Cybersecurity Certification Service for EU RED Directive

Background Introduction

On January 12, 2022, the European Union issued Implementing RegULation (EU) 2022/30, mandating compliance with Article 3.3(d), (e) and (f) of the RED Directive. This regulation requires wireless devices sold on the EU market to meet the requirements of cybersecurity, personal data privacy and fraud protection. The regulation will be enforced across EU member states starting from August 1, 2025.

Regulatory Provisions

3.3(d)：Radio equipment shall not impair the network or its functions, nor shall it abuse network resources, leading to unacceptable degradation of services.

3.3(e)：Radio equipment shall incorporate protective measures to ensure that the personal data and privacy of users, as well as those of subscribers, are protected.

3.3(f)：Radio equipment shall support specific functions to ensure fraud prevention.

Testing Standards

(1) en 18031-1

General Security Requirements for Radio Equipment - Part 1: Internet-Connected Radio Equipment (corresponding to Article 3.3(d))

(2) EN 18031-2

General Security Requirements for Radio Equipment - Part 2: Radio Equipment Processing Data, i.e., Internet-Connected Radio Equipment, Children's Radio Equipment, Toy Radio Equipment and Wearable Radio Equipment (corresponding to Article 3.3(e))

(3) EN 18031-3

General Security Requirements for Radio Equipment - Part 3: Internet-Connected Radio Equipment Processing Virtual Currencies or Monetary Value (corresponding to Article 3.3(f))

Applicable Products

Applicable products cover most internet-accessible wireless terminal devices, including routers, smart cameras, walkie-talkies, smart door locks, smart home appliances, wearable devices and apparel, smartphones, tablets, toys and child monitoring devices, etc.

Certification Process

(1) Asset Identification

Classify assets into four categories: security, network, privacy and finance.

(2) Document Preparation

Prepare technical design documents, asset identification lists and the basis for the implementation of security mechanisms.

(3) Conceptual Evaluation

Examine the logic and compliance of submitted documents.

(4) Test Execution

Conduct comprehensive testing in accordance with standard requirements.

(5) Certification Issuance

Submit test results and obtain the accredited certificate upon passing all tests.