EN 18031 Consulting for Radio Equipment Manufacturers
The RED Delegated Act has applied since August 1, 2025. Every radio device you have shipped since then that communicates over the internet needs cybersecurity evidence for its CE marking, including models that have been in your catalog for years. We bring your devices in line with EN 18031 and prepare the documents your customers, distributors and notified body ask for.
- Half a day per product tells you which parts of the standard apply
- Variants with the same architecture are assessed together
- Documentation in the format your notified body expects
- Fixed price per phase
Book an initial call
30 minutes, no obligation. Afterwards you know which parts of EN 18031 apply to your devices and whether you need a notified body.
Secuvise in numbers
An assessor's knowledge on your side
We built up the product security testing business at TÜV SÜD and tested radio equipment against EN 18031 there. Today we implement for manufacturers what assessors want to see.
Regulation and engineering
From applicability and changes to firmware and interfaces through to testing on the device, all from one team.
40+ manufacturers supported
Mostly in machinery, plant engineering and device manufacturing.
350+ compliant products
From audit, certification and implementation projects.
Case study: 12 Jungheinrich variants in seven months
Jungheinrich had to bring its entire portfolio of automated guided vehicles and mobile robots into EN 18031 compliance by August 1, 2025. The vehicles ran on several hardware and software platforms. We determined applicability for each vehicle, assessed vehicles with the same architecture together, ran the gap analyses across all mechanisms, supported engineering with the fixes, tested, built the SBOM and prepared the documentation for notified body review.
12 of 12 variants compliant
The whole portfolio, no variant left behind.
7 months
Project start in March 2025, deadline met.
0 non-conformities
With a method Jungheinrich can reuse for new products.
What our clients say
We faced the challenge of bringing our entire mobile robot portfolio into EN 18031 compliance under significant time pressure. Secuvise did not just provide advice, but actively supported us hands-on – from structured information gathering and gap analysis through to executing conformity testing. Without this pragmatic support, we would not have met our deadline.
For regulatory compliance of our products, we needed a partner who combines technical depth with practical implementability. Working with Secuvise was straightforward, and their solutions integrated well into our development process.
Secuvise has always supported us closely and reliably in developing our security concepts. The collaboration has been consistently constructive and collegial, exceeding our expectations. I look forward to continued partnership across all areas of cybersecurity.
Three phases to compliance
From applicability to the declaration of conformity
Each phase has a defined result and a fixed price. After the first phase you know what each device is missing, and then you decide how to proceed.
You decide how much of the work we take on in each phase: we review what your team produces, we work it out together with your team, or we produce it and your team supplies the information.
Applicability and gap analysis
For each product we determine which parts of EN 18031 apply and group variants that share an architecture. Then we go through interfaces, software and update paths and check them against the requirements. You get a gap list with actions for engineering and know whether you can self-declare or need a notified body.
Implementation and technical documentation
For each gap we work out an implementation concept with your engineers, for example for secure boot, signed updates or key management. The documentation is built in parallel: every requirement decided, justified and backed with evidence, in your notified body's format or in our template. You also get the test plan for your manufacturer tests.
Support through to compliance
Before submission we review the documents the way the notified body will. We answer its findings with you until the assessment is closed. Without a notified body, the phase ends with the completed declaration of conformity. At the end you receive a guide for updating the documentation yourself with every new release.
Add-on modules as needed
As the manufacturer, you run the EN 18031 tests; a notified body tests in addition where required. If you lack the people or the experience, our test team takes over.
Penetration test of the interfaces
We attack your device through every reachable interface: radio, network services, app, service and debug ports.
- Report with rated vulnerabilities
- Retest after remediation
Testing every requirement on the device
One test case for each applicable requirement, run on your device in our lab or via remote access.
- Results ready for the documentation
- Test scripts handed over to your team on request
Training for your engineers
The EN 18031 requirements explained on your own architecture, so your team can develop new products to the standard on its own.
- One day on site or two half days online
- In English or German
Why Secuvise
Implementation from an assessor's perspective
A notified body examines your device but is not allowed to advise you. Our team includes people who have tested radio equipment against EN 18031 themselves. Today we are on your side and prepare the evidence so that it passes the assessment.
Our EN 18031 and RED projects include work for Jungheinrich, Altice Labs, KHS, Kontron and Gutermann.
A proven method instead of busywork
We start from the interfaces and access paths, not from a long list of assets. That way you decide each requirement exactly once and find gaps early, while engineering can still react.
At home in embedded Linux and firmware
Yocto, secure boot, OTA updates, keys in an HSM, cellular gateways and NB-IoT sensors: we implement the changes with your engineers, with our own security engineers where needed.
Independent of the notified body
We work with the notified body of your choice, for example TÜV SÜD or KIWA, and know their templates and expectations from client projects.
Reusable for the CRA
We structure the evidence so you can reuse it for the Cyber Resilience Act from December 2027.
Fixed price per phase
You pay for the result, not for hours. We quote the price for implementation and support after the gap analysis, once the scope is clear.
