RED cybersecurity radio-controlled toys 2026/2027 – EN 18031, declaration of conformity & batch blocking | Word/PDF/Excel

Do you import or manufacture radio-controlled toys, Bluetooth toys, or connected toys intended for sale in Sweden/the EU? A toy may be subject to the cybersecurity requirements of the RED even if it does not connect to the internet: privacy requirements may be relevant when radio equipment processes personal data, traffic data, or location data. This specialist package helps you assess actual applicability, request evidence of testing from the supplier, and decide whether to block a batch. It is not a general policy and is not a CE certificate.

Read the guide: Cybersecurity for radio-controlled toys – RED, EN 18031 and the CRA transition. It explains the rules and practical assessments.

Current regulatory framework: The RED Directive 2014/53/EU, together with EU Delegated Regulation (EU) 2022/30, imposes cybersecurity requirements on relevant radio equipment on the EU market from 1 August 2025. Under Regulation (EU) 2026/339, the Delegated Regulation will be repealed from 11 December 2027, when the CRA’s main product requirements begin to apply. Market surveillance of earlier products is not automatically affected retroactively. PTS summarizes applicability; EU 2026/339 specifies the transition.

For whom: Swedish manufacturers, importers, supplier representatives, and quality teams for radio toys, radio-controlled cars, app-connected toys, and other actual radio products in the toy category. Wholesalers who must be able to explain why a particular batch has been blocked or released may also find the documents useful.

What cybersecurity requirements may apply to toys?

RED 3.3(d) – network protection: Applies within the relevant scope to internet-connected radio equipment, even when the internet network is accessed indirectly via another device, such as a mobile app or gateway. A simple radio toy without such internet capability should not automatically receive this classification.

RED 3.3(e) – personal data and privacy: May also apply to radio toys that are not internet-connected if they process personal, traffic, or location data according to the requirements of the regulatory framework. It is therefore incorrect to automatically set “not applicable” simply because the toy only uses Bluetooth or other local radio technology.

RED 3.3(f) – fraud protection: Covers relevant internet-connected radio equipment that enables the transfer of money, monetary value, or virtual currency. This does not routinely apply to all toys. Also check exemptions and the responsibilities of separate economic operators.

EN 18031-1 and EN 18031-2: what do they prove?

EN 18031-1:2024 is relevant to network protection (d); EN 18031-2:2024 concerns data protection and privacy (e), including relevant radio toys. EN 18031-3:2024 may become relevant in the case of a relevant payment function. PTS emphasizes that the published harmonized standards have restrictions and do not always provide a full presumption of conformity. In some cases, a notified body must be used. The package does not include the licensed standard text, any laboratory tests, or any notified body statement.

All 15 customer files

Excel with nine tabs

Overview, Models, Applicability, Supplier Evidence, Testing, Batch Blocks, Decisions, Actions, and Sources. Each actual model is assigned its own ID. Register entries may show, among other things, open actions, missing evidence, deviating test results, and blocked batches. Seven summary metrics have been tested with an empty register and one completed test case. The customer file is then reset to 0 registered cases – no fictitious product IDs or actual test certificates are included. The status “Released” is a manual entry and does not certify CE compliance.

How to use the package

1. Inventory the radio toy. Enter model/SKU, firmware, radio components, app/gateway, manufacturer, importer, batch, and market date.
2. Test the correct regulation. Investigate direct/indirect internet connection, relevant data types, any payment flow, and actual exemptions. Document 3.3(d), (e), and (f) separately.
3. Request the evidence. Require authentic supplier reports, the correct EN 18031 version, report ID, standard restrictions, any notified body involvement, and the actual firmware version.
4. Test and document. Check access, pairing, data handling, secure updates, and actual evidence references. Have the technical manager verify – not just administer.
5. Block the affected batch in case of deficiency. Record the actual inventory stop and any external notification based on a correct legal assessment.
6. Make a decision and choose the correct time period. Separate products that were first placed on the EU market before 11 December 2027 from later product models and CRA requirements.

Five relevant practical situations

Bluetooth toy without internet: investigate 3.3(e) in the case of relevant processing of personal/traffic/location data, but do not make an automatic 3.3(d) claim.

App-connected Wi-Fi toy: investigate both 3.3(d) and (e) with clear evidence of data flow, account, and remote connection.

Radio-controlled car without personal data: document the negative applicability assessment objectively. Other RED and toy requirements still apply in relevant parts.

The supplier sends a generic “EN 18031 compliant”: request the actual model, version, test ID, standard restrictions, and assess whether the evidence provides any relevant presumption at all.

New batch from 11 December 2027:

Frequently asked questions

Must all radio-controlled toys have EN 18031-1?

No. EN 18031-1 refers to network protection for internet-connected radio equipment. First investigate whether the toy actually connects to the internet, even indirectly. Legal applicability and the selected standard must be assessed separately.

Can EN 18031-2 apply without internet?

Yes, certain toys that are radio equipment may be subject to the privacy requirement 3.3(e) in the case of relevant data processing even without an internet connection. However, an automatic obligation for all toys is not claimed.

Does a completed template mean we can CE mark the product?

No. You must meet all applicable requirements and have actual technical documentation. An assessment by a notified body may be necessary. Templates, Word, and Excel are only work aids.

What applies after 10 December 2027?

Regulation (EU) 2026/339 repeals 2022/30 from 11 December 2027. The main requirements of the CRA will then apply. Products that were first placed on the market during the RED period can still be reviewed according to the rules in force at that time.

Are all documents in English?

No. Five operational templates and the Excel file are in Swedish. A Swedish user guide and a separate English User Guide are included; the English guide contains instructions, not full translations of the main documents.

Legal sources and quality status

PTS – cybersecurity requirements for radio equipment · EU 2022/30 · EU 2026/339 · CRA (EU) 2024/2847 · RED 2014/53/EU.

Version 1.0, AI-assisted source control 10 November 2026. No external independent legal review, laboratory testing, notified body, regulatory decision, or actual CE certification has been performed. Check the latest version of the regulatory framework before operational application. The Digital ZIP file is not yet linked to Shopify Digital Products; the product is in DRAFT without publication.

Related documents

For another product category, there is a special RED template for smart locks. The broader CRA Compliance Package covers later horizontal product requirements. Choose this specialist package if the question concerns radio toys' special privacy protection and supplier evidence for 2025–2027.