EN 18031-2:2024
The harmonised EU standard for the privacy and personal data protection requirement of the Radio Equipment Directive: 40 requirements on internet-connected, childcare, toy and wearable radio equipment covering access control, authentication, secure updates, secure storage, secure communication, logging, deletion, user notification, cryptographic keys, general equipment hygiene and cryptography, each with its own assessment criteria.
EN 18031-2:2024 is a compliance framework from European Union (EEA) with 11 domains and 40 controls. The largest domains are 6.10 General equipment capabilities (GEC) – EN 18031-2:2024 (7 controls), 6.1 Access control mechanism (ACM) – EN 18031-2:2024 (6 controls), 6.2 Authentication mechanism (AUM) – EN 18031-2:2024 (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (11)
6.1 Access control mechanism (ACM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::ACM-1 | Use access control to govern entities' access to security and privacy assets |
| en-18031-2-2024::ACM-2 | Access control that admits authorised entities only |
| en-18031-2-2024::ACM-3 | Toys: children's access to external content restricted by default |
| en-18031-2-2024::ACM-4 | Toys and childcare equipment: third-party access to children's privacy assets restricted by default |
| en-18031-2-2024::ACM-5 | Toys: parent or guardian controls over children's access to assets |
| en-18031-2-2024::ACM-6 | Toys: parent or guardian controls over other entities' access to children's privacy assets |
6.10 General equipment capabilities (GEC) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::GEC-1 | No publicly known exploitable vulnerabilities affecting security or privacy assets |
| en-18031-2-2024::GEC-2 | Factory default exposes only the network interfaces and services needed for setup or basic operation |
| en-18031-2-2024::GEC-3 | Optional services and interfaces in the default state can be enabled and disabled |
| en-18031-2-2024::GEC-4 | Document the exposed network interfaces and services of the default state |
| en-18031-2-2024::GEC-5 | No unnecessary physical external interfaces |
| en-18031-2-2024::GEC-6 | Validate input from external interfaces that can affect security or privacy assets |
| en-18031-2-2024::GEC-7 | Document external sensing capabilities relevant to privacy |
6.11 Cryptography (CRY) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::CRY-1 | Best-practice cryptography for protecting security and privacy assets |
6.2 Authentication mechanism (AUM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::AUM-1 | Authenticate entities before they read confidential, change sensitive, or use privacy and security functions (network and user interfaces) |
| en-18031-2-2024::AUM-2 | One-factor authentication as the floor; two-factor for special-category data over the network |
| en-18031-2-2024::AUM-3 | Validate the properties of authenticators |
| en-18031-2-2024::AUM-4 | Authenticators can be changed |
| en-18031-2-2024::AUM-5 | Password strength for factory default and user-set passwords |
| en-18031-2-2024::AUM-6 | Resistance to brute-force attack |
6.3 Secure update mechanism (SUM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::SUM-1 | Provide a mechanism to update software and firmware that affects security or privacy assets |
| en-18031-2-2024::SUM-2 | Install only updates whose integrity and authenticity are verified at installation |
| en-18031-2-2024::SUM-3 | Internet-connected equipment can apply updates automatically or on scheduled or triggered approval |
6.4 Secure storage mechanism (SSM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::SSM-1 | Use secure storage for security and privacy assets kept persistently on the equipment |
| en-18031-2-2024::SSM-2 | Secure storage protects integrity |
| en-18031-2-2024::SSM-3 | Secure storage protects the secrecy of confidential data, configuration and security parameters |
6.5 Secure communication mechanism (SCM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::SCM-1 | Use secure communication for security and privacy assets sent over network interfaces |
| en-18031-2-2024::SCM-2 | Integrity and authenticity protection to best practice |
| en-18031-2-2024::SCM-3 | Confidentiality protection to best practice where needed |
| en-18031-2-2024::SCM-4 | Replay protection to best practice |
6.6 Logging mechanism (LGM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::LGM-1 | Log internal activities relevant to privacy assets and their protection |
| en-18031-2-2024::LGM-2 | Store log data persistently on the equipment |
| en-18031-2-2024::LGM-3 | Retain a minimum number of the latest events, always including the latest |
| en-18031-2-2024::LGM-4 | Time information on persistently stored log data |
6.7 Deletion mechanism (DLM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::DLM-1 | Let users delete their personal data and sensitive security parameters from the equipment |
6.8 User notification mechanism (UNM) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::UNM-1 | Notify users of changes affecting the protection or privacy of personal information |
| en-18031-2-2024::UNM-2 | Notification content: what changed and how it affects protection and privacy |
6.9 Confidential cryptographic keys (CCK) – EN 18031-2:2024
| Code | Title |
|---|---|
| en-18031-2-2024::CCK-1 | Confidential cryptographic keys of at least 112-bit security strength |
| en-18031-2-2024::CCK-2 | Generate confidential cryptographic keys with best-practice cryptography |
| en-18031-2-2024::CCK-3 | Preinstalled confidential cryptographic keys practically unique per unit |
What is EN 18031-2:2024 and who does it apply to?
EN 18031-2:2024 is a compliance framework from European Union (EEA) with 11 domains and 40 controls. The harmonised EU standard for the privacy and personal data protection requirement of the Radio Equipment Directive: 40 requirements on internet-connected, childcare, toy and wearable radio equipment covering access control, authentication, secure updates, secure storage, secure communication, logging, deletion, user notification, cryptographic keys, general equipment hygiene and cryptography, each with its own assessment criteria. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does EN 18031-2:2024 actually require?
EN 18031-2:2024 has 40 controls organised across 11 domains. The largest domains are 6.10 General equipment capabilities (GEC) – EN 18031-2:2024 (7 controls), 6.1 Access control mechanism (ACM) – EN 18031-2:2024 (6 controls), 6.2 Authentication mechanism (AUM) – EN 18031-2:2024 (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of EN 18031-2:2024 do I already cover?
EN 18031-2:2024 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement EN 18031-2:2024?
Start your EN 18031-2:2024 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about EN 18031-2:2024 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 40 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required