For engineers
ETSI EN 303 645 or EN 18031: one evidence base for both
By Manish SharmaPublished 8 min read
Consumer IoT sold in Europe is judged against two overlapping documents. ETSI EN 303 645 is a voluntary consumer IoT baseline. EN 18031-1, -2 and -3 are the harmonised standards for the Radio Equipment Directive's security requirements. Those apply from 1 August 2025 until 11 December 2027, when the Cyber Resilience Act takes over. Most ETSI provisions on passwords, updates, storage, communication and attack surface have an EN 18031 counterpart, and the same firmware evidence feeds both. They differ on legal role, scope, vulnerability handling, privacy and three restrictions in the Official Journal.
In short
- ETSI EN 303 645 is a voluntary consumer IoT baseline; EN 18031 is the harmonised standard for EU radio rules from 1 August 2025 to 10 December 2027.
- Passwords, updates, storage, communication and attack surface line up well, so one firmware analysis can feed both.
- They differ on legal role, scope, vulnerability handling and privacy, and the Official Journal limits EN 18031 in three places.
Two documents with different jobs
ETSI EN 303 645 describes what good consumer IoT security looks like. EN 18031 is a route to a presumption of conformity with a law, meaning legal proof that a product meets it. That difference shapes how each one is written and assessed.
| ETSI EN 303 645 | EN 18031-1, -2 and -3 | |
|---|---|---|
| Published by | ETSI | CEN and CENELEC |
| Version | V3.1.3, September 2024 | 2024 editions, cited on 30 January 2025 |
| Legal role | Voluntary European standard | Harmonised under Directive 2014/53/EU, with restrictions |
| Scope | Consumer IoT devices | Part 1: internet-connected radio equipment. Part 2: internet-connected radio equipment, childcare equipment, toys and wearables that process personal, traffic or location data. Part 3: internet-connected radio equipment that moves money |
| Structure | Provisions 5.0-1 to 6-8, each M (shall) or R (should), some conditional | Requirements grouped by mechanism, such as access control, authentication, secure update, storage and communication |
| How it is assessed | ETSI TS 103 701 | Against each requirement's assessment criteria |
Each ETSI provision is one sentence with a status: M for shall, R for should, and a condition where a feature must exist first. Provision 5.0-1 asks you to record a justification for every recommendation you do not meet. EN 18031 is organised by mechanism instead, and the Official Journal decision describes its "assessment criteria" and "implementation categories".
TEC 31318:2025 in India follows ETSI V3.1.3, so ETSI work also counts at home. Our ITSAR and TEC 31318 post covers that side.
The dates, as EUR-Lex has them
The radio security rules have applied since 1 August 2025 and end on 11 December 2027. We read each act below on EUR-Lex.
| Act | What it does |
|---|---|
| Delegated Regulation (EU) 2022/30 | Applies Article 3(3)(d), (e) and (f) of the directive to the radio equipment above; first set for 1 August 2024 |
| Delegated Regulation (EU) 2023/2444 | Moves the start to 1 August 2025 |
| Implementing Decision (EU) 2025/138 | Cites EN 18031-1, -2 and -3 in the Official Journal on 30 January 2025, with restrictions |
| Delegated Regulation (EU) 2026/339 | Adopted 16 February 2026, published 29 April 2026; repeals 2022/30 from 11 December 2027 |
Two details matter for planning. The repeal does not stop market surveillance of radio equipment placed on the market between 1 August 2025 and 10 December 2027. Its recitals also say that the CRA's Annex I includes every element of the three radio requirements, so the work you do now carries forward.
The three restrictions
The citation in the Official Journal removes the presumption of conformity in three cases. If your design falls into one of them, the standard alone will not carry you.
- Optional passwords, all three parts. Clause 6.2.5 lets a manufacturer allow the user not to set or use any password, and choosing that option loses the presumption.
- Parental control, EN 18031-2. For toy and childcare radio equipment, the access control you pick must ensure parental or guardian control.
- Secure updates, EN 18031-3. Its assessment criteria for secure updates give no presumption, because no single listed method is enough for financial assets.
The sections named rationale and guidance give no presumption in any part. The fix for the first restriction is simple and matches ETSI 5.1-1. Make the user set a password at setup, or ship a password unique to each device.
