EU RED cybersecurity for connected chargers: EN 18031 now, the Cyber Resilience Act next
Since 1 August 2025, connected radio equipment sold in the EU must meet RED cybersecurity requirements. What applies to EV chargers, where EN 18031 falls short, and how the rules change in 2027.
- 01Since 1 August 2025, internet-connected radio equipment in the EU must meet RED Article 3(3)(d), (e) and (f).
- 02A charger with Wi-Fi, cellular or other radio that connects to the internet is in scope.
- 03EN 18031-1/-2/-3 were cited on 30 January 2025, with restrictions that can remove the self-declaration route.
- 04If users may skip setting a password, the standard gives no presumption of conformity and a notified body is needed.
- 05Delegated Regulation 2026/339 repeals these rules from 11 December 2027, when the Cyber Resilience Act fully applies.
What changed on 1 August 2025
Delegated Regulation (EU) 2022/30 switched on three cybersecurity requirements of the Radio Equipment Directive (RED). It was due to apply from 1 August 2024; Delegated Regulation (EU) 2023/2444 moved the date to 1 August 2025. Every product in scope placed on the EU market from that date must comply.
| Requirement | Protects | Applies to |
|---|---|---|
| Article 3(3)(d) | The network | Radio equipment that can communicate over the internet, directly or via other equipment |
| Article 3(3)(e) | Personal data and privacy | Internet-connected equipment that processes personal or traffic and location data, plus childcare equipment, toys and wearables |
| Article 3(3)(f) | Against fraud | Internet-connected equipment that lets the user transfer money, monetary value or virtual currency |
Does it apply to my charger?
The test is radio plus internet. A charger with Wi-Fi or a cellular modem that talks to a back office is in scope for (d). If it also handles user accounts, card IDs or session data linked to a person, (e) is likely to apply. If the user can pay through the charger, (f) is likely to apply.
A charger with no radio at all, connected only by cable, is not radio equipment and falls outside the RED. Confirm the classification product by product.
EN 18031: cited with restrictions
The Commission cited EN 18031-1, EN 18031-2 and EN 18031-3:2024 in the Official Journal on 30 January 2025 (Implementing Decision (EU) 2025/138), with notices that limit the presumption of conformity:
| Standard | Notice |
|---|---|
| All three | The “rationale” and “guidance” parts give no presumption of conformity |
| All three | No presumption if the user is allowed not to set and use any password |
| EN 18031-2 | No presumption for covered equipment if parental or guardian access control is not ensured |
| EN 18031-3 | No presumption for the assessment criteria on secure updates (clause 6.3.2.4) |
This matters for the conformity route. A manufacturer can self-declare only by applying a cited harmonised standard in full. Where a restriction applies, or the standard is not fully applied, a notified body must be involved.
The next change: the Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847) covers products with digital elements more broadly:
| Date | What happens |
|---|---|
| 11 September 2026 | CRA reporting obligations apply: actively exploited vulnerabilities and severe incidents must be reported |
| 11 December 2027 | CRA requirements apply in full |
| 11 December 2027 | Delegated Regulation 2022/30 is repealed (Delegated Regulation (EU) 2026/339) |
Products placed on the market between 1 August 2025 and 10 December 2027 stay subject to the RED requirements for market surveillance.
What to do now
- Remove the no-password option. Unique credentials or forced password setting avoid the EN 18031 restriction.
- Document secure updates. Firmware update integrity and authenticity need their own evidence.
- Build once for 2027. Risk assessment, vulnerability handling and update policy written for EN 18031 can carry into the CRA.
We help charger manufacturers plan the CE route for the EU, together with EMC and safety testing in our partner laboratory network.
FAQ
Is an EV charger with Wi-Fi covered?
Yes, if it can communicate over the internet. Article 3(3)(d) applies; (e) and (f) depend on whether it processes personal data or lets users pay.
Can I self-declare with EN 18031?
Only by applying the cited standards in full and avoiding the restrictions, for example by not letting users skip passwords. Otherwise a notified body is needed.
What happens in December 2027?
The Cyber Resilience Act applies in full and Delegated Regulation 2022/30 is repealed from 11 December 2027.
Sources
- Commission Delegated Regulation (EU) 2022/30 — EUR-Lex
- Commission Delegated Regulation (EU) 2023/2444 (application date moved to 1 August 2025) — EUR-Lex
- Commission Implementing Decision (EU) 2025/138 (EN 18031 citation and restrictions) — EUR-Lex
- Commission Delegated Regulation (EU) 2026/339 (repeal of 2022/30) — EUR-Lex
- McCann FitzGerald: Cyber Resilience Act reporting obligations apply from 11 September 2026
CertificationEU CE & TÜV Marks 
