Preparing for the Cyber Resilience Act as well? See CRA Readiness Assessment. For a security assessment without a specific regulation in mind, see Product Security Assessment.
The deadline is already behind you
The Radio Equipment Directive's cybersecurity requirements, Article 3.3(d), (e) and (f), became mandatory. Every radio product placed on the EU or EEA market since then has to meet them. Unlike the CRA's deadlines, this one is not coming; it has passed.
Market-surveillance authorities can ask for evidence of conformity for products already on sale. Radio equipment that can't show it can be refused entry, withdrawn or recalled.
Most makers of wireless products are further from conformity than they expect, because the requirements sit exactly where the radio meets the firmware, the layer a design review and a code scanner both read past. That is the work we do.
Does this apply to your product?
RED covers equipment that intentionally transmits or receives radio: Wi-Fi, Bluetooth and BLE, cellular, Thread and Zigbee, ultra-wideband, GNSS receivers, and proprietary sub-GHz links. If there is a radio in the product, it is in scope. Which of the three requirements apply depends on what the product does.
- 3.3(d) Network protection
For internet-connected or data-processing radio equipment. The product must not harm the network it joins or misuse its resources.
- 3.3(e) Privacy and personal data
For equipment that handles personal, traffic or location data, plus toys, wearables and childcare equipment. Safeguards for the user's privacy and data.
- 3.3(f) Protection from fraud
For equipment that can transfer money or monetary value. Features that guard against fraudulent use.
What we verify on the device
EN 18031 turns the requirements into a set of security mechanisms the product has to implement properly. Each one is something you can only confirm on the built device, not from the design documents. We check them against the shipped firmware and the live product.
- Signed and verified updates
Whether the product can be updated safely at all, with authenticated, integrity-checked updates, secure boot and rollback protection. A radio product that can't accept a trusted fix, or will accept an untrusted one, can't stay compliant.
- No default passwords or hardcoded keys
Whether the device ships with universal default credentials or keys baked into the firmware, the first thing an attacker and an auditor both go looking for.
- Protected secrets
How keys, credentials and sensitive data are stored on the device, and whether they can be recovered from flash.
- Secure communication
Whether the radio link and the backhaul protect confidentiality, integrity and authenticity, or accept the other end without checking who it is.
- Access control and authentication
Whether security-relevant functions and interfaces actually check who is calling them.
- Radio resilience
Whether the product can be pushed to flood, degrade or misuse the network it sits on, the core of Article 3.3(d).
RED is the law. EN 18031 is how you prove it.
The Radio Equipment Directive is the legal obligation. EN 18031 is the harmonised standard that demonstrates conformity with it. Apply the standard, and you gain a presumption that you meet the requirement. The standard comes in three parts, one per requirement. EN 18031-1 covers network protection, EN 18031-2 covers privacy, and EN 18031-3 covers fraud.
If EN 18031 is fully applied and fits your product's risks, you can self-declare conformity. Where it isn't a clean fit, or where the standard's own conditions leave something open, a notified body has to be involved. Knowing which case you are in, before you commit to a route, is most of the value of looking early. Either way the technical work is the same. We confirm the mechanisms are genuinely there, document the evidence, and flag where a gap needs closing or a notified body needs to weigh in.
What you get
- Conformity gap report
Every EN 18031 mechanism assessed on your device, with evidence and a severity for each finding, mapped to Article 3.3 and the relevant part of the standard.
- Route recommendation
Whether your product is a clean fit for self-declaration or needs a notified body, so you choose the conformity path with the technical picture already in hand.
- Remediation guidance
What has to change, ordered by exposure, written for your engineers and respecting how the product is built.
- Re-verification
We re-check the fixes once you've closed the gaps, so the evidence reflects the product you actually ship.
How an engagement runs
Scope
We agree the target and the boundaries before work starts. That covers which product, which radios it uses, which of the three requirements apply, and how we get the firmware and a unit to test. The scope and the price are fixed up front, with no open-ended hourly meters running in the background. Your firmware and the unit are handled in an isolated environment and deleted after the engagement, with the handling documented.
Assess
Firmware and RF work both happen in our own lab. We extract and reverse the firmware, exercise the radio, and check each EN 18031 mechanism against how the device actually behaves.
Report
You get a report mapping every mechanism to Article 3.3 and the relevant EN 18031 part, with evidence, severity and reproduction steps, written for engineers. We debrief the team directly, so the report turns into fixes rather than a document that sits on a shelf.
Re-test
Once you've addressed the findings, we verify the fixes hold and update the report accordingly. The result is something you can put in front of a notified body or a market-surveillance authority with confidence.
For test labs and certification bodies
Is RED generating more radio-cybersecurity assessment work than you have hands for? EN 18031 asks for firmware and RF skills that sit outside traditional radio testing. MKR Labs takes that assessment work as a subcontractor. You hold the accreditation and the client relationship, we bring the lab and the hands, quietly and under your brand where needed.