Provision by provision
Most ETSI provisions about the device itself have an EN 18031 counterpart, and the same device checks give evidence for both. The table uses the EN 18031 identifiers we map to, which are marked to be confirmed for the reason given further down.
| ETSI provision | M or R | EN 18031 counterpart | Firmware evidence (device checks) | FDIE: ETSI | FDIE: EN 18031-1 |
|---|---|---|---|---|---|
| 5.1-1 Unique passwords | M | AUM-5 | No published default credentials, no hard-coded credentials, no account without a password | Partly | Partly |
| 5.1-3 Cryptography for authentication | M | AUM-2 | Strong hash for stored passwords | Partly | Partly |
| 5.1-5 Brute force made impracticable | M, conditional | AUM-6 | Brute-force protection on sign-in | Partly | Partly |
| 5.2-1 Disclosure policy published | M | None in part 1 | Disclosure policy referenced, plus your declared policy | Automatic | Not mapped |
| 5.2-3 Vulnerabilities monitored and fixed | R | GEC-1 | Vulnerability checks on the kernel, BusyBox and TLS libraries, the SBOM and known exploited vulnerabilities | Partly | Partly |
| 5.3-9, 5.3-10 Updates verified | R, M | SUM-1, SUM-2 | Updates verified by signature, integrity check before installing, unsigned updates rejected | Partly | SUM-2 automatic |
| 5.3-13 Support period published | M | None in part 1 | Your declared support period | Product data | Not mapped |
| 5.4-1 Secure storage | M | SSM-1, SSM-3 | Strong password hash, no clear text credentials in configuration | Automatic | Partly |
| 5.4-3, 5.4-4 No hard-coded critical parameters, unique keys | M | CCK-1 to CCK-3 | No private keys in the image, RSA keys of at least 2048 bits | Automatic | Partly |
| 5.5-1 Best practice cryptography | M | SCM-1 to SCM-3, CRY-1 | TLS 1.2 or later, no SSL 2 or 3, valid certificates, no MD5, SHA-1, DES, RC4 or ECB | Automatic | Partly |
| 5.6-1, 5.6-5 Unused interfaces off, needed services only | M, R | GEC-2 | Telnet and FTP off, only needed network services | Automatic | Partly |
| 5.6-4A Debug interfaces protected | M | GEC-5 | No shell on the serial console, no debug tools | Automatic | Partly |
| 5.6-7 Least privilege | R | ACM-2 | Web server not running as root, only root has user id 0 | Automatic | Partly |
| 5.13-1A, 5.13-1B Input validated | M | GEC-6 | Command, script and path injection checks on scripts and the web interface | Automatic | Partly |
Why is a provision automatic on one side and only partly on the other? In the requirement list we work from, many EN 18031 requirements apply wherever an asset needs the mechanism. An image cannot tell us which assets you declared, so the checks give part of the evidence and your documentation gives the rest.
What firmware cannot answer
Some requirements are about behaviour on a live network or about your own paperwork. No analysis of a file can settle them.
- Live behaviour: replay protection (SCM-4), resilience against denial of service (RLM-1 and ETSI 5.9), network monitoring (NMM-1) and traffic control (TCM-1).
- Documents: a list of exposed interfaces (GEC-4), configurable optional services (GEC-3) and the user guidance ETSI asks for in 5.12.
- People and process: acting on reports in time (5.2-2), shipping timely updates (5.3-8) and managing keys securely in the factory (5.5-8).
- Privacy: ETSI clause 6 on consent and telemetry, and the deletion and user notification mechanisms of EN 18031-2.
Where they differ
The overlap is large, but five differences change the work you plan.
- Legal role: ETSI is voluntary, while EN 18031 gives a presumption of conformity with a law, within the restrictions above.
- Scope: ETSI covers consumer devices only, while EN 18031 also covers professional radio equipment, and part 2 reaches toys, childcare equipment and wearables.
- Vulnerability handling: ETSI requires a published disclosure policy (5.2-1) and a published support period (5.3-13). We find no counterpart in the EN 18031-1 list we work from, and the CRA's Annex I Part II brings both back.
