EN 18031 is the European standard family that addresses cybersecurity for radio equipment — the category a charger joins when it carries Wi-Fi, Bluetooth, cellular or RFID. Which parts of it reach a given charger, and what evidence closes the question, is established for the exact model with a test laboratory or notified body working from the current framework text. It is never read off a feature list: an app or an OCPP line states a capability, not an assessment.
Key Takeaways
- EN 18031 is the European cybersecurity standard family for radio equipment; the radio module is the trigger.
- Each area is closed with a laboratory document for the exact model — never with a feature list.
- Each market’s version of the question is a separate scope decision on the same configuration.
- No EVDANCE listing claims a cybersecurity certification; connected models’ positions are written confirmations.
Why a Charger Is in Scope at All
The trigger is the radio, not the charging. A basic unit with no radio sits outside this standard family entirely. Add a radio module — for an app connection, networked operation or contactless access — and the product is radio equipment with data to protect, and the European framework asks cybersecurity questions of it through standards such as the EN 18031 family. The maker’s first task is a scope decision per model and per variant: the same charger sold with and without a radio module is two different compliance stories. How connected chargers work is covered in our guide to how smart EV chargers work.
The Requirement Areas, and What Closes Each
| Area | Why a connected charger touches it | The confirmation that closes it |
|---|---|---|
| The radio link itself | The wireless connection is the entry point every other protection assumes | The lab’s assessment of the exact model’s radio configuration |
| Access and credentials | Accounts, cards and pairing decide who can start, stop or reconfigure a session | How access is granted and revoked, as assessed — not as a brochure describes it |
| Data the unit holds and sends | Session records, user data and network traffic cross the radio link | The model’s data handling, stated in its file for the assessed configuration |
| Software over the product’s life | The security position changes as vulnerabilities are found and fixed | The update route for the exact model, and who operates it, in writing |
| The service behind the unit | An app or platform compromise reaches every connected charger on it | Whose service it is, and its own security evidence — asked, not assumed |
Note what the right-hand column never says: a clause number or a pass mark quoted from memory. Those live in the laboratory’s documentation for the assessed model — the same documentary discipline behind the wider conformity file described in our guide to CE marking for private-label EV chargers.
And Beyond: the File Around It
Cybersecurity does not stand alone in a connected charger’s file. It sits beside the radio, safety and EMC assessments for the same model, and other markets run their own versions of the question: Great Britain, for example, sets security requirements for smart charge points inside its own regulations — a separate text and file, linked below. A maker selling into several markets keeps one scope decision per market, all tied to the same configuration. A firmware change, a new radio module or a new backend service reopens each of them.
EVDANCE’s Connected Models, as Listed
Two EVDANCE models state connected features: the EV-ACS3210E 32 A Type 2 portable charger (single-phase, about 7 kW, IP66), whose listing states an app and energy monitoring and describes the unit as OCPP-ready, and the EV-ACT3204PE 22 kW three-phase wallbox (Type 2, IP66, CE), whose listing states RFID and app. No EVDANCE listing claims a cybersecurity certification for any model, and “OCPP-ready” is a protocol phrase, not security evidence. For a connected model bound for Europe, the areas above are closed per model with EVDANCE in writing, through the OEM and private-label programme or by contacting us.
Frequently Asked Questions
Does EN 18031 apply to every EV charger?
No. It addresses radio equipment: a charger with no radio module sits outside the family, and a connected variant is a separate scope decision. Which parts apply is confirmed with the laboratory or notified body for that model.
Our charger has an app and OCPP. Is that cybersecurity compliance?
No. An app is a feature and OCPP is a communications protocol; neither is a security assessment. Compliance is the assessed file behind the exact model — the same distinction our certifications guide draws for marks generally.
Who tells us which requirements apply to our model?
The test laboratory or notified body you engage for the model, working from the current framework text. Distributors and retailers will ask for the resulting documents, so keep them with the model’s compliance file.
Related Reading
- How Do Smart EV Chargers Work?
- CE Marking for Private-Label EV Chargers Sold in the EU
- EV Charger Certifications Explained: CE, UKCA, UL, ETL, CB and What Buyers Should Ask For
- Smart vs Non-Smart EV Chargers: What Installers Actually Want
