Compliance 📅 October 22, 2026 ⏱ 12 min read

RED Cybersecurity for Networked UHF RFID Readers: EN 18031, the 2025–2027 Window and the CRA Hand-over

Timeline of EU cybersecurity rules for networked UHF RFID readers, from EN 18031 under the Radio Equipment Directive in August 2025 to the Cyber Resilience Act in December 2027

An EU enquiry for a networked fixed reader now carries two compliance questions. One is spectrum, under Article 3(2) of the Radio Equipment Directive. The other arrived on 1 August 2025, when Commission Delegated Regulation (EU) 2022/30 switched on the RED’s cybersecurity requirements in Article 3(3)(d), (e) and (f) — network protection, personal data and privacy, and protection from fraud. The harmonised route is the EN 18031:2024 series, cited in the Official Journal with restrictions.

That regime now has an end date: Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027, when the Cyber Resilience Act applies. Below, from the reader’s side: which configurations are caught, what EN 18031 examines, when a notified body is needed, and how one model answers to two regimes depending on when each unit ships. Every date is taken from the face of the document that sets it.

What the delegated act covers, in its own words

Article 1 of Delegated Regulation (EU) 2022/30 has three paragraphs, each switching on one requirement for a defined class of equipment.

Article 1(1), point (d), network. Any radio equipment that can communicate itself over the internet, directly or via any other equipment: “internet-connected radio equipment”.
Article 1(2), point (e), privacy. Internet-connected equipment, childcare equipment, radio toys and wearables, where capable of processing personal data, or traffic data or location data. The “or” is corrected wording from Article 2 of Delegated Regulation (EU) 2023/2444; the original read “and”.
Article 1(3), point (f), fraud. Internet-connected equipment that enables the holder or user to transfer money, monetary value or virtual currency.

Reader configuration	(d)	(e)	(f)
Networked fixed reader counting stock, cartons or pallets	Applies	Manufacturer’s risk-assessment call	Outside Art. 1(3)
Reader identifying people: attendance, access control, patient or delegate tracking	Applies	Applies where capable of processing personal data	Outside Art. 1(3)
Internet-connected top-up or payment terminal with a reader	Applies	Applies where capable of processing personal data	Applies where users transfer money, monetary value or virtual currency

Article 2 leaves sector law in charge. Equipment also under the medical device Regulations (EU) 2017/745 or 2017/746 is outside all three points. Equipment also under civil aviation Regulation (EU) 2018/1139, vehicle type-approval Regulation (EU) 2019/2144 or road-toll Directive (EU) 2019/520 is outside (e) and (f) only, so radio equipment within that tolling Directive still answers to (d).

The 28-month window: a dated timeline

The requirements cover units placed on the EU market from 1 August 2025 to 10 December 2027, a little over 28 months; recital 5 of 2026/339 keeps exactly those units under market surveillance after the repeal.

Date	Event
29 October 2021	2022/30 adopted; published 12.1.2022 (OJ L 7, p. 6); in force on the twentieth day, 1 February 2022
5 August 2022	Standardisation request C(2022) 5637, known as M/585, sent to CEN and CENELEC
20 July 2023	2023/2444 adopted, published and in force 27.10.2023: application moved from 1 August 2024 to 1 August 2025 after CEN and CENELEC asked for at least nine more months
28 January 2025	Implementing Decision (EU) 2025/138 adopted; published and in force 30.1.2025, citing EN 18031-1, -2 and -3:2024 with restrictions
1 August 2025	Article 3(3)(d), (e) and (f) apply
16 February 2026	2026/339 adopted; published 29.4.2026 after a two-month scrutiny period; in force on the twentieth day, 19 May 2026
11 September 2026	Cyber Resilience Act Article 14 reporting applies (CRA Art. 71(2))
11 December 2027	2022/30 repealed (2026/339 Art. 1); the CRA applies
11 June 2028	Validity ends for cybersecurity EU type-examination certificates issued under other harmonisation legislation, unless they expire earlier (CRA Art. 69(1))

Four corrections for your own files

1 August 2024 is the date in 2022/30 as first published; a DoC template or lab page still quoting it reflects the text before 2023/2444 amended it.
30 January 2025, not 28. 2025/138 is dated 28 January, but recital 12 ties presumption of conformity to publication, which was 30.1.2025.
2025/138 is the number. “2025/1385” circulates in secondary documents, including version 2.0 of NIST’s RED notified-body checklist.
2026/339 repeals the delegated act alone. RED Article 3(1) safety and EMC and Article 3(2) spectrum apply to every reader before and after 11 December 2027.

