What is EN 18031-1 and why does it matter for environmental monitoring?

EN 18031-1:2024 is a harmonised European standard that defines cybersecurity requirements for internet-connected radio equipment under the EU Radio Equipment Directive (RED) Article 3(3)(d). It matters for environmental monitoring because every cellular air quality monitor, dust sensor, and noise meter sold in the EU must comply with this standard. It establishes eleven security mechanism categories covering access control, authentication, secure firmware updates, encrypted communication, secure key storage, and device resilience — all of which directly affect the integrity of environmental monitoring data.

When did EN 18031-1 become mandatory?

The delegated act under RED Article 3(3)(d) makes EN 18031-1 compliance mandatory for all new internet-connected radio equipment placed on the EU market. Manufacturers must demonstrate compliance through self-declaration or third-party assessment. Devices that do not meet these requirements cannot carry CE marking for cybersecurity under the Radio Equipment Directive.

How does EN 18031-1 relate to the EU Cyber Resilience Act?

EN 18031-1 and the EU Cyber Resilience Act (CRA) both address IoT cybersecurity but through different regulatory frameworks. EN 18031-1 applies specifically to radio equipment under the RED, while the CRA covers a broader category of products with digital elements. For environmental monitoring equipment that uses cellular connectivity, EN 18031-1 under the RED is the current applicable standard. The CRA introduces additional requirements that will apply alongside the RED requirements as it comes into force.

Does my air quality monitor need EN 18031-1 compliance?

If your air quality monitor uses cellular connectivity (LTE-M, NB-IoT, 4G, or 5G) and is sold or deployed in the EU, then yes — it falls under the scope of EN 18031-1 as internet-connected radio equipment. Monitors that use only wired connections (Ethernet, RS-485) or local wireless (Wi-Fi used purely as a local interface without direct internet connectivity) may have different regulatory considerations.

What is the difference between EN 18031-1 and ISO 27001 for IoT devices?

ISO 27001 is an information security management system standard that applies to organisations and their processes. EN 18031-1 is a product security standard that applies to the device itself — its firmware, communication protocols, key storage, and update mechanisms. A manufacturer can have ISO 27001 certification for their company processes while their devices fail to meet EN 18031-1 requirements. Both are important, but they address different aspects of security.

How does LwM2M help with EN 18031-1 compliance?

LwM2M (Lightweight Machine-to-Machine) is an IoT protocol designed with security as a foundational principle. It natively provides DTLS-encrypted communication (satisfying SCM requirements), mutual device-server authentication (AUM), standardised secure firmware updates via Object 5 (SUM), per-resource access control via Object 2 (ACM), and resilience mechanisms including session caching and automatic reconnection (RLM). Devices built on LwM2M inherently address approximately half of EN 18031-1's mechanism categories at the protocol level. For a detailed comparison of LwM2M versus other IoT protocols, read our article on why LwM2M matters for air quality monitoring.

Can MQTT-based IoT devices comply with EN 18031-1?

Yes, but it requires significantly more custom engineering. MQTT is a messaging protocol without built-in device management, firmware update mechanisms, or standardised access control. Every EN 18031-1 requirement — secure firmware updates, credential rotation, mutual authentication, resilience mechanisms — must be designed and implemented from scratch on top of MQTT. The question is not whether it is possible, but whether your supplier has actually done the work and can provide documented evidence of compliance for each mechanism category.

What should I ask my monitoring supplier about EN 18031-1?

Key questions include: Can you provide your EN 18031-1 compliance evidence document? How are firmware updates cryptographically signed? Does each device have unique cryptographic credentials, or do they share default keys? Where are credentials stored — in hardware-isolated storage or in software? Can credentials be rotated remotely without device replacement? What protocol does the device use to communicate with the cloud? How do you handle CVE vulnerability disclosures for your firmware stack?

Is Sensorbee compliant with EN 18031-1?

Yes. Sensorbee has assessed the Air Pro 2 Cellular (models SB8202 and SB8203) against EN 18031-1:2024 and published a self-declaration of conformity. Nine of the eleven mechanism categories are applicable to the Pro 2 (two apply only to network routing equipment), and all nine are assessed as compliant. The compliance evidence is built on the LwM2M protocol stack with DTLS encryption, hardware-backed credential storage in the nRF9160 modem, ECDSA P-256 firmware signing via MCUboot, and per-device unique manufacturing provisioning. The full compliance evidence document is available for download.

EN 18031: IoT Cybersecurity for Monitoring

hello@sensorbee.com +46 13 390 95 37|

Demander un devis Se connecter

EN 18031: IoT Cybersecurity for Monitoring | Sensorbee

Tout moniteur cellulaire de qualité de l'air, capteur de poussières et sonomètre vendu dans l'UE est désormais soumis aux exigences de cybersécurité EN 18031-1:2024 sous la Directive Équipements Radio. La norme définit onze catégories de mécanismes de sécurité couvrant le contrôle d'accès, l'authentification, les mises à jour sécurisées du firmware, le stockage sécurisé, la communication chiffrée, la résilience et la cryptographie.

Comment LwM2M résout la moitié du problème

Si votre fournisseur utilise LwM2M, il a déjà traité une part substantielle d'EN 18031-1 au niveau du protocole. S'il utilise MQTT ou un protocole propriétaire, demandez-lui de le prouver.

| Mécanisme EN 18031-1 | Comment LwM2M y répond | |---|---| | Authentification | DTLS avec clés pré-partagées — authentification mutuelle | | Communication sécurisée | DTLS — chiffrement, intégrité, protection contre la relecture | | Mises à jour sécurisées | Objet Firmware LwM2M (Objet 5) | | Contrôle d'accès | Objet Contrôle d'Accès LwM2M (Objet 2) | | Résilience | Reconnexion automatique avec recul exponentiel |

Conformité Sensorbee

Gros plan d'un circuit imprimé de capteur IoT montrant les composants qui implémentent les mécanismes de sécurité EN 18031-1

L'Air Pro 2 Cellular utilise des signatures ECDSA P-256, le stockage sécurisé hardware du modem nRF9160, des identifiants uniques par dispositif et AES-128/256.

Télécharger : Preuve de conformité EN 18031-1 (PDF)

Téléchargez notre catalogue ou contactez-nous.

Questions fréquemment posées

Qu'est-ce qu'EN 18031-1 ?

Norme européenne harmonisée définissant les exigences de cybersécurité pour les équipements radio connectés sous la RED Article 3(3)(d).

Mon moniteur doit-il être conforme à EN 18031-1 ?

Si votre moniteur utilise la connectivité cellulaire et est vendu dans l'UE, oui.

Comment LwM2M aide-t-il à la conformité ?

LwM2M fournit nativement la communication DTLS chiffrée, l'authentification mutuelle, les mises à jour firmware standardisées, le contrôle d'accès par ressource et les mécanismes de résilience.

Sensorbee est-il conforme à EN 18031-1 ?

Oui. Neuf des onze catégories de mécanismes sont applicables et toutes sont conformes. Document de preuve disponible en téléchargement.

EN 18031-1 : ce que la norme de cybersécurité de l'UE signifie pour les moniteurs environnementaux IoT