EN 18031 and the CRA essential requirements: what carries over, mechanism by mechanism

If you sell radio equipment in the EU, you may already have assessed it against EN 18031, the harmonised standards for the Radio Equipment Directive's cybersecurity requirements. Our guide "The CRA and the Radio Equipment Directive side by side" covers the two laws and their dates. This one goes a level deeper: what the three EN 18031 parts actually assess, what the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) says about that work, and which CRA essential requirements each EN 18031 mechanism gives you evidence for. It is a documentation aid, not legal advice. Standards are cited by number and described in our words; their text is not reproduced.

What the CRA says about EN 18031, and what it does not

It is tempting to assume that work done under the RED counts automatically under the CRA. The text does not say so. Here is what it does say.

Recital 30 is the CRA's main statement about the RED's cybersecurity requirements (recital 100 adds that conformity assessment bodies notified under the RED act "should be newly assessed and notified" under the CRA, and that authorities can define "synergies" on overlapping requirements "to prevent an unnecessary financial and administrative burden"). A recital explains the articles; it does not itself impose obligations. Recital 30 says three things:

• "The essential cybersecurity requirements set out in this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU." The CRA covers everything the RED's cybersecurity requirements cover, and more.
• When the RED cybersecurity act stops applying, the Commission and the standards bodies "should take into account the standardisation work carried out" for the RED "in the preparation and development of harmonised standards" for the CRA. EN 18031 is meant to feed the future CRA standards.
• During the transition, the Commission "should provide guidance" to manufacturers subject to both.

The overlap is solved by repeal, not by substitution. Commission Delegated Regulation (EU) 2026/339 repeals the RED cybersecurity act (Delegated Regulation (EU) 2022/30) with effect from 11 December 2027. Its recital 4 gives the reason: "to prevent radio equipment covered by Delegated Regulation (EU) 2022/30 from being simultaneously subject to requirements also concerning cybersecurity set out in Regulation (EU) 2024/2847". From that date, radio products placed on the market are subject to the CRA's cybersecurity requirements, not the RED act's; recital 5 of the repealing act keeps RED market surveillance for radio equipment placed on the market between 1 August 2025 and 10 December 2027.

The CRA gives a presumption of conformity by three routes, and EN 18031 is on none of them. Article 27(1) gives it to harmonised standards "the references of which have been published in the Official Journal" under the CRA. Article 27(5) gives it to common specifications the Commission establishes by implementing act. Article 27(8) gives it to a certificate or EU statement of conformity issued under a European cybersecurity certification scheme, "in so far as" that certificate covers the requirements. Our glossary entry "common specification" and our certification-scheme conformity route describe the second and third. None of the three is open to a radio device on the strength of EN 18031: EN 18031 is cited under the RED, by Implementing Decision (EU) 2025/138, not under the CRA; as of 8 October 2026, we found no standard cited under the CRA in the Official Journal; and our self-assessment route (module A) records that on 9 October 2026 no common specification had been established and no delegated act had named a certification scheme for the CRA under Article 27(9).

Compare what the CRA does when it wants substitution. Article 12 says a product that is a high-risk AI system "shall be deemed to comply" with the AI Act's cybersecurity requirements if it meets the CRA's, and the declaration of conformity shows that the level of cybersecurity protection required under Article 15 of the AI Act is achieved (Article 12(1)). There is no such article for the RED or EN 18031.

So EN 18031 gives you evidence for parts of Annex I, not a presumption and not an exemption. The Commission's CRA FAQ, version 1.4 of 4 September 2026 (2.6.1), which is not binding, is consistent with this: radio products placed on the market from 11 December 2027 "will be subject to the essential requirements of the CRA".

How EN 18031 is built

The three parts were developed by the joint CEN and CENELEC committee JTC 13. CEN-CENELEC describe them as:

• EN 18031-1:2024: common security requirements for internet-connected radio equipment (RED Article 3(3)(d), network protection);
• EN 18031-2:2024: radio equipment that processes personal, traffic or location data, including childcare, toy and wearable equipment (Article 3(3)(e), privacy);
• EN 18031-3:2024: internet-connected radio equipment that processes virtual money or monetary value (Article 3(3)(f), fraud).

CEN-CENELEC add that the series establishes "a foundation for the development of harmonized standards supporting the Cyber Resilience Act".

The standards work on assets: security assets in all three parts, network assets in part 1, privacy assets in part 2, financial assets in part 3 (per a Phoenix Testlab presentation). For each asset, a set of mechanisms is checked with decision trees: is the mechanism applicable, and if so is the protection appropriate? The outcomes are pass, fail or not applicable. Applus+ Laboratories sums it up: "If a mechanism is not applicable to a device, no further assessment is needed."

Mechanism by mechanism

The table below lists the EN 18031 mechanisms, which parts use them (per Phoenix Testlab), what each assesses (in our words, after Emitech's descriptions), and the CRA Annex I points we read each one as giving evidence for. The last column is argument: our mapping, not an official one. We found no official mapping between EN 18031 and the CRA.