Does RED cybersecurity apply to my reader?

“Internet-connected” is the gate for (d) and (f), and the usual route into (e). The Commission’s Guide to the RED (2026 edition, file labelled version 07.07.2026) illustrates it in section 12.1 with seven cases, and the test in each is the protocol: does the equipment operate one, open or proprietary, that allows communication over the internet, directly or through intermediate equipment? The Guide leaves the case-by-case assessment with the manufacturer and is not legally binding.

Reader configuration	Closest case	Internet-connected?
Fixed reader on Ethernet to a site switch or router	Case 1: wired, via intermediate equipment	Yes, indirectly: point (d)
Fixed reader on Wi-Fi	Case 2: wireless, via intermediate equipment	Yes, indirectly: point (d)
Reader with its own 4G modem	Case 3	Yes, directly: point (d)
Android handheld on Wi-Fi or 4G	Case 2 or 3	Yes: point (d). Section 1.7.2 places equipment used solely in the hand outside “wearable”
Reader whose only host link is Wiegand or RS-485	Cases 4 and 5: no internet-ready protocol	No, on the Guide’s test; the manufacturer’s risk assessment must determine it cannot reach, or be reached from, the internet
UHF module on a serial link, permanently built into a kiosk whose controller has Ethernet	Case 7	The combined product: yes
Non-radio gate controller fitted with a Wi-Fi or cellular module	Case 6	The combined product: yes

Three notes from the bench. RED Article 17(1) requires assessment in every configuration the equipment can take, so a Wiegand reader with an Ethernet port a menu can enable is assessed with that port live; wiring for those readers is in our Wiegand and RS-485 integration guide. A radio part and a non-radio product count as one product only when the radio is incorporated and permanently affixed (section 1.7.4.1), so a reader on a bracket beside a turnstile stays its own product. And section 1.7.4.15 confirms that RFID tags are radio equipment, with the tag manufacturer responsible for compliance.

EN 18031 in the Official Journal: rows 164–166

Implementing Decision (EU) 2025/138 added three rows to Annex I of Implementing Decision (EU) 2022/2191, the single list of harmonised standards under the RED.

Row	Standard	Supports	Notices
164	EN 18031-1:2024, Part 1: internet connected radio equipment	Art. 3(3)(d)	1, 2
165	EN 18031-2:2024, Part 2: radio equipment processing data	Art. 3(3)(e)	1, 2, 3
166	EN 18031-3:2024, Part 3: internet connected radio equipment processing virtual money or monetary value	Art. 3(3)(f)	1, 2, 3

Notice 1, all parts. The “rationale” and “guidance” sections confer no presumption; recital 5 notes they justify and illustrate rather than specify.
Notice 2, all parts. Clauses 6.2.5.1 and 6.2.5.2, on default passwords, leave an option to let the user set and use no password. A product that takes it gets no presumption (recital 6).
Notice 3, EN 18031-2. Covers parental or guardian access control for toys and childcare equipment (clauses 6.1.3 to 6.1.6).
Notice 3, EN 18031-3. The clause 6.3.2.4 secure-update criteria confer no presumption at all; recital 8 judges no single listed method sufficient on its own for financial assets.

Status as of October 2026: four later decisions amend 2022/2191, (EU) 2025/893, 2025/1741, 2025/2499 and 2026/2003, covering short range devices, satellite systems, radar and other families. None touches rows 164 to 166, so the citations and notices stand as published on 30.1.2025. Estonia’s national adoption, EVS-EN 18031-1:2024, is listed as valid from 02.09.2024.

What an assessment examines on a networked reader

M/585, Annex I item 2.1, lists six outcomes a point (d) standard must ensure. The table maps each to the EN 18031 mechanism families named in NIST’s notified-body checklist, then to a UHF reader. The mapping is ours; the standard’s paid text decides which requirement applies where, so none is quoted.

