The European Commission has recently published its Decision referencing harmonised standards in support of the cybersecurity requirements of the Radio Equipment Directive (2014/53/EU) or (RED). The RED includes requirements for Internet connected equipment, for toys and childcare equipment that process data and for equipment used in financial transactions.
The following standards now offer a presumption of conformity with the requirements.
- EN 18031-1 2024 – Common security requirements for radio equipment – Part 1: Internet connected radio equipment.
- EN 18031-2 2024 – Common security requirements for radio equipment – Part 2: radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment.
- EN 18031-3 2024 Common security requirements for radio equipment – Part 3: Internet connected radio equipment processing virtual money or monetary value.
Note that part 2 applies to toys and child care products.
The standards have been referenced with a restrictive note. There is concern that the standards allow users the option to not set a specific access password, or to avoid setting up parental controls. Provided passwords and parental controls are correctly required in a product set up, the standards can still be used. Alternatively, a notified body EC Type approval can be used.
For more information, please see the BTHA guidance on the RED.
