What changed on 1 August 2025
RED 2014/53/EU always contained articles on network protection, personal data and fraud, but they only applied to product categories activated by a delegated act. Delegated Regulation (EU) 2022/30 did that, and its requirements have applied since 1 August 2025. For the smart glasses category the regulation is unusually direct: it lists glasses as an example of wearable radio equipment. That removes the argument that a pair of audio glasses is just an accessory. A product placed on the EU market after that date has to show conformity with the activated requirements as part of its RED declaration.
The practical change for brands is that cybersecurity is now part of CE marking rather than a voluntary feature. A pair that pairs with a phone app, stores account data, uploads audio for translation or transfers photos over Wi-Fi now carries obligations that a lab will test and document, in the same file as the spectrum and EMC reports.
Three requirements, three standards
The activated articles each protect a different interest, and each has a part of EN 18031 as its harmonised standard. The standards were referenced through Implementing Decision (EU) 2025/138.
| RED article | Interest protected | Harmonised standard | Where it touches smart glasses |
|---|---|---|---|
| 3(3)(d) | No harm to networks or misuse of network resources | EN 18031-1 | Wi-Fi transfer on camera models, cloud-connected AI and translation features |
| 3(3)(e) | Protection of personal data and privacy | EN 18031-2 | Microphone audio, photos and video, account data, location from the paired phone |
| 3(3)(f) | Protection from fraud | EN 18031-3 | Only where the product handles payments or monetary value, which is rare in this category |
Which articles apply to a given product is a scoping decision that depends on its connectivity and the data it processes. A Bluetooth-only audio pair with a simple app and an AI camera pair with Wi-Fi and a cloud account will not have the same scope. That decision should be made with the test lab and written into the test plan, not assumed from a competitor's declaration.
What the standards look at in a glasses design
EN 18031 is written around assets - the things worth protecting, such as personal data, credentials and network functions - and the security mechanisms that protect them. The lab works through the product's assets and checks whether the relevant mechanisms are present and documented. In a smart glasses program, the areas that come up most are:
- Pairing and authentication. How the glasses and the app establish trust, whether default credentials exist and how they can be changed.
- Software updates. Whether over-the-air firmware updates are authenticated and how the product behaves if an update fails; see firmware update failures.
- Data storage and transfer. How audio, photos and account data are stored on the glasses, in the app and in the cloud, and how they are protected in transit.
- Deletion and reset. Whether a user can remove personal data before resale or return.
- Documentation. A description of the security design that the lab can assess, which plants and app vendors often need to prepare from scratch.
Much of this sits outside the glasses themselves, in the companion app and the cloud service. That is why the app vendor, not only the hardware plant, needs to be part of the conversation. On private label programs where the app is white-labelled, confirm who maintains the app and who provides the documentation the lab will ask for. The app and firmware side is covered on firmware and app.
Restrictions, notified bodies and documentation
When the EN 18031 standards were cited in the Official Journal, the citation came with restrictions on certain clauses. Where a restriction applies to a design, applying the standard does not give a full presumption of conformity for that aspect, and a notified body assessment may be needed. Whether this affects a particular product depends on how it implements functions such as authentication and access control. This is exactly the kind of point to raise with the lab at quotation rather than after testing. It is also a point where counsel should be involved if the route is unclear.
The move to the Cyber Resilience Act
The RED cybersecurity requirements are not the end state. From 11 December 2027, these requirements are taken over by the Cyber Resilience Act, through Delegated Regulation (EU) 2026/339, so the legal basis for the same protection goals changes on that date. For a brand launching now, the practical reading is that work done for EN 18031 is not wasted - pairing, update and data handling designs carry forward - but the documentation and obligations will change for products placed on the market after that date. Programs with long sales lives should ask the plant and the app vendor how they plan to support the CRA transition, including how long security updates will be provided. The legal detail of the transition should be confirmed with counsel.
A buyer checklist
- Describe the connectivity. Bluetooth only, Bluetooth plus Wi-Fi, cloud features, camera, account login.
- Identify the app owner. Plant app, white-label app from a vendor, or the brand's own app.
- Ask for the EN 18031 scope and report. On catalog models, check that the report covers the firmware and app version that will ship.
- Agree update support. How long firmware and app security updates will be provided, in writing.
- Plan for 2027. Ask how the file will move to the CRA regime.
The broader certification map is on compliance and certifications. Cybersecurity testing adds to lab time, so plan it against the ranges on MOQ and lead time, and describe your app and connectivity on the quote form so the desk can shortlist plants that have run EN 18031 before.