For engineers
EN 18031 for routers and cameras: which part applies
By Manish SharmaPublished 4 min read
Founder and CEO, MAGDOX. Writes on firmware security and device regulation.
EN 18031 is the harmonised standard for the EU's radio equipment security rules, which have applied since 1 August 2025 and give way to the Cyber Resilience Act on 11 December 2027. A Wi-Fi router or camera sold in the EU usually needs part 1 and, because it handles personal data, part 2; part 3 applies only when the device moves money. The Official Journal citation removes the presumption of conformity in three cases, and optional passwords is the one most router and camera makers trip on.
In short
- EN 18031 is the harmonised standard behind the EU's radio equipment security rules. They have applied since 1 August 2025 and end on 11 December 2027, when the Cyber Resilience Act takes over.
- A Wi-Fi router or camera usually needs part 1 and part 2. Part 3 applies only when the device moves money.
- The firmware shows a lot of the evidence: passwords, update checks, cryptography and storage. Documents cover the rest.
These rules come from the Radio Equipment Directive, Directive 2014/53/EU. Article 3(3) lets the Commission switch on extra requirements, and Delegated Regulation (EU) 2022/30 switched on three of them for internet-connected radio equipment.
This guide answers the question router and camera teams ask first: which part do we test against? For the clause by clause comparison with the consumer IoT baseline, read our post on ETSI EN 303 645 and EN 18031.
What does each part of EN 18031 cover?
Each part answers one of the three requirements of Article 3(3).
| Part | Requirement of the directive | What it protects |
|---|---|---|
| EN 18031-1 | Article 3(3)(d): no harm to the network or misuse of network resources | Internet-connected radio equipment |
| EN 18031-2 | Article 3(3)(e): safeguards for personal data and privacy | Internet-connected radio equipment, childcare equipment, toys and wearables that process personal, traffic or location data |
| EN 18031-3 | Article 3(3)(f): protection from fraud | Internet-connected radio equipment that handles money or monetary value |
The parts are organised by security mechanism rather than by device: access control, authentication, secure storage, secure communication, secure update, cryptography and so on. Each mechanism comes with assessment criteria that say when it is met.
Which part applies to a router or a camera?
Start from the radio. The directive applies to radio equipment, so a device with no radio at all, such as a wired-only camera, is outside these rules. It will still fall under the Cyber Resilience Act from December 2027.
| Device | Part 1 | Part 2 | Part 3 |
|---|---|---|---|
| Wi-Fi router or mesh node | Yes, it connects to the internet | Yes, it handles traffic and connection data | Only with payment features |
| Wi-Fi or 4G security camera | Yes | Yes, video and images of people are personal data | Only with payment features |
| Video doorbell with a radio | Yes | Yes | Only with payment features |
| Wired camera or NVR with no radio | No | No | No |
Check your own case with your test lab: a radio accessory that never connects to the internet, for example, can change the answer.
What dates apply?
| Act | What it does |
|---|---|
| Delegated Regulation (EU) 2022/30 | Applies Article 3(3)(d), (e) and (f) to internet-connected radio equipment |
| Delegated Regulation (EU) 2023/2444 | Moves the start to 1 August 2025 |
| Implementing Decision (EU) 2025/138 | Cites EN 18031-1, -2 and -3 in the Official Journal on 30 January 2025, with restrictions |
| Delegated Regulation (EU) 2026/339 | Repeals 2022/30 from 11 December 2027 |
Products placed on the market between 1 August 2025 and 10 December 2027 stay subject to market surveillance under these rules after the repeal. The repeal's recitals note that the Cyber Resilience Act's Annex I covers every element of the three radio requirements, so the work carries forward. Our EU CRA timeline has the dates that follow.
Where do router and camera makers lose the presumption?
Applying a harmonised standard gives a presumption of conformity: legal proof that the product meets the requirement. The Official Journal citation takes that away in three cases.
- Optional passwords, all three parts. If you let the user choose not to set or use any password, the standard no longer carries you. Make the user set a password at setup, or ship a password unique to each device.
- Parental control, part 2. On toys and childcare equipment, the access control must ensure parental or guardian control.
- Secure updates, part 3. Its secure update criteria give no presumption, because no single listed method is enough for financial assets.
For routers and cameras, the first one is the common trap. A setup wizard with a "skip" button on the password step is enough to lose it.
What can the firmware show?
A lot of EN 18031 is visible in the firmware image, before a lab ever sees the device.
| Mechanism | Evidence in the firmware | Still needs |
|---|---|---|
| Authentication and passwords | No published default credentials, no hard-coded credentials, no account without a password, a strong hash for stored passwords | The setup flow on the device |
| Secure update | Updates verified by signature, an integrity check before installing, unsigned updates rejected | Your update server and process |
| Secure storage and keys | No private keys or clear text credentials in the image, keys of adequate length | Per-device provisioning records |
| Secure communication | TLS 1.2 or later, valid certificates, no SSL, MD5, SHA-1, DES, RC4 or ECB | Your cloud and app endpoints |
| Vulnerabilities | Known vulnerabilities in the kernel, BusyBox, TLS libraries and the rest of the SBOM | Your fix and release process |
FDIE by Magdox maps its device checks to these mechanisms for each analysed release, so a team sees the gaps before booking the lab. The standard's text is sold by the standards bodies; read it for the exact criteria, and treat any mapping, ours included, as a guide to where the evidence is. A notified body or your test lab makes the final call.
Questions
Does EN 18031 apply to a camera without Wi-Fi?
The radio rules apply to radio equipment. A camera with no radio, connected only by cable, is not radio equipment, so these rules do not apply to it, although the Cyber Resilience Act will from 11 December 2027.
Which EN 18031 part applies to a Wi-Fi router?
Part 1 for any internet-connected radio equipment, and part 2 because a router processes personal data such as traffic and connection data. Part 3 only if it handles payments or other monetary value.
How long do the EN 18031 radio rules apply?
From 1 August 2025. Delegated Regulation (EU) 2026/339 repeals the delegated act behind them from 11 December 2027, when the Cyber Resilience Act applies in full.
What makes a product lose the EN 18031 presumption of conformity?
Three restrictions in the Official Journal citation: letting the user choose not to set a password, access control on toys and childcare equipment that does not ensure parental control, and the secure update criteria of part 3.
Sources
- Directive 2014/53/EU, the Radio Equipment Directive (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2022/30 (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2023/2444, application from 1 August 2025 (EUR-Lex) eur-lex.europa.eu
- Commission Implementing Decision (EU) 2025/138 citing EN 18031-1, -2 and -3 with restrictions (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2026/339 repealing Delegated Regulation (EU) 2022/30 (EUR-Lex) eur-lex.europa.eu
- Regulation (EU) 2024/2847, the Cyber Resilience Act (EUR-Lex) eur-lex.europa.eu
Product and project names are trademarks of their owners, used only to identify the public firmware, software and standards discussed. MAGDOX is not affiliated with or endorsed by them.