This report has been created by a group of smart meter stakeholders including members from ESMIG, Aqua and OMS, and the ad hoc subgroup on smart meters from the CEN/CENELEC/ESTI Coordination Group on Smart Meters.
Background:
On 1 August 2025, the new Delegated Legislation (EU 2022/30) came into force, requiring most radio equipment to be compliant with Essential Articles 3.3 d, e and/or f of the RED (EU 2014/53). This legislation was introduced as a response to concerns over the resilience of some products to cyber-attacks.
By a Standardisation Request, the EU Commission tasked CEN/CENELEC to develop three generic standards that set out the generic requirements that are to be demonstrated in order to presume compliance with the Essential Articles.
These standards are:
- EN 18031 -1 (internet connected radio equipment)
- EN 18031-2 (radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment)
- EN 18031-3 (Internet connected radio equipment processing virtual money or monetary value)
They describe a set of security requirements that products need to demonstrate and there is a high degree of overlap between requirements across the three standards.
This document describes the cyber requirements contained within EN 18031 and provides a commentary on whether and how each of the requirements and the standards themselves might apply to smart meters. Assumptions made are clearly documented to aid any notified bodies that may be tasked with the assessment of smart meters.
To note:
The content of this document provides a guidance to manufacturers of smart meters and aims to assist manufacturers to assign the generic terms used in the EN18031 series standards to concrete terms used in a smart meter context. It does not provide guidance for the assessment of other components in a smart metering system.
This document cannot be used as a legal reference when performing the assessment of smart meters. It shall also be noted that the technical characteristics of the smart meters, that according to this guideline limits the scope of the products falling under (EU 2022/30), will not be the same in future legislations, such as EU 2024/2847. However, many of the considerations would still be applicable.