Tracker entry M13: Radio Equipment Directive: cybersecurity rules (EN 18031)
In force
EU
Next date
in 13 months
Cyber Resilience Act takes over these requirements
- Region
- EU
- Sector
- Readers and connected devices
- Imposed by
- European Commission
- Applies to
- Makers of internet-connected radio equipment, including networked RFID readers
- Technology
- Applies to reader hardware
What the rule requires
Networked RFID readers and other connected radio kit must meet network protection, privacy and fraud requirements to carry the CE mark. EN 18031 is the standard most makers test against.
Status: Applies since 1 Aug 2025
What it means for RFID
This rule governs reader hardware rather than tags. Since 1 August 2025, makers of internet-connected radio equipment sold in the EU, including networked RFID readers, have had to meet the cybersecurity requirements on network protection, privacy and fraud to carry the CE mark. EN 18031 is the standard most of them test against.
For reader manufacturers this is a design and conformity task built into the CE assessment of each connected product. Integrators and buyers specifying networked readers for EU sites can ask suppliers for evidence of EN 18031 testing.
The date to watch is 11 December 2027, when the Cyber Resilience Act takes over these requirements.
Timeline
- Cybersecurity requirements apply to internet-connected radio equipment
- Cyber Resilience Act takes over these requirements
Sources
Official source: EUR-Lex
Last checked against the official source on 29 October 2026.
Newsletter
Get deadline alerts for this and every other RFID mandate
Every Thursday the RFID News weekly digest lists the deadlines coming up from the mandates tracker, alongside the week's deployments and launches.
Related rules
All 65 rules on the mandates tracker This rule in the tracker
Seen a change to this rule, or something we have wrong? Tell the newsroom
