What Cybersecurity Rules Must a Connected EV Charger Meet in Europe? EN 18031 and the CRA Explained for Buyers

A modern EV charger is a network endpoint. It holds driver accounts, session and billing data, and a live connection to a backend — and, through smart charging, a degree of influence over the local grid. European law now treats it that way.

Two regulatory layers decide whether a connected charger can be sold and kept in service in Europe: the Radio Equipment Directive cybersecurity requirements, in force since 1 August 2025 and assessed against EN 18031, and the Cyber Resilience Act, phasing in across 2026 and 2027. This article explains which chargers are in scope, what compliance evidence looks like, and what to ask any supplier before ordering.

1. The rule already in force: RED and EN 18031

The Radio Equipment Directive (RED) has governed radio equipment in the EU for years. Delegated Regulation (EU) 2022/30 activated three additional essential requirements in its Article 3(3): point (d) on network protection, point (e) on privacy for equipment processing personal, traffic or location data, and point (f) on fraud protection for equipment processing virtual money or monetary value.

After a one-year postponement, these requirements have applied since 1 August 2025. Radio equipment in the named categories placed on the EU market from that date must meet them before it can carry the CE mark.

The EN 18031 series is the harmonised standards route for demonstrating that compliance. Its references were published in the Official Journal in January 2025: EN 18031-1 covers internet-connected radio equipment and maps to point (d); EN 18031-2 covers equipment processing personal, traffic or location data and maps to point (e); EN 18031-3 covers equipment processing virtual money or monetary value and maps to point (f). The standards were published with restrictions, so for some products the presumption of conformity does not cover everything and a notified body may still need to be involved. For a buyer, the consequence is simple: “EN 18031 compliant” is a claim that should come with paperwork, not a logo.

2. Is your charger in scope?

Work through three questions. Does the charger contain a radio — Wi-Fi, Bluetooth or a cellular modem? Does it connect, directly or through another device, to the internet? Does it process personal data, such as driver accounts and session records, or handle payment value?

A connected AC charger normally answers yes to all three. That puts EN 18031-1 and EN 18031-2 at the centre of its file, with part 3 relevant where the charger itself processes payment value. A basic charger with no radio sits outside this regime. Almost everything specified for fleets, workplaces and reimbursed home charging sits inside it.

3. The second wave: the Cyber Resilience Act

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, entered into force on 10 December 2024 and generalises the same idea: products with digital elements sold in the EU must be secure by design, delivered in a secure default configuration, and kept secure across their lifecycle.

Its timetable matters for chargers you buy today. Reporting obligations — notifying actively exploited vulnerabilities and severe security incidents — have applied since 11 September 2026. The main requirements apply from 11 December 2027, including vulnerability handling, secure update delivery, and a software bill of materials documenting what is inside the firmware. Products placed on the market before that date fall under the main requirements only if substantially modified afterwards — but the reporting duty already reaches in-scope products on the market now. On the same December 2027 date, the RED delegated regulation is repealed and the CRA becomes the single regime: the RED route is the bridge, the CRA is the destination.

What does good look like? When Easee announced that its full charger range met the RED cybersecurity requirements, the announcement named the assessing body — DEKRA — and the standard. That is the shape of a verifiable claim. Ask for the same shape from every supplier.

4. Seven questions to ask any charger supplier

1. Does your EU Declaration of Conformity reference RED Article 3(3)(d) and (e) — and (f), if the charger processes payment value?
2. Which parts of EN 18031 were applied, and where the standards carry restrictions, was a notified body involved?
3. How are default credentials handled — unique per device, or changed at first use?
4. How are firmware updates delivered and verified, and can a bad update be rolled back safely?
5. What is the declared security support period for updates?
6. Is there a published route for reporting a vulnerability, and how are fixes disclosed?
7. Looking ahead to the CRA: can you provide a software bill of materials for the firmware, and are your reporting processes ready?

A supplier with a real compliance file answers in documents. A supplier without one answers in adjectives.

FAQ

Does EN 18031 apply to portable chargers, or only wallboxes? The rules follow the radio and the data, not the mounting. A portable charger with Wi-Fi, Bluetooth or 4G that connects to a backend and processes session data is in scope just like a fixed wallbox.

We bought chargers before August 2025. Are they affected? The RED requirements govern equipment placed on the market from 1 August 2025. Under the CRA, reporting obligations already cover in-scope products on the market, while the main requirements reach older products only if substantially modified after 11 December 2027.

Is a CE mark on the datasheet enough? No. Ask which requirements the Declaration of Conformity references and which standards were applied. A connected charger whose file is silent on Article 3(3) is a question, not an answer.

At Amprisen, our portable chargers speak OCPP 1.6J with built-in 4G and are CE and CB certified — and the seven questions above should be put to every connected-charger supplier, including us. Connected is the starting point. Provably secure is the specification.