- Secure boot: ETSI recommends it in 5.7-1, but our EN 18031 mapping has no direct counterpart, and integrity checking at boot only feeds secure storage.
- Lifetime: EN 18031 stops being needed for the radio rules on 11 December 2027, while ETSI stays a reference and TEC 31318 builds on it.
One evidence base, two assessments
Keep one set of evidence and assess each standard against it rather than running two projects, using four habits.
- Write the asset and interface list first: EN 18031 depends on it, and it also answers ETSI 5.6 on attack surface and 5.8-3 on documented sensing.
- Analyse every release, not only the one you submit: a new BusyBox or OpenSSL version changes the answer to GEC-1 and to ETSI 5.2-3.
- Record your ETSI justifications as you go: provision 5.0-1 asks for one for each recommendation you do not meet.
- Design passwords out of the restricted option: a password the user must set at first setup meets ETSI 5.1-1 and stays clear of the restricted option.
How FDIE shows both, and its limits
One analysis of a release fills both frameworks, and each provision shows the device checks and findings behind it.
| Framework | Provisions | Decided by checks | Checks help | Product data | Your evidence |
|---|---|---|---|---|---|
| ETSI EN 303 645 | 78 | 14 | 11 | 1 | 52 |
| EN 18031-1 | 31 | 1 | 21 | 0 | 9 |
| EN 18031-2 | 11 | 0 | 8 | 0 | 3 |
| EN 18031-3 | 9 | 0 | 8 | 0 | 1 |
EN 18031-3 shows as not applicable unless the product has payment features. We are also plain about two limits in this mapping.
- The EN 18031 text. It is sold through national standards bodies, and we could not read it for our catalogue. Requirement identifiers follow public summaries, and the app tags each one "Clause to be confirmed".
- Runtime checks. ETSI 5.13-1 also maps to two runtime checks, which stay unassessed until running firmware arrives in the app.
FDIE gives evidence and finds gaps, but it does not certify. A notified body or your own conformity assessment makes the decision. For the wider picture by market, see device security frameworks by market.
Questions
Does EN 303 645 compliance mean EN 18031 compliance?
No. They overlap on passwords, updates, storage, communication and attack surface, but EN 18031 is assessed per mechanism and per asset, and the Official Journal adds restrictions. Use one evidence base, then assess each standard on its own.
When do the Radio Equipment Directive security requirements apply?
From 1 August 2025, under Delegated Regulation (EU) 2022/30 as amended by Delegated Regulation (EU) 2023/2444. Delegated Regulation (EU) 2026/339 repeals them from 11 December 2027, when the Cyber Resilience Act applies in full.
What are the EN 18031 restrictions in the Official Journal?
No presumption of conformity if the user may choose not to set or use any password, or if toy or childcare equipment lacks parental or guardian control under EN 18031-2. The secure update assessment criteria of EN 18031-3 give none either, nor do the rationale and guidance sections.
Which EN 18031 part applies to a Wi-Fi camera?
EN 18031-1 for any radio equipment that talks to the internet, and EN 18031-2 because a camera processes personal data. EN 18031-3 applies only to equipment that lets users transfer money or virtual currency.
Sources
- ETSI EN 303 645 V3.1.3 (2024-09), Cyber Security for Consumer Internet of Things, Baseline Requirements (PDF) etsi.org
- ETSI TS 103 701 V2.1.1, conformance assessment of baseline requirements (PDF) etsi.org
- Directive 2014/53/EU, the Radio Equipment Directive (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2022/30 (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2023/2444, application from 1 August 2025 (EUR-Lex) eur-lex.europa.eu
- Commission Implementing Decision (EU) 2025/138 citing EN 18031-1, -2 and -3 with restrictions (EUR-Lex) eur-lex.europa.eu
- Commission Delegated Regulation (EU) 2026/339 repealing Delegated Regulation (EU) 2022/30 (EUR-Lex) eur-lex.europa.eu
- Regulation (EU) 2024/2847, the Cyber Resilience Act (EUR-Lex) eur-lex.europa.eu
Product and project names are trademarks of their owners, used only to identify the public firmware, software and standards discussed. MAGDOX is not affiliated with or endorsed by them.