Cybersecurity for radio-controlled toys – RED, EN 18031 and the CRA transition
Practical guide for EU toy manufacturers and importers: RED cybersecurity, toys without internet, EN 18031 evidence and the 2027 CRA transition.
A radio-controlled toy does not need an internet connection for every RED cybersecurity requirement to be relevant. Manufacturers and importers should assess network protection under Article 3(3)(d), privacy under 3(3)(e) and fraud prevention under 3(3)(f) separately. Real radio functions, data processing and the EU placing-on-the-market date matter more than the label 'Bluetooth' or 'smart'.
Who is covered, and when?
This guide is for manufacturers, importers, distributors and quality managers of remote-controlled cars, Bluetooth toys and app-controlled toys in Sweden and the EU. Directive 2014/53/EU (RED) and Delegated Regulation (EU) 2022/30 have applied specific cybersecurity requirements to covered radio equipment since 1 August 2025. Not every toy meets every condition; a toy without radio equipment is not brought within these provisions merely because it is a toy. Toy safety, general product safety and the GDPR must be assessed independently when relevant.
Delegated Regulation (EU) 2026/339 repeals the RED cybersecurity delegated regulation from 11 December 2027 as the main Cyber Resilience Act (EU) 2024/2847 requirements take effect. This repeal does not erase market surveillance obligations for equipment placed on the market during the earlier RED period.
Decision matrix: three distinct requirements
| Product question | Potential requirement | Evidence to obtain |
|---|---|---|
| Can the radio equipment connect to the internet directly or through another device? | RED 3(3)(d) – network protection | Connection map, app or gateway, functions and technical test results. |
| Can radio toy equipment process personal, traffic or location data? | RED 3(3)(e) – privacy, potentially even without internet | Actual data categories, access controls, storage and safeguards. |
| Can internet-connected radio equipment transfer money, monetary value or virtual currency? | RED 3(3)(f) – fraud protection where conditions are met | Payment function, transaction flow and relevant safeguards. |
Assess each requirement separately. No internet connection may rule out 3(3)(d), but it does not automatically rule out 3(3)(e) for radio toys processing covered data.
What do EN 18031-1 and EN 18031-2 prove?
EN 18031-1:2024, EN 18031-2:2024 and EN 18031-3:2024 are harmonised standards addressing the corresponding areas. A standard is not itself a mandatory certificate. Use of a harmonised standard is a route to demonstrating conformity, while other assessment routes can exist under RED. Commission Decision (EU) 2025/138 restricts the presumption of conformity in specified circumstances, including some password and parental-access arrangements.
Do not accept a bare claim of 'EN 18031 compliant'. Request the exact model and firmware, applied clauses, identifiable test reports, deviations and the applicable conformity-assessment route. Determine whether a notified body must be involved. A completed spreadsheet or supplier statement does not replace genuine technical documentation or a proper EU declaration of conformity.
Seven checks before a model is released
- Identify the model, SKU, firmware, radio interfaces, manufacturer, importer, batch and EU first placing-on-the-market date.
- Map direct and indirect internet access through apps, phones, routers or other equipment.
- Identify voice, pictures, accounts, device identifiers, traffic or location data and who processes them.
- Record a separate reasoned yes/no assessment for 3(3)(d), (e) and (f), including possible exceptions.
- Obtain authentic technical, design and test reports, standard edition, notified-body evidence where needed, and EU declaration.
- Log unresolved non-conformities, corrective actions, any internal batch hold and the authorised release decision.
- Reassess the relevant CRA requirements for new market placements from 11 December 2027.
Three practical examples
Local radio-controlled car
A toy car uses a local radio remote and has no internet pathway. Do not automatically apply 3(3)(d). Check whether it processes personal, traffic or location data for the separate 3(3)(e) assessment; the latter may also be inapplicable if the conditions are not met.
App-controlled toy with a microphone
A toy sends information via a phone app to the internet and stores audio against a user account. Both network and privacy protection may matter. The app, cloud provider, firmware and supporting evidence need to be assessed as a system.
Undated supplier certificate
A general EN 18031 statement without model, firmware, test scope or issuing party is an inadequate evidence trail. Request the specific documents and record whether to hold the batch pending checks.
Frequently asked questions
Can RED cybersecurity rules apply to Bluetooth toys without internet?
Yes. Article 3(3)(e) may cover radio toys capable of processing relevant personal, traffic or location data without an internet connection. Network protection under 3(3)(d) must be assessed separately.
Must every manufacturer use EN 18031-1?
No. EN 18031-1 addresses network protection for internet-connected radio equipment, and use of a harmonised standard is not compulsory in every case. The applicable legal requirements and conformity-assessment procedure still need to be met.
Can older models still be sold after 11 December 2027?
Assess when individual products were first placed on the EU market and whether they have changed. Repeal does not automatically erase RED compliance duties for products placed on the market in the earlier period; assess the CRA where relevant.
Is a supplier checklist enough for CE marking?
No. Administrative checklists support evidence management but cannot replace genuine technical documentation, a correct conformity assessment and other applicable product requirements.
Related document templates
For practical documentation, a topic-specific template pack is available: RED cybersecurity radio-controlled toys 2026/2027 – EN 18031, declaration of conformity & batch blocking | Word/PDF/Excel The templates are optional working aids; this guide is useful independently of any purchase.
Official sources and review
- PTS – cybersecurity requirements for radio equipment
- Delegated Regulation (EU) 2022/30
- Commission Decision (EU) 2025/138 – EN 18031
- Delegated Regulation (EU) 2026/339 – repeal
- RED 2014/53/EU · CRA 2024/2847
Editorial source check: 11 November 2026, against PTS and EUR-Lex. This is general guidance, not an individual legal opinion or conformity assessment. Have qualified technical and legal personnel review the real product before it is placed on the market.