M/585 item 2.1	Mechanisms	On a UHF reader	Technical-file evidence
(a) Monitor and control network traffic, including outgoing data	NMM, TCM	Tag-report pushes (HTTP, MQTT or TCP), time sync, name lookup, update checks; destinations set by the administrator	Outbound-flow list: protocol, port, destination, trigger
(b) Mitigate the effects of ongoing denial-of-service attacks	RLM	The LAN port takes flood or malformed traffic and the reader keeps, or regains, its RF inventory	Resilience test on the shipped configuration
(c) Authentication and access control	ACM, AUM	Administrator password set at first use, before the web UI, host command port or service console accept changes	First-boot flow; per-interface authentication table
(d) On a risk basis, up-to-date software and hardware with no publicly known exploitable vulnerabilities when placed on the market	GEC	Kernel, TLS library, web server and third-party components checked at release	Component list with versions; dated vulnerability scan
(e) Automated, secure software updates	SUM, CRY, SSM	Firmware images signed by the manufacturer and verified on the reader before installation	Update architecture; tampered-image rejection test
(f) Protect exposed attack surfaces; minimise impact	GEC, SCM, SSM, CRY	Only needed services listening by default; encrypted sessions; credentials in protected storage	Port scan of the shipped configuration against the documented services list

Key: ACM access control, AUM authentication, SUM secure update, SSM secure storage, SCM secure communication, RLM resilience, NMM network monitoring, TCM traffic control, GEC general equipment capabilities, CRY cryptography. Where edge middleware runs on the reader itself, as our ReaderSense does, its endpoints and data-push targets join the web UI in one services inventory.

A notified body reads more than test results. Module B of RED Annex III requires an adequate analysis and assessment of the risks, which NIST’s checklist (version 2.0, 25 September 2025) expects notified bodies to review at the granularity of M/585 items 2.1 to 2.3. Annex V adds the firmware versions affecting compliance, so the file names the build the evidence came from.

Self-declaration or notified body

The route follows RED Article 17, one essential requirement at a time. Under Article 17(3), a manufacturer that applied OJ-listed harmonised standards may use internal production control (Annex II, Module A), EU-type examination with conformity to type (Annex III, Modules B and C) or full quality assurance (Annex IV, Module H). Under Article 17(4), standards not applied, applied in part, or absent send that requirement to Annex III or IV, both with a notified body. Section 7.1 of the RED Guide adds that a restricted citation needs a notified body when the restriction leaves an aspect uncovered, and none when the manufacturer is certain it does not apply; each point of Article 3(3) is a separate aspect.

Internet-connected? If the documented risk assessment says no, as in the Wiegand-only case, point (d) is not triggered; the reasoning goes in the technical file.
Password always enforced? If a password must be set before any configurable interface accepts changes, Notice 2 is designed out, EN 18031-1 can be applied in full, and Module A stays open for point (d).
Personal data? Add EN 18031-2 for point (e), with the same Notice 2 logic.
Payments? Within Article 1(3), EN 18031-3 covers point (f), and its Notice 3 removes the presumption for the clause 6.3.2.4 secure-update criteria in every case. Our reading of Article 17(4) with section 7.1: point (f) then goes to a notified body under Modules B and C or Module H, while (d) and (e) can still be self-declared.

The mirror case: a product that lets the user skip the password sits outside the Notice 2 presumption, so the manufacturer changes the first-boot flow or takes the notified-body route for that aspect.

When (e) and (f) also apply

Point (e) turns on capability. Commission Recommendation 2009/387/EC framed the RFID version in recital 5: RFID applications can process personal data on the tag, or data connecting a specific RFID item number to personal data stored elsewhere, and could be used to monitor people through the tagged items they carry. That describes the read points behind attendance and access control, school-bus boarding, patient tracking and delegate tracking.

EN 18031-2 adds three mechanism families for them, matching M/585 item 2.2: logging (LGM) of internal activity affecting data protection, item (f); deletion (DLM) of stored personal data before disposal or replacement, item (g); and user notification (UNM) of changes affecting data protection, item (e). On a reader that buffers reads through a network outage, deletion covers that buffer and its timestamps too.

Whether a reader that only forwards EPCs is “capable of processing” personal data is the manufacturer’s call, made in its documented risk assessment. A dock-door reader counting cartons and the same hardware reading staff badges at a gate can land on different sides of that line.

Point (f) turns on what the user can do. Article 1(3)’s cross-reference to Article 2(d) of Directive (EU) 2019/713 lands on the definition of virtual currency: a digital representation of value, not issued or guaranteed by a central bank or public authority, accepted as a means of exchange and transferable, storable and tradable electronically. An internet-connected top-up kiosk in a cashless payment system is the obvious candidate; a closed-loop event or campus wallet is assessed against Article 1(3) case by case, with the reasoning on file.

