Transatlantic Technology Research, home

Research & analysis for U.S. companies in European markets

NewsletterSaved

Product Security Standards for Connected Products: IEC 62443, EN 18031, ETSI EN 303 645

Which standard to build evidence against for which EU rule, and where each one's harmonised status stood on the date shown.

By the editorial teamLast updated Written with the help of AI tools

EU product laws set requirements. Standards tell you how to meet them, and in the EU, a harmonised standard whose reference is published in the Official Journal gives a presumption of conformity with the requirements it covers [1][2]. This hub maps the three standards families our readers ask about most to the rules they support, and states each one’s harmonised-standard status with a date. We explain the standards; we don’t reproduce them. Buy the texts from the standards bodies.

Who this is for

Firmware and product security leads who need to choose which standard to build evidence against, and who are being asked by customers for IEC 62443, EN 18031 or ETSI EN 303 645.

Which standard answers which rule

Status as of 2026-11-10. Check the Official Journal before relying on any presumption of conformity.

Standard What it covers Supports Harmonised status (dated)
IEC 62443 series Security for industrial automation and control systems: from asset-owner programs to system and component requirements [3][4][5] Industrial customer requirements; candidate evidence for the CRA Not cited as a harmonised standard under the CRA; the Commission’s Cyber Resilience Act standardisation page (updated 31 July 2026) lists none yet [6]
EN 18031-1, -2, -3:2024 Common security requirements for internet-connected radio equipment, including privacy and monetary-value functions [7] RED Art. 3(3)(d), (e), (f), as activated by Delegated Regulation (EU) 2022/30 [7][8] References published with restrictions by Implementing Decision (EU) 2025/138 of 28 January 2025 [7]
ETSI EN 303 645 Baseline cybersecurity requirements for consumer IoT; latest version V3.1.3 (2024-09) [9] Consumer IoT expectations Not stated here; no harmonised-standard citation verified today
Cyber Resilience Act harmonised standards (in preparation) 41 horizontal and product-specific standards under standardisation request M/606 [6] Cyber Resilience Act Annex I First deliverables expected Q3 2026, more by 30 October 2027 (Commission timeline) [10]

IEC 62443 in brief

IEC 62443 is a series, not one standard. Parts relevant here, by their published titles:

  • 3-2: security risk assessment for system design [5]. It covers partitioning a system into zones and conduits and setting a target security level for each [12].
  • 3-3: system security requirements and security levels [5]. It’s system-level, so it’s mentioned here only for context.
  • 4-1: secure product development lifecycle requirements [3].
  • 4-2: technical security requirements for IACS components [4].

Product makers usually work with 4-1 (process) and 4-2 (component). Our IEC 62443 certification guide covers that path, and IEC 62443-4-1 vs 4-2 compares the two parts.

EN 18031 and the RED delegated act

For radio equipment, the RED cybersecurity delegated act has applied since 1 August 2025 [8]. It’s repealed with effect from 11 December 2027, when the CRA’s main obligations apply [8][11]. EN 18031 and the RED delegated act explains what that means for products that will span both regimes.

ETSI EN 303 645

A baseline for consumer IoT [9]. If your products are industrial, you may still meet it in customer questionnaires. ETSI EN 303 645 explains where it fits.

Start here

  1. Make a list, per product: radio or not, consumer or industrial, EU customers' stated standards.
  2. Radio products on the EU market since August 2025: confirm your EN 18031 position [7][8].
  3. Industrial products: plan IEC 62443-4-1 and 4-2 evidence, and map it to the Cyber Resilience Act requirements.
  4. Watch for Cyber Resilience Act harmonised standards. Our EU regulatory timeline tracks status.

Guides in this section

Sources

All accessed 2026-11-10.

  1. Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 27(1). EUR-Lex, ELI: http://data.europa.eu/eli/reg/2024/2847/oj
  2. Commission Implementing Decision (EU) 2025/138, recital 12 (presumption of conformity from OJ publication). EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025D0138
  3. IEC, "IEC 62443-4-1:2018 … Part 4-1: Secure product development lifecycle requirements", IEC Webstore. https://webstore.iec.ch/en/publication/33615
  4. IEC, "IEC 62443-4-2:2019 … Part 4-2: Technical security requirements for IACS components", IEC Webstore. https://webstore.iec.ch/en/publication/34421
  5. ISA, "ISA/IEC 62443 Series of Standards" (published parts and titles). https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
  6. European Commission, "Cyber Resilience Act - Standardisation" (last update 31 July 2026). https://digital-strategy.ec.europa.eu/en/policies/cra-standardisation
  7. Commission Implementing Decision (EU) 2025/138 of 28 January 2025 (EN 18031-1/-2/-3:2024 references, with restrictions). EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025D0138
  8. EUR-Lex, document information for Commission Delegated Regulation (EU) 2022/30 (application 01/08/2025; repealed by 2026/339 with effect from 11/12/2027). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32022R0030
  9. ETSI, ETSI EN 303 645 V3.1.3 (2024-09), "Cyber Security for Consumer Internet of Things: Baseline Requirements" (title page). https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf
  10. European Commission, "Cyber Resilience Act - Implementation" (last update 27 July 2026). https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation
  11. European Commission, "Radio Equipment Directive (RED)" page. https://single-market-economy.ec.europa.eu/sectors/electrical-and-electronic-engineering-industries-eei/radio-equipment-directive-red_en
  12. IEC, "IEC 62443-3-2:2020 … Part 3-2: Security risk assessment for system design", IEC Webstore (abstract). https://webstore.iec.ch/en/publication/30727

Spotted an error? Report it to our corrections log. Read our editorial methodology.