Last updated: 24 October 2026
At a Glance
- EN 18031-1/-2/-3 were harmonised with restrictions by reference in the Official Journal of the EU on 28 January 2025 (2025/138); a notified body is mandatory for products that trigger a restriction.
- The cybersecurity requirements of RED Delegated Regulation (EU) 2022/30 have applied since 1 August 2025; they are a CE prerequisite for internet-connected radio equipment.
- EN 18031-1 contains 31 requirements, EN 18031-2 contains 40 and EN 18031-3 contains 34; assessment is carried out with mechanisms coded ACM/AUM/SUM and decision trees.
- Cyber Resilience Act (CRA) Annex I applies in full from 11 December 2027; a single, correctly designed test engagement produces RED and CRA evidence together.
- Typical test duration is 2–4 weeks; the report is delivered in Turkish and English and added directly to the Annex VII technical file.
Nesil Teknoloji performs product security testing in Türkiye for IoT devices, smart home products, network equipment, embedded systems and all internet-connectable digital products according to EN 18031-1/-2/-3, ETSI EN 303 645 and IEC 62443 scenarios. The output is a requirement-based conformity report that goes directly into your CE technical file as evidence under RED Delegated Regulation (EU) 2022/30 and the EU Cyber Resilience Act (CRA). The work is carried out entirely in Türkiye by our test organisation, structured independently of our consulting services, as a TSE Class A Approved Penetration Testing Company (TSE-STF-065) and CREST member.
Which Obligation Does This Testing Meet?
Since 1 August 2025, cybersecurity has been a CE requirement for radio equipment that can connect to the internet directly or indirectly under RED Delegated Regulation (EU) 2022/30, and the EN 18031 series is the harmonised standard for this requirement. The EU Cyber Resilience Act (CRA) brings the Annex I essential requirements into full application for all digital products on 11 December 2027. Most products facing test requests when exported to the EU today sit at the intersection of these two regulations; a single test engagement, correctly designed, serves both obligations. For scope and timeline details, see our CRA Compliance Consulting page.
Test Scope
- EN 18031-1:2024 — network protection (RED Art. 3(3)(d)); 31 requirements, assessed with mechanism-based ACM/AUM/SUM codes and decision trees.
- EN 18031-2:2024 — protection of personal data and privacy (Art. 3(3)(e)); 40 requirements.
- EN 18031-3:2024 — protection from fraud, for products handling financial transactions (Art. 3(3)(f)); 34 requirements.
- ETSI EN 303 645 — baseline security for consumer IoT; assessment according to the TS 103 701 test specification.
- IEC 62443-4-1 / 4-2 — industrial automation and control system components.
- Technical depth — firmware extraction and analysis; UART, JTAG and SPI hardware interface testing; Wi-Fi, BLE and Zigbee communication analysis; testing of the companion mobile app and cloud back-end; SBOM validation (see our SBOM guide).
Legal Status of the Report
The role of the report in the conformity process depends on the product’s class and restriction status:
| Situation | Status of the report |
|---|---|
| Default-class product (Module A, self-declaration) | Direct evidence for the Annex VII technical file; sufficient on its own |
| Important Class I — harmonised standard fully applied | Basis for the self-declaration |
| Restriction triggered, or Important Class II / critical product | Evidence feeding the notified body file |
The EN 18031 series was published in the Official Journal of the EU (OJ L, 2025/138) with restrictions. If a product triggers a restricted situation (for example, offering the user an option to skip setting a password), no presumption of conformity arises and a notified body assessment becomes mandatory. Our test report includes the restriction analysis as a separate section; where a notified body is required, our CRA Conformity Assessment and Notified Body Preparation service takes over.
Process and Timeline
| Step | Content | Typical duration |
|---|---|---|
| 1. Scope and requirement mapping | Scope form, selection of the standard set, preliminary restriction analysis | 1 week |
| 2. Test execution | Mechanism-based assessment; firmware, hardware interfaces, communications, mobile and cloud | 2–4 weeks |
| 3. Remediation verification | Retesting after fixes | 1 week |
| 4. Final report and technical file annex | TR+EN report, requirement-based conformity matrix, evidence set | 3 business days |
Cost Advantage Through Government Support
Costs of test/analysis reports that are mandatory for, or give an advantage in, entering the EU market can be supported at 50%, within an annual cap, under the Turkish Ministry of Trade’s Market Entry Certification Support programme. Current rates, caps and eligibility conditions should be confirmed with your exporters’ association; we structure invoicing in line with the support conditions.
Why Nesil Teknoloji
Penetration testing authorisation certificate of the Republic of Türkiye Ministry of Industry and Technology (STB03-250), TSE Class A Approved Penetration Testing Company certificate (TSE-STF-065), CREST membership and TÜRKAK-accredited ISO/IEC 27001:2022, ISO/IEC 27701, ISO 9001, ISO/IEC 20000-1 and ISO 22301 management systems. A testing team holding OSCP, GPEN, LPT, CISSP and CEH certifications; 400+ corporate references across the public, finance, industry and telecommunications sectors. All testing activities, including firmware and hardware, are carried out in Türkiye under a non-disclosure agreement.
Frequently Asked Questions
How are test duration and cost determined?
They depend on the number of interfaces (network, radio, physical), the standard set to be applied, the level of firmware access and the number of product variants. A quote is sent within 2 business days based on the scope form completed at the preliminary meeting; typical test duration is 2–4 weeks.
What happens if an EN 18031 restriction is triggered?
No presumption of conformity arises; the product must undergo an assessment by a notified body established in the EU. Our report includes the restriction analysis, and we coordinate the notified body process and file preparation.
Are RED testing and CRA testing the same engagement?
They overlap but are not identical. RED/EN 18031 focuses on product mechanisms; CRA Annex I additionally covers vulnerability handling processes (SBOM, security updates, coordinated disclosure). Our test plan maps both requirement sets in a single engagement; gap items are shown separately in the report.
In which language and format is the report delivered?
In Turkish and English, with a requirement-based conformity matrix, findings, evidence set and restriction analysis, in a format ready to be added directly to the EU Declaration of Conformity and the Annex VII technical file.
Official Sources
- Regulation (EU) 2024/2847 — Cyber Resilience Act (EUR-Lex)
- Delegated Regulation (EU) 2022/30 — RED Cybersecurity (EUR-Lex)
- Implementing Decision (EU) 2025/138 — EN 18031 References and Restrictions
- ETSI — Consumer IoT Security (EN 303 645)
Quote and Preliminary Meeting
Scope form and quote for your product: Request a Quote · Ankara +90 312 911 46 40 · Istanbul +90 216 232 24 33