EU RED Cybersecurity & EN 18031 (2026): The UAE Connected-Device Checklist

Short answer: since 1 August 2025, every internet-connectable radio product placed on the EU market has had to meet the cybersecurity requirements in Article 3(3)(d), (e) and (f) of the Radio Equipment Directive, made binding by Delegated Regulation (EU) 2022/30. If your device has Wi-Fi, Bluetooth or a cellular module and a UAE address on the carton, you need an EN 18031 conformity file. And if one specific checkbox in that file goes the wrong way, you lose the right to self-declare and a notified body has to sign off instead. On 11 December 2027 the Cyber Resilience Act absorbs the whole regime, so everything you build now has to survive that handover too.

The enforcement numbers most UAE exporters have not seen

This is the part Dubai manufacturers tend to discover late. Germany’s Bundesnetzagentur published its 2025 market-surveillance results on 5 February 2026, and it is the clearest picture anyone has of how radio equipment is actually policed in Europe:

• 7.7 million individual items were found with deficiencies across the year’s checks.
• Online surveillance alone identified 1,266 non-compliant equipment types, covering more than five million items.
• Retail checks covered nearly 2,100 equipment types — 58% were non-compliant, roughly 1.9 million items.
• Working with customs, the regulator examined 8,202 suspicious consignments, up from 5,005 in 2024. About 89% were non-compliant and over 359,000 items were stopped at the border.

Read that last line again, because it is the one that matters commercially. The failure point is not a court case years later. It is a container that does not clear customs, with your buyer’s retail launch date attached to it. The same report also flagged smartwatches falsely advertising blood-glucose monitoring and solar storage inverters exceeding interference limits — both categories UAE trading companies move in volume.

Meanwhile the UAE is actively pushing firms into exactly this product space. Under Operation 300bn, the Ministry of Industry and Advanced Technology is targeting a rise in industrial contribution to GDP from AED 133 billion to AED 300 billion by 2031, and Emirates Development Bank’s AED 30 billion financing programme names electrical equipment and electronics as a priority sector. On the demand side, IMARC puts the UAE IoT market at USD 5.11 billion in 2024, growing to USD 17.48 billion by 2033 (13.08% CAGR). More UAE-built connected hardware is coming. Most of it will be sold into Europe by someone who has never read EN 18031.

Which of your products are actually in scope

The delegated regulation switched on three separate requirements, and they catch different things:

• Article 3(3)(d) — network protection. Any radio equipment that can communicate over the internet, directly or through another device. Smart-home controllers, routers, IoT sensors, smart TVs, voice assistants, gateways.
• Article 3(3)(e) — personal data and privacy. Radio equipment that processes personal, traffic or location data: wearables, fitness trackers, smartwatches. Also radio equipment designed for childcare or as toys for children under 14 — baby monitors, connected learning toys, kids’ smartwatches.
• Article 3(3)(f) — protection from fraud. Equipment that handles money, monetary value or virtual currency: payment terminals with a radio interface, contactless payment devices, hardware wallets.

Exemptions are narrower than people assume. Medical devices under Regulation (EU) 2017/745 and in-vitro diagnostics under (EU) 2017/746 are carved out. Article 2 excludes certain aviation, motor-vehicle and electronic road-toll equipment — but only from the privacy and fraud requirements, not from network protection. Everything else in the list above is in.

The three standards and what they map to

Commission Implementing Decision (EU) 2025/138 of 28 January 2025 cited the harmonised standards in the Official Journal, applicable from the same 1 August 2025 date. The mapping is one-to-one: EN 18031-1:2024 covers network protection, 3(3)(d). EN 18031-2:2024 covers personal data and privacy, 3(3)(e). EN 18031-3:2024 covers fraud protection, 3(3)(f). Using them gives you a presumption of conformity — which is what lets you self-declare under the Radio Equipment Directive’s internal production control route instead of paying a notified body.

The restriction trap that forces a notified body

Here is the detail that most UAE device makers get wrong, and it is worth more than the rest of this article. The standards were cited with restrictions. Where a restriction bites, the presumption of conformity disappears for that part of the assessment and you need a notified body — even though you followed the harmonised standard faithfully.

• Password restriction (all three parts, clauses 6.2.5.1 and 6.2.5.2). If your device lets the user decline to set or use a password — a “skip for now” on the companion-app onboarding screen, a blank-password option in a web UI — the restriction applies. This is the single most common trigger.
• EN 18031-2, children’s toys. If access control does not ensure that only parents or guardians can configure the device, the presumption is lost.
• EN 18031-3, secure update test criteria SUM-2, clause 6.3.2.4. Restricted, so your update mechanism evidence has to stand on its own.

Note also that the “Rationale” and “Guidance” sections inside the standards are supportive text only — they do not themselves confer conformity. If your test house hands you a report that leans on them to explain away a gap, that is not a conformity file, it is a wish.

The practical takeaway: a single UX decision in your mobile app — letting people skip the password — can move your product from an AED 30,000 paperwork exercise to an AED 300,000 notified-body project. Fix the onboarding flow, keep the cheap route.

What the two routes cost

Figures below are typical 2026 ranges quoted by EU conformity and security-testing vendors, converted at EUR 1 ≈ AED 4.12 (EUR/USD 1.1216 against the pegged dirham at 3.6725).

