EU Cybersecurity in Focus: Implementation Decision and Harmonized Standards

Commission Implementing Decision (EU) 2025/138 dated 28 January 2025 amends Commission Implementing Decision (EU) 2022/2191 as regards harmonized standards supporting the essential requirements of Directive 2014/53/EU of the European Parliament and of the Council, relating to cybersecurity for categories and classes of radio equipment specified in Delegated Regulation (EU) 2022/30.

The decision is based on the Treaty on the Functioning of the European Union and Regulation (EU) No 1025/2012 of the European Parliament and of the Council on European standardization. This regulation provides that radio equipment compliant with harmonized standards published in the Official Journal of the European Union is presumed to be compliant with the essential requirements set out in Article 3 of Directive 2014/53/EU.

In 2022, the Commission requested the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (Cenelec) to draft new harmonized standards in support of Article 3(3) of Directive 2014/53/EU. As a result, EN 18031-1:2024, EN 18031-2:2024 and EN 18031-3:2024 were developed, addressing common safety requirements for internet-connected radio equipment, childcare radio equipment, toys and portable radio equipment, as well as radio equipment processing virtual money or monetary value.

WHY?

Implementing Decision (EU) 2025/138 has a high impact, as it primarily affects radio equipment manufacturers and standardization organizations, such as the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (Cenelec). Although it does not have an immediate impact on the end consumer, it does influence the safety and conformity of products reaching the market.

The decision introduces harmonized standards addressing safety requirements for internet-connected radio equipment, childcare radio equipment, toys, and portable radio equipment, as well as radio equipment processing virtual money or monetary value. This ensures that products are more secure and comply with cybersecurity standards.

The rules include specific restrictions, such as the need to set appropriate passwords and access controls. These restrictions are crucial to ensure compliance with the essential requirements of Directive 2014/53/EU.

WHO?

Therefore, the direct impact is on Radio Equipment Manufacturers, Standardization Organizations, Regulators and Compliance Authorities.

CONCLUSION:

Although the impact is not immediate for consumers, the decision plays a crucial role in improving the safety and compliance of radio equipment in the European market, mainly affecting manufacturers and standardization organizations.

Regulatory Impact:

Top Priority: Yes Type of Certificate: No Spectrum Bands: No Import Changes HS Codes: No Standard Changes: Yes Product Changes: Yes Label Changes: No