Your contact
Markus Müller
Founder and managing director of Secuvise
Markus Müller built up and ran the product security testing business at TÜV SÜD in Germany and worked there as a certifier himself. At Secuvise he holds the initial calls and is responsible for the RED and CRA projects, which he delivers with a team of consultants, security engineers and testers. The team brings experience from testing, consulting and engineering, including at TÜV SÜD and the large audit firms.
- Built up and led the product security testing business at TÜV SÜD in Germany
- Certifier at TÜV SÜD
- Experience in industry, consulting and testing at Siemens, KPMG and TÜV SÜD
Why EN 18031 is landing on your desk now
The RED Delegated Act (Delegated Regulation (EU) 2022/30) turns cybersecurity into an essential requirement of the Radio Equipment Directive. From a wireless sensor to a gateway to an automated guided vehicle, it covers almost every device with Wi-Fi, Bluetooth, cellular or any other radio.
Mandatory since August 1, 2025
What counts is each individual unit you place on the market. If you keep shipping a proven model, you need the evidence just as you would for a new one.
Customers and distributors check too
Importers and distributors have to verify the CE marking and documents before they sell. That is why the request for EN 18031 evidence often comes from your customers' purchasing department first.
No standard, no self-declaration
If you do not apply EN 18031 in full, or if your device can be operated without a password, self-declaration is off the table. A notified body then has to examine the device.
Market surveillance can stop sales
Without the evidence, authorities can require corrective action, prohibit sales or order a recall.
What EN 18031 requires of your device
The standard has three parts, one for each of the three requirements in Article 3(3) of the Radio Equipment Directive. Which of them apply depends on what your device does. The assessment covers the device and all its interfaces, not your backend.
Part 1: Network protection
Applies to every radio device that communicates over the internet, either directly or through another device. That means Part 1 almost always applies.
Part 2: Personal data protection
Applies when the device processes personal, traffic or location data, and to toys, childcare equipment and wearables that handle such data.
Part 3: Fraud protection
Applies only if the device lets users transfer money, monetary value or virtual currency. For most industrial devices it drops out, but the justification still belongs in the file.
Interfaces and access paths
Every assessment starts with all of the device's interfaces, debug and service ports included, and the paths someone could take to reach its data and functions.
A decision for each requirement
Access control, authentication, updates, secure storage and communication, cryptography: for each mechanism, a decision tree leads to a result that you justify and back with evidence.
Evidence and declaration of conformity
Justifications, test results and evidence go into the technical documentation. On that basis you sign the declaration of conformity or submit to the notified body.
Frequently asked questions
Is our device covered by the RED Delegated Act?
Yes, if it is radio equipment and communicates over the internet, either directly or through another device. That includes devices whose internet connection runs through a gateway. Toys, childcare equipment and wearables that can process personal data are covered regardless of internet connectivity. Medical devices, among others, are excluded. We check your devices in the initial call.
Do we need a notified body?
Not necessarily. If you apply the harmonized EN 18031 in full, you declare conformity yourself. A notified body, such as TÜV SÜD or KIWA, has to examine the device if you apply the standard only in part, or if the device lets users choose not to set a password. That restriction is laid down in Implementing Decision (EU) 2025/138, which harmonized the standard. Some manufacturers also opt for a notified body voluntarily because their customers want to see a certificate.
We use a CE-marked radio module. Isn't that enough?
No. The radio equipment under the directive is your end device, and the assessment covers its interfaces, firmware, update paths and stored data. The module manufacturer's documents help with individual requirements, but they do not replace your own assessment.
How much does EN 18031 compliance cost?
Starting prices per product or product group, net of VAT:
- Applicability and gap analysis: from EUR 8,000
- Implementation through to technical documentation: from EUR 20,000
- Support through the notified body assessment: from EUR 5,000
- Testing by our team: from EUR 15,000
- Training for engineering: from EUR 2,500
How far above the starting price you end up depends on the number of interfaces and variants, and on how much of the work we take on. If we only review what your team produces, the price stays close to the starting figure. If we produce the documents ourselves, it goes up. We quote a fixed price for implementation and support after the gap analysis.
How long does it take to reach the declaration of conformity?
Which parts of the standard apply takes half a day per product to settle. How long implementation takes depends on how much has to change in firmware and interfaces and how quickly your engineering team ships releases. At Jungheinrich, 12 variants were compliant after seven months. With a notified body, add its review time and the rounds of findings.
Is EN 18031 still worth it when the CRA applies from December 2027?
Yes. Delegated Regulation (EU) 2026/339 repeals the RED Delegated Act as of December 11, 2027, but until then it applies unchanged. Devices you ship up to December 10, 2027 will still be measured against its requirements afterwards. From December 11, 2027 the Cyber Resilience Act takes over. The upcoming standard EN 40000-1-4 builds on EN 18031, so you can reuse a large part of the evidence.
Don't see your question?
In the initial call we clarify which parts of EN 18031 apply to your devices and which route to compliance fits.
Book an initial callHow far are your devices from EN 18031?
A clear plan in 30 minutes
We clarify which parts of the standard apply to your devices, whether you need a notified body and what is missing before you can declare conformity. You talk directly to our managing director, who knows assessments from the inside.
Book an initial call
We will get back to you within one business day to schedule it.