate separate retention times for vehicles vs. cloud. Local device logs should be kept for at least 90 days. Cloud commercial logs are at the company’s own risk assessment – no statutory one‑year or three‑year fixed requirement.

5.1 OTA Update Requirements

OTA firmware updates are a core test item – they must include integrity and authenticity verification to prevent malicious firmware flashing. This is mandatory.

  6. What to Do Now

·Is your product sold stand‑alone? – If it’s OEM‑only, exempt. If aftermarket retail, yes.

·Connectivity type – local Bluetooth only (no cloud, no OTA) → basic assessment. With remote capability → full assessment.

·Is it financial‑payment? – Yes → NB route. No → DoC route (lab test + self‑declaration, CE mark).

After 1 August 2025, non‑compliant wireless devices risk customs detention. Market surveillance authorities are already conducting random checks – this is not theoretical.

For EN18031 and RED compliance, contact BlueAsia at 13534225140 (King) or king.guo@cblueasia.com.