Unit by unit: three shipments of one reader model

Section 2.3 of the Blue Guide 2022 decides this: placing on the market refers to each individual product, not to a type, and units placed after new requirements become applicable must meet them even if the model was supplied before. Section 1.3 of the RED Guide applies the same rule to radio equipment. Take one networked fixed reader model, one design, three units:

Unit	Placed on the market	Cybersecurity basis	What follows
A	September 2025	RED Art. 3(3)(d)–(f) via 2022/30	EN 18031 presumption within its restrictions; RED market surveillance continues after the repeal (2026/339, recital 5)
B	October 2026	RED Art. 3(3)(d)–(f) via 2022/30	As Unit A; 2026/339 is in force, with the repeal taking effect on 11 December 2027
C	January 2028	CRA, Regulation (EU) 2024/2847	RED Guide section 10.9.4: units placed on or after 11 December 2027 answer to the CRA for cybersecurity, without prejudice to CRA Article 69

All three stay under the RED for safety, EMC and spectrum; only the cybersecurity basis moves. Two transition details reach the paperwork. CRA Article 69(1) keeps cybersecurity EU type-examination certificates issued under other harmonisation legislation valid until 11 June 2028, unless they expire earlier; on our reading a RED certificate for Article 3(3)(d)–(f) is one, and its use after 11 December 2027 should be checked against the Commission’s CRA guidance. CRA Article 69(3) extends Article 14 reporting to in-scope products placed before 11 December 2027, so reporting reaches Unit A from 11 September 2026 and Unit B from its placing in October 2026. The obligations themselves are in our Cyber Resilience Act guide for RFID readers.

What to ask a reader supplier

The EU declaration of conformity. RED Annex VI item 6 lists standards by number and version: look for EN 18031-1:2024, plus -2 and -3 where (e) and (f) apply, and ask which OJ citation the presumption rests on (2025/138).
Notified-body details, where used: body, number and certificate (Annex VI item 7), and which of (d), (e) and (f) it covers.
First-boot password behaviour on every configurable interface.
Firmware signing: how an image is verified and what happens to a tampered one.
The exposed-services list for the shipped configuration, on-reader middleware included.
A risk-assessment summary showing which of (d), (e) and (f) were applied and why.
The firmware version the declaration covers.
A plan for units placed from 11 December 2027, with CRA documentation written into the contract.

Tender-ready clauses are in our UHF RFID tender specification template, and support-window terms in the reader supplier continuity checklist. Because we design the reader hardware and write its firmware in-house, these questions go straight to the engineers who wrote the first-boot flow, the update path and the service list.

Frequently asked questions

Does EN 18031 apply to RFID readers?

Yes, as the harmonised route for readers within Delegated Regulation (EU) 2022/30. A reader linked over Ethernet, Wi-Fi or 4G is internet-connected on the RED Guide’s section 12.1 cases, so point (d) applies and EN 18031-1:2024 is the matching standard. EN 18031-2:2024 adds personal data; EN 18031-3:2024 adds money transfer.

When did the RED cybersecurity requirements become mandatory?

1 August 2025. Delegated Regulation (EU) 2022/30 first set 1 August 2024; Delegated Regulation (EU) 2023/2444 moved it at CEN and CENELEC’s request. The requirements cover units placed on the EU market up to 10 December 2027.

Is EN 18031 a harmonised standard?

Yes. Implementing Decision (EU) 2025/138, published on 30.1.2025, cited EN 18031-1, -2 and -3:2024 as rows 164 to 166 of Annex I to Implementing Decision (EU) 2022/2191, each with restrictions, including no presumption where the user may set and use no password.

Do I need a notified body for EN 18031?

With the cited standards applied in full and no restriction applying, for example a password enforced at first use, RED Article 17(3) allows self-declaration under Module A. Partial application or an uncovered restriction leads to Modules B and C or Module H. On our reading, EN 18031-3’s Notice 3 on secure updates sends point (f) to a notified body.

What happens to RED cybersecurity after the Cyber Resilience Act applies?

Delegated Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027. Units placed from that date answer to Regulation (EU) 2024/2847; units placed from 1 August 2025 to 10 December 2027 stay under RED market surveillance. CRA Article 14 reporting has applied since 11 September 2026, earlier in-scope products included.

Does a Wiegand-only RFID reader need EN 18031?

A reader whose only host link is Wiegand or RS-485 operates no internet-ready protocol, so on the RED Guide’s cases it is not internet-connected. The manufacturer’s risk assessment must confirm it cannot reach or be reached from the internet, and Article 17(1) requires every configuration the model can take to be assessed.

Does an RFID cashless payment terminal fall under EN 18031-3?

If it is internet-connected and lets the holder or user transfer money, monetary value or virtual currency, Article 1(3) applies point (f) and EN 18031-3:2024 is the harmonised standard. On our reading, the secure-update aspect then needs a notified body. Closed-loop wallets are assessed case by case.