We announced the forthcoming listing in the Official Journal of the EU (OJEU) in our last newsletter. On January 30, 2025, the EU Commission listed the three cybersecurity standards in the OJEU with restrictions.
The standards are therefore directly applicable with restrictions from January 30, 2025.
Without listing in the OJEU, every product with direct or indirect access to the internet would have had to undergo a type examination, at least for the cybersecurity part, by the Notified Body (NB) from August 1, 2025.
Due to the restrictions, the NB may still be required. The restrictions mean that the standards only fulfill the presumption of conformity to a limited extent.
The restrictions are described below in the notes (OJEU wording).
EN 18031-1:2024
Common safety requirements for radio equipment
- Part 1: Radio equipment with internet connection
This standard applies to all equipment connected directly or indirectly to the Internet and not covered by Part 2 or 3 of the series of standards.
Note 1: The clauses entitled 'rationale' or 'guidance' in this harmonized standard do not confer a presumption of conformity with the essential requirement set out in point (d) of the first subparagraph of Article 3(3) of Directive 2014/53/EU.
This restriction is not a restriction. It only clarifies that the parts of the standard entitled "Requirements" (points 6) are sufficient and valid. Informative parts of the standard are formally not to be observed, even if they are helpful for the user.
Note 2: This harmonized standard does not confer a presumption of conformity with the essential requirement set out in Article 3(3), first subparagraph, point (d) of Directive 2014/53/EU if the user is allowed not to set or use a password when applying points 6.2.5.1 and 6.2.5.2.
This means that the user must always assign their own password.
If both these and all other requirements specified in the standard are met, the type examination by the NB is not required.
EN 18031-2:2024
Common safety requirements for radio equipment
- Part 2: Radio equipment that processes data, in particular internet-enabled radio equipment, childcare radio equipment, toy radio equipment and portable radio equipment
The devices concerned are derived from the title of the standard and the RED.
Note 1 and Note 2: are identical to the notes of the same name for EN 18031-1, thus providing the same solution approach.
Note 3: For the classes and categories of radio equipment covered by 6.1.3, 6.1.4, 6.1.5 or 6.1.6 of this harmonized standard, this harmonized standard does not confer a presumption of conformity with the essential requirement set out in point (e) of the first subparagraph of Article 3(3) of Directive 2014/53/EU if access control by parents or guardians is not ensured by the application of points 6.1.3.4.2, 6.1.4.4.2, 6.1.5.4.2 and 6.1.6.4.2.
Here, the manufacturer of the product must ensure that access control is enforced by the parents. The sections of the standard provide for alternatives that are not desired by the EU Commission.
EN 18031-3:2024
Common safety requirements for radio equipment
- Part 3: Internet-enabled radio equipment handling virtual money or monetary value
For all devices that enable or initiate payments.
Note 1 and Note 2: are identical to the notes of the same name to EN 18031-1. This means that the same approach is taken.
Note 3: With regard to the assessment criteria set out in point 6.3.2.4 of this harmonized standard, this harmonized standard does not confer a presumption of conformity with the essential requirement set out in point (f) of the first subparagraph of Article 3(3) of Directive 2014/53/EU."
This point is more complex and cannot be described and resolved here in brief.
The above content is abridged for the newsletter to provide a quick overview. In the detailed product evaluation, there will be cases that require in-depth consideration. We will be happy to help with our individual advice.
The EU Commission had originally announced that it would publish a guide to the comments.
We will keep you up to date and will be happy to provide you with further details.
Author's note
This article has been machine translated into English.
TERMS AND ABBREVIATIONS
OJEU: Official Journal of the EU
NB: Notified Body (third party body, required for a type examination)
Norm = Standard
