The EU Radio Equipment Directive (RED 2014/53/EU) ensures radio equipment placed on the EU market meets unified safety, health, electromagnetic compatibility, environmental, and now cybersecurity requirements. With the explosion of IoT devices, the 2025 update makes cybersecurity compliance mandatory in addition to traditional RF/EMC/Saf
ety.
CE-RED is mandatory across the European Economic Area (EEA): the 27 EU countries + Iceland, Norway, Liechtenstein.
Consumer electronics: mobile phones, Bluetooth headsets, smartwatches
IoT devices: smart cameras, wireless sensors
Industrial equipment: drone controllers, wireless payment terminals
Computers & peripherals: routers, laptops
Certification is based on RED (2014/53/EU) — the EU’s market-access rule for radio equipment.
From August 1, 2025, applicable wireless devices must comply with the EN 18031 cybersecurity series. Passing only RF/EMC/Safety is not enough.
| Standard Sub-item | Core Requirements (examples) | RED Clause |
|---|---|---|
| EN 18031-1 (General devices) | DDoS resilience, secure update/rollback, disable default/blank passwords | Art. 3.3(d) – must not harm networks or misuse resources |
| EN 18031-2 (Children/Wearables) | AES-256 encryption, location-data protection, parental/guardian access control | Art. 3.3(e) – protect personal data & privacy |
| EN 18031-3 (Payment terminals) | Transaction verification, tamper-resistant design, MFA | Art. 3.3(f) – prevent fraud |
New test items now common in the certification scope:
Penetration testing (simulated intrusion/DDoS)
Firmware security audit (vulnerability scanning, update integrity, crypto)
Suggested visual flow (horizontal): 1. Preparation → 2. Lab Testing → 3. Certification Application & Review → 4. (High-Risk) Notified Body Secondary Review → 5. Certificate Issuance & CE Marking → 6. Post-Market Surveillance
Confirm applicability; map frequency bands, power, and harmonized standards (e.g., EN 300 328 for 2.4 GHz).
Build the Technical File: user manual (EU languages), circuit diagrams, risk assessment, component list/BOM, labels.
RF (e.g., EN 300 328), EMC (e.g., EN 301 489 series / EN 55032 for emissions), LVD (EN 62368-1), SAR (EN 62479/EN 62311 where applicable).
Cybersecurity per EN 18031-1/-2/-3.
Lab submits test reports + technical files.
Standard products: lab review may suffice.
High-risk/complex products (e.g., no passwords, toys, payment terminals): EU Notified Body (NB) secondary review → certificate bears NB number.
Affix CE mark (height ≥ 5 mm), declare EN 18031 compliance in the manual.
Keep full technical documentation for ≥ 10 years for EU market-surveillance checks.
Certification cycle: 4–8 weeks standard; complex rectification can add 2–3 months.
Cost composition (illustrative):
Testing fees: $15,000–$25,000 (often lower via Chinese labs)
Certification issuance: $5,000–$8,000
Potential extras: Notified Body fees (if required), EU Authorized Representative, expedited service
Note: Final scope depends on radio technologies, bands, device usage, and whether EN 18031-2/-3 applies.
Use certified modules (Wi-Fi/Bluetooth already RED-compliant incl. EN 18031) to reduce scope, cost, and time.
Preliminary gap analysis: start 6–12 months ahead; most products require design tweaks during formal testing.
Leverage “family models” for variants with only cosmetic changes (same radio/hardware/firmware).
Never ship without certification: from Aug 1, 2025, non-compliant products face bans, customs detention/destruction, and fines up to 4% of global annual turnover.
Monitor maintenance: CE-RED has no fixed expiry, but re-testing is needed if EU standards update (~every 5 years) or if hardware/firmware changes.
Blue Asia Technology (Shenzhen) is an ISO/IEC 17025-accredited lab providing end-to-end CE-RED 2025 programs:
EN 18031 cybersecurity (3.3(d)(e)(f)), RF/EMC/LVD/SAR
Pen-testing & firmware security audits (pre-test to reduce rework)
Technical-file guidance (security architecture, data flows, update policy)
Multi-market approvals: FCC / UKCA / KC / SRRC / MIC / RCM, plus BQB / Wi-Fi Alliance / USB-IF
king.guo@cblueasia.com | +86 135 3422 5140
Q1. Does every wireless device need EN 18031 now?
Most network-connected devices need EN 18031-1; add -2 for personal-data processing; add -3 for transactions.
Q2. When is an NB required?
If you cannot meet self-declaration limitations (e.g., blank passwords, missing parental control, weak update security) or use non-harmonized standards.
Q3. How do I shorten timelines?
Use certified modules, run a gap analysis and pre-tests, and prepare a complete Technical File before submission.
Need to confirm which EN 18031 parts apply and how to pass on the first attempt?
Blue Asia Technology can review your design and build a pass-ready test plan.
Request a Free CE-RED Cybersecurity Checkup → /contact
king.guo@cblueasia.com | +86 135 3422 5140
Related News
