Who Enforces EN 18031? The Real State of RED Cybersecurity Audits and Fines, One Year In

EN 18031 became mandatory for the RED Directive cybersecurity requirements, Articles 3.3(d), 3.3(e) and 3.3(f), on 1 August 2025. A year later, manufacturers keep asking two questions: who exactly can audit and fine us, and is anyone actually doing it?

EN 18031 compliance is enforced by national Market Surveillance Authorities (MSAs). Regulation (EU) 2019/1020 requires each Member State to designate one or more authorities per product sector, radio equipment included. They coordinate at EU level, but the inspection, the corrective order and the fine always come from a national body.

For Italy, the official MIMIT page on market surveillance assigns coordination to the Directorate-General for Digital and Telecommunications through ISCTI. The ministry's territorial inspectorates carry out inspections and act as the sanctioning authorities, technical testing goes to the public Eurolab Radio or accredited laboratories, and the postal and communications police collaborate.

In Ireland, ComReg is the sole MSA for the RED and runs recurring inspection campaigns on radio equipment sold in the country.

EU law never uses the word audit. Regulation 2019/1020 speaks of documentary checks and, where appropriate, physical and laboratory checks. Article 14 lets MSAs demand technical documentation, access embedded software where needed, carry out unannounced inspections and acquire samples. In practice, a check on the RED cybersecurity requirements follows a recognisable sequence:

Notice where the sequence starts: with your paperwork. A product whose documentation never mentions the cybersecurity requirements can be found non-compliant before anyone connects it to a test bench.

The most transparent authority so far is the Dutch RDI. It maintains a dedicated RED 3.3 page and an IoT test lab where inspectors verify whether products meet the cybersecurity requirements applicable since 1 August 2025: password policies, update mechanisms, connection security and account deletion on smart doorbells, baby monitors, routers and smartwatches, including penetration tests. In June 2026 the RDI even won an innovation award for an AI firmware vulnerability scanner its inspectors use to prioritise findings. A European MSA is testing products against RED 3.3 today.

Germany shows the scale of the machinery this plugs into. In its 2025 market surveillance results, the Bundesnetzagentur reported deficiencies affecting 7.7 million devices, with 8,202 suspicious customs consignments (89 percent non-compliant) and over 359,000 items stopped at the border. One honest caveat: those figures cover all RED essential requirements, not cybersecurity specifically. BNetzA also publishes a running list of market-restricting measures naming individual products barred from the market, with entries added as recently as January 2026. Bans against named products are routine business, and cybersecurity is now one more ground for them.

Is there a documented EN 18031 case? One, with a caveat. Compliance provider TecEx published a 2026 case study describing a smart-home gateway launched in four EU markets in September 2025 with a valid CE mark but no Article 3.3(d)/(e)/(f) assessment in its file. A routine documentation audit caught the gap and the product spent 11 weeks off the market while the EN 18031 assessment and an updated Declaration of Conformity were produced. Manufacturer and authority are anonymised, so treat it as industry evidence, not an official decision.

And the fines? Do not expect a press release. In most member states a RED fine is an administrative decision that is never published with the company's name; of the authorities above, only the Dutch RDI names fined companies by default. France's ANFR even documents the administrative fine as a standard step of the same procedure that produces withdrawals and recalls. The visible actions are the bans and suspensions; the fines attached to the same procedures stay out of the public record. Their absence from the news is invisibility, not inaction.

The RED sets the obligations, but penalties live in national law, so exposure differs by country. Three verified examples:

Sources: the German Funkanlagengesetz Section 37, the Irish European Union (Radio Equipment) Regulations 2026, and the Italian d.lgs. 22 June 2016, n. 128. Note the Italian per-unit multiplier: on 10,000 devices it alone can exceed the headline fine.

The fine is rarely the expensive part, though. The real cost sequence is: documentation request, non-compliance finding, sales suspension while you remediate, possible withdrawal or recall, and propagation to other Member States. The anonymised gateway case burned 11 weeks of revenue across four markets before any fine entered the picture.

So, who enforces EN 18031 and are they already doing it? National market surveillance authorities enforce it: BNetzA in Germany, RDI in the Netherlands, MIMIT's territorial inspectorates in Italy, ANFR in France, ComReg in Ireland. And enforcement has started: documentation checks are routine, the Dutch RDI is penetration-testing products against RED 3.3, and national laws already price non-compliance at up to 100,000 euro in Germany, 500,000 euro in Ireland, and per-unit fines in Italy.

The first legal actions are on the books; the fines that follow them are simply not published with names. It is still the cheapest moment to get compliant: the machinery is running, and the authorities' first question will be for your technical file, not your firmware. If that file already demonstrates EN 18031, the audit is an exchange of documents. If it does not, everything that follows runs on the regulator's schedule.

Every enforcement path in this article starts with the same request: show us your Declaration of Conformity and technical documentation. RedComply exists so that request never finds you unprepared.

Market surveillance is no longer theoretical. Visit redcomply.com and have your answer ready before the request arrives.