What is EN 18031-1 and why does it matter for environmental monitoring?

EN 18031-1:2024 is a harmonised European standard that defines cybersecurity requirements for internet-connected radio equipment under the EU Radio Equipment Directive (RED) Article 3(3)(d). It matters for environmental monitoring because every cellular air quality monitor, dust sensor, and noise meter sold in the EU must comply with this standard. It establishes eleven security mechanism categories covering access control, authentication, secure firmware updates, encrypted communication, secure key storage, and device resilience — all of which directly affect the integrity of environmental monitoring data.

When did EN 18031-1 become mandatory?

The delegated act under RED Article 3(3)(d) makes EN 18031-1 compliance mandatory for all new internet-connected radio equipment placed on the EU market. Manufacturers must demonstrate compliance through self-declaration or third-party assessment. Devices that do not meet these requirements cannot carry CE marking for cybersecurity under the Radio Equipment Directive.

How does EN 18031-1 relate to the EU Cyber Resilience Act?

EN 18031-1 and the EU Cyber Resilience Act (CRA) both address IoT cybersecurity but through different regulatory frameworks. EN 18031-1 applies specifically to radio equipment under the RED, while the CRA covers a broader category of products with digital elements. For environmental monitoring equipment that uses cellular connectivity, EN 18031-1 under the RED is the current applicable standard. The CRA introduces additional requirements that will apply alongside the RED requirements as it comes into force.

Does my air quality monitor need EN 18031-1 compliance?

If your air quality monitor uses cellular connectivity (LTE-M, NB-IoT, 4G, or 5G) and is sold or deployed in the EU, then yes — it falls under the scope of EN 18031-1 as internet-connected radio equipment. Monitors that use only wired connections (Ethernet, RS-485) or local wireless (Wi-Fi used purely as a local interface without direct internet connectivity) may have different regulatory considerations.

What is the difference between EN 18031-1 and ISO 27001 for IoT devices?

ISO 27001 is an information security management system standard that applies to organisations and their processes. EN 18031-1 is a product security standard that applies to the device itself — its firmware, communication protocols, key storage, and update mechanisms. A manufacturer can have ISO 27001 certification for their company processes while their devices fail to meet EN 18031-1 requirements. Both are important, but they address different aspects of security.

How does LwM2M help with EN 18031-1 compliance?

LwM2M (Lightweight Machine-to-Machine) is an IoT protocol designed with security as a foundational principle. It natively provides DTLS-encrypted communication (satisfying SCM requirements), mutual device-server authentication (AUM), standardised secure firmware updates via Object 5 (SUM), per-resource access control via Object 2 (ACM), and resilience mechanisms including session caching and automatic reconnection (RLM). Devices built on LwM2M inherently address approximately half of EN 18031-1's mechanism categories at the protocol level. For a detailed comparison of LwM2M versus other IoT protocols, read our article on why LwM2M matters for air quality monitoring.

Can MQTT-based IoT devices comply with EN 18031-1?

Yes, but it requires significantly more custom engineering. MQTT is a messaging protocol without built-in device management, firmware update mechanisms, or standardised access control. Every EN 18031-1 requirement — secure firmware updates, credential rotation, mutual authentication, resilience mechanisms — must be designed and implemented from scratch on top of MQTT. The question is not whether it is possible, but whether your supplier has actually done the work and can provide documented evidence of compliance for each mechanism category.

What should I ask my monitoring supplier about EN 18031-1?

Key questions include: Can you provide your EN 18031-1 compliance evidence document? How are firmware updates cryptographically signed? Does each device have unique cryptographic credentials, or do they share default keys? Where are credentials stored — in hardware-isolated storage or in software? Can credentials be rotated remotely without device replacement? What protocol does the device use to communicate with the cloud? How do you handle CVE vulnerability disclosures for your firmware stack?

Is Sensorbee compliant with EN 18031-1?

Yes. Sensorbee has assessed the Air Pro 2 Cellular (models SB8202 and SB8203) against EN 18031-1:2024 and published a self-declaration of conformity. Nine of the eleven mechanism categories are applicable to the Pro 2 (two apply only to network routing equipment), and all nine are assessed as compliant. The compliance evidence is built on the LwM2M protocol stack with DTLS encryption, hardware-backed credential storage in the nRF9160 modem, ECDSA P-256 firmware signing via MCUboot, and per-device unique manufacturing provisioning. The full compliance evidence document is available for download.

EN 18031: IoT Cybersecurity for Monitoring

Publicerat av Oscar Sjöberg den 20 November 2025 · 13 min läsning

EU kräver nu att all internetansluten radioutrustning uppfyller cybersäkerhetskraven i EN 18031-1. Här är vad standarden kräver, hur LwM2M löser halva problemet, och vad du ska fråga din leverantör.

EN 18031-1: vad EU:s cybersäkerhetsstandard innebär för IoT-miljöövervakare

Hur LwM2M löser halva problemet

Sensorbees efterlevnad

Vanliga frågor

Vad är EN 18031-1?

Behöver min övervakare uppfylla EN 18031-1?

Hur hjälper LwM2M med efterlevnad?

Uppfyller Sensorbee EN 18031-1?

Redo att komma igång med miljöövervakning?