Vigilon RED Cybersecurity Testing
Test radio products against the cybersecurity requirements of the EU Radio Equipment Directive (RED) using the EN 18031 harmonised standards, and build the evidence your technical documentation needs.
Which products are affected?
Delegated Regulation (EU) 2022/30 makes three RED cybersecurity requirements apply from 1 August 2025 to certain categories of radio equipment:
- Article 3(3)(d), network protection: radio equipment that can communicate over the internet, directly or through other equipment.
- Article 3(3)(e), personal data and privacy: internet-connected radio equipment, childcare radio equipment, toys and wearables that can process personal, traffic or location data.
- Article 3(3)(f), protection from fraud: internet-connected radio equipment that lets users transfer money, monetary value or virtual currency.
There are exclusions. For example, the requirements don’t apply to radio equipment also covered by the EU medical device regulations, and (e) and (f) don’t apply to equipment covered by certain vehicle, civil aviation and road toll rules.
These are cybersecurity requirements only. Radio products still need to meet the RED’s other requirements, such as safety, electromagnetic compatibility and radio spectrum use.
Changes from 11 December 2027
Delegated Regulation (EU) 2026/339 repeals these RED cybersecurity requirements from 11 December 2027, when the Cyber Resilience Act (CRA) applies in full. From that date, the CRA’s cybersecurity requirements apply to products within its scope. Compliance of radio equipment placed on the market between 1 August 2025 and 10 December 2027 can still be checked under the RED. About CRA readiness.
EN 18031 and presumption of conformity
EN 18031-1, -2 and -3 are the harmonised standards for Article 3(3)(d), (e) and (f). Their references were published in the Official Journal in January 2025 with restrictions. For example, they don’t give a presumption of conformity where users can choose not to set or use any password, and the secure-update assessment criteria in EN 18031-3 don’t give a presumption of conformity for Article 3(3)(f).
Self-declaration or Notified Body?
Where the harmonised standards are applied in full, manufacturers can use internal production control (module A) and self-declare conformity. Where they aren’t applied, are applied only in part, or don’t exist, a Notified Body procedure — EU-type examination followed by conformity to type (modules B and C), or full quality assurance (module H) — is required for the requirements concerned.
Our RED testing services
Gap analysis
We review your product design, architecture and existing security measures against EN 18031. You receive a gap report identifying non-conformities, with remediation guidance ranked by priority.
Compliance testing
We perform the evaluation methodology specified in EN 18031, including functional testing, security mechanism verification, documentation review and evidence gathering for your technical file.
Technical file preparation
We help you compile the technical documentation required under the RED, including the cybersecurity risk assessment, test reports and evidence of conformity, which must be kept for 10 years after the product is placed on the market.
Notified Body preparation
If you need a Notified Body assessment, we prepare you for it — pre-testing your product, reviewing your documentation and addressing potential non-conformities before the formal assessment.
Engagement options
See how RED testing engagements are typically structured on our packages page, or request a quote for your product.
Related
- CRA readiness & technical documentation
- Risk assessment & threat modelling
- Penetration testing
- The Complete Guide to EN 18031-1 Compliance
Sources: Directive 2014/53/EU, Articles 3, 10 and 17; Delegated Regulation (EU) 2022/30, as amended; Implementing Decision (EU) 2025/138; Delegated Regulation (EU) 2026/339. Checked 13 September 2026.