Route	When it applies	Indicative cost	Timeline
Self-assessment against EN 18031 (internal production control)	No restriction triggered; design already supports mandatory passwords and signed updates	AED 0 – 33,000 in documentation and tooling	4 – 8 weeks
Notified body, EU-type examination with security testing	A restriction applies, or no harmonised standard fits your architecture	AED 165,000 – 412,000+	16 – 24 weeks
Additional notified-body audit fee	On top of testing, per assessment	AED 6,200 – 20,600	Within the above
Firmware remediation (secure boot, signed OTA, key management)	Legacy designs with no update hooks	Project-dependent; the dominant cost in practice	8 – 20 weeks

The honest summary of that table: the certificate is rarely the expensive part. Re-architecting firmware that was never designed to be updated securely is.

Why devices fail the first test

Compliance vendors report a 40–60% first-time failure rate against EN 18031. The causes repeat with almost no variation:

• No secure update path. The firmware can be flashed, but not verified. Passing means a secure bootloader, cryptographically signed over-the-air updates and real key management — which usually means touching the hardware design, not just the code.
• Factory-default or shared passwords. Still the most common single finding, and the one that also drags in the clause 6.2.5 restriction.
• Open or undocumented network services. Debug ports, telnet, unauthenticated local HTTP APIs left live in production builds.
• No maintained SBOM or HBOM. Without a living software and hardware bill of materials you cannot show you screen components against new CVEs, which is a documentation failure even when the device is technically sound.

Enforcement for all of this is national, not EU-level. In Germany, § 37(2) of the Funkanlagengesetz allows fines of up to EUR 100,000 for the breaches listed in § 37(1) nos. 3 and 14, and up to EUR 10,000 otherwise, with the Bundesnetzagentur enforcing. The Netherlands runs a dedicated IoT test lab under RDI; Italy enforces through MIMIT, France through ANFR, Ireland through ComReg, Sweden through PTS. Being clean in one member state is not a defence in another.

What we build on the software side

Aquarius is a Dubai software studio, not a test house — we do not issue certificates. What we do is the engineering work that decides whether you pass cheaply or expensively: the firmware update pipeline with signed OTA and rollback, the companion mobile app whose onboarding does not create a restriction, the credential and key-provisioning flow, the SBOM generation wired into CI so it stays current, and the technical documentation pack your notified body or importer asks for.

Typical engagements run AED 45,000 – 90,000 for a readiness audit plus documentation pack, and AED 120,000 – 350,000 for firmware and companion-app remediation on a mid-complexity connected product. Set that against 359,000 items stopped at one country’s border in a single year: the cost of inaction here is not a fine, it is a cancelled purchase order from a European buyer who cannot take the risk. If you are building the connected product itself, our IoT and smart-building development guide covers the architecture side, and our pricing page sets out how we scope this work.

The 11 December 2027 handover

Do not treat this as a two-year problem you can skip. A Commission draft delegated regulation — Ares(2025)10949208 — repeals (EU) 2022/30 from 11 December 2027, the date the Cyber Resilience Act, Regulation (EU) 2024/2847, becomes fully applicable. Radio equipment placed on the market between 1 August 2025 and 10 December 2027 still has to meet the RED cybersecurity requirements, and market surveillance for that window stays in force.

The CRA then widens the net considerably: it covers products with digital elements whether or not they contain a radio, its vulnerability and incident reporting obligations start earlier on 11 September 2026 (24 hours for actively exploited vulnerabilities, 72 hours for severe incidents, 14 days for the final report via the ENISA platform), and from 11 December 2027 an SBOM in a machine-readable format such as SPDX or CycloneDX becomes part of mandatory technical documentation, retained for at least ten years. Work done for EN 18031 now — signed updates, no default passwords, a maintained SBOM — is the same work the CRA will ask for. We covered that regime in detail in our Cyber Resilience Act guide for UAE software and IoT firms.

FAQ

Does EN 18031 apply if I only sell inside the UAE?

No. The Radio Equipment Directive applies to equipment placed on the EU market. Domestically you deal with TDRA type approval instead. But if any distributor, reseller or e-commerce listing moves your product into the EU, the obligations follow the product — which is why European buyers increasingly demand the conformity file in the purchase contract.

Is EN 18031 compliance mandatory, or just one way to comply?

The requirements in Article 3(3)(d), (e) and (f) are mandatory. EN 18031 is the harmonised route to proving you meet them, and it is the only route that gives you a presumption of conformity. You may demonstrate compliance another way, but then a notified body assesses you, so in practice EN 18031 is the cheap path.

What exactly triggers needing a notified body?

A restriction in Implementing Decision (EU) 2025/138 applying to your product — most often the clause 6.2.5.1/6.2.5.2 password restriction, where the device permits not setting or using a password. Also the EN 18031-2 children’s-toy access-control case, and EN 18031-3’s SUM-2 secure-update criteria in clause 6.3.2.4. Or simply having an architecture no harmonised standard covers.

Do I need all three parts of the standard?

Only the parts matching the requirements your product triggers. A Wi-Fi industrial sensor with no personal data and no payments needs EN 18031-1. A kids’ smartwatch with in-app top-ups can need all three.

How does this relate to the Digital Product Passport?

They are separate regimes that pull on the same data. EN 18031 asks for a security and update evidence trail; the ESPR passport asks for product and materials data. Both want structured, machine-readable records of what is inside your device — see our Digital Product Passport guide for UAE exporters.

Most Dubai hardware firms treat EU cybersecurity rules as a certificate to buy at the end of a project. It is not. It is a set of design decisions made at the start — whether the password can be skipped, whether the firmware can be signed, whether anyone is tracking what is in the build. Get those three right and the paperwork is cheap. Get them wrong and you are paying a notified body to document a problem you could have avoided. Tell us what you are shipping and we will tell you which route you are on.