Mechanism	Parts	What it assesses	Closest CRA points (our reading)
ACM, access control	1, 2, 3	Only authorised entities reach sensitive assets	Part I(2)(d)
AUM, authentication	1, 2, 3	Strength of passwords, certificates and tokens	Part I(2)(d); with the password restriction, Part I(2)(b)
SUM, secure update	1, 2, 3	Updates are genuine, intact and controlled	Part I(2)(c), Part II(7)
SSM, secure storage	1, 2, 3	Stored assets are protected	Part I(2)(e), (f)
SCM, secure communication	1, 2, 3	Exchanges are confidential, intact, authentic and replay-proof	Part I(2)(e), (f)
CCK, confidential cryptographic keys	1, 2, 3	Keys are generated well and never shipped as defaults	Part I(2)(e), (b)
CRY, cryptography	1, 2, 3	Cryptography follows current good practice	Part I(2)(e), (f)
GEC, general equipment capabilities	1, 2, 3	Up-to-date software, few exposed services	Part I(2)(a), (j)
RLM, resilience	1	Withstands denial-of-service attacks	Part I(2)(h)
NMM, network monitoring	1	Detects abnormal network activity	Part I(2)(i), (l)
TCM, traffic control	1	Controls traffic to prevent abuse	Part I(2)(i)
LGM, logging	2, 3	Security events are traceable	Part I(2)(l)
DLM, deletion	2	Sensitive data can be securely deleted	Part I(2)(m)
UNM, user notification	2	Users are told about security events	The "report on" duties in Part I(2)(d) and (f)

Read by part (argument): part 1's own mechanisms point at availability, Part I(2)(h) and (i), the CRA's version of "do not harm the network"; part 2's point at logging, deletion and telling the user, Part I(2)(l) and (m); part 3 adds logging to the shared core for financial assets.

What EN 18031 does not reach

On our reading, nothing in the mechanisms above covers these Annex I points:

• Data minimisation (Annex I, Part I(2)(g)) and exploitation mitigation (Annex I, Part I(2)(k)): no mechanism in the public descriptions we found addresses them directly. On data minimisation the Commission's guidance points the same way: it gives data minimisation as an example of a risk a RED certificate may not cover (C(2026) 5252, paragraph 253, not binding).
• The risk assessment. EN 18031 checks mechanisms per asset; the CRA asks for a cybersecurity risk assessment of the whole product (Article 13(2)), and Annex I, Part I(2) applies its requirements "on the basis of" it.
• Almost all of Part II, vulnerability handling: the SBOM (Annex I, Part II(1)), remediation without delay (Annex I, Part II(2)), security testing (Annex I, Part II(3)), advisories (Annex I, Part II(4)), coordinated disclosure and a contact address (Annex I, Part II(5) and (6)), and free security updates (Annex I, Part II(8)). Only secure update distribution (Annex I, Part II(7)) overlaps, through SUM.
• Duties outside Annex I: the support period (Article 13(8)) and Article 14 reporting, which has applied since 11 September 2026 (Article 71(2), EUR-Lex text checked 8 October 2026).

What to do

1. Keep your EN 18031 records (the decision-tree outcomes, test reports and justifications) and cite them in your CRA technical documentation as evidence for the points above. They do not presume conformity, but they are work you do not need to repeat from nothing.
2. Note where a restriction applied to you. Implementing Decision (EU) 2025/138 withholds presumption where users may skip setting a password, among other cases. Under the CRA the same design choice is, on our reading (argument), a question for Annex I, Part I(2)(b), secure by default.
3. Keep any RED notified-body certificate. Article 69(1) says EU type-examination certificates and approval decisions "issued regarding cybersecurity requirements" under Union harmonisation legislation other than the CRA "shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred to in that legislation". The article names no other law. That it reaches certificates issued under the RED cybersecurity act is the Commission's reading, not the article's words (neither document below is binding). The Commission's FAQ, version 1.4 of 4 September 2026 (7.1), names Delegated Regulation (EU) 2022/30 as an example of such other legislation. Its CRA guidance, C(2026) 5252 (section 9.3.2, paragraphs 247 to 254), says such a certificate can be relied on as evidence for the cybersecurity risks it covers, for as long as it stays valid and not beyond 11 June 2028; that it does not replace the CRA risk assessment; and that risks it does not cover, for example vulnerability handling, data minimisation and reduction of the attack surface, remain yours to address.
4. Close the gaps now, starting with vulnerability handling, which EN 18031 does not cover and which the CRA asks for on every product.
5. Watch for the CRA harmonised standards. When they are cited, re-map your evidence to them.

What is settled and what is not

Settled (evidence): recital 30; the repeal by Delegated Regulation (EU) 2026/339 from 11 December 2027; Article 27(1), (5) and (8) on presumption; the text of Article 69(1); the EN 18031 listing and restrictions in Implementing Decision (EU) 2025/138.

Not settled (as of 8 October 2026): which harmonised standards the CRA will cite and how closely they follow EN 18031, and what further transition guidance under recital 30 the Commission will give beyond its July 2026 guidance on RED certificates. The mechanism mapping above is our reading and will be revisited against the CRA standards when they are published.