registerlevel emre@registerlevel.com

EN 18031 firmware work for ESP32 products.

Since 1 August 2025, every Wi-Fi and Bluetooth product sold in the EU has to meet EN 18031. We take your firmware through its eleven security mechanisms at a fixed price, with a fixed end date, and keep it open if your customers flash their own builds.

Email about a gap check See prices

EN18031_1_STATUS EN 18031-1, clause 6: security mechanisms

The eleven EN 18031-1 security mechanisms, each set to 1 once implemented and documented
CRY6.11 GEC6.10 CCK6.9 TCM6.8 NMM6.7 RLM6.6 SCM6.5 SSM6.4 SUM6.3 AUM6.2 ACM6.1
1 1 1 1 1 1 1 1 1 1 1

?not yet assessed1implemented, tested and documented, or shown not to apply

What each field asks of your product

Not every mechanism applies to every device. Traffic control, for example, is mostly for routers. The gap check tells you which ones apply to yours and where you stand on each.

ACM6.1
Access controlOnly the right people and apps can use each function.
AUM6.2
AuthenticationPasswords and keys that are unique per device and can't be skipped.
SUM6.3
Secure updateFirmware updates are authenticated and checked for integrity.
SSM6.4
Secure storageSecrets and settings stay protected on the device.
SCM6.5
Secure communicationTraffic to apps and the cloud is encrypted and authenticated.
RLM6.6
ResilienceThe device keeps working, or recovers, when the network is attacked.
NMM6.7
Network monitoringNetwork equipment notices attacks on the network it serves.
TCM6.8
Traffic controlNetwork equipment filters the traffic it passes on.
CCK6.9
Confidential cryptographic keysKeys are generated, stored and used safely.
GEC6.10
General equipment capabilitiesNo known exploitable vulnerabilities, no needless open services, inputs checked.
CRY6.11
CryptographyCurrent algorithms and key lengths, nothing home-made.

The password rule

If the user can skip setting a password, EN 18031-1 gives no presumption of conformity.

From the EU decision that harmonised the standard, Implementing Decision (EU) 2025/138.

Many open-firmware devices ship with an open web interface and an optional password. As they stand, they can't rely on the standard to self-declare.

The fix doesn't require a closed device. A password set at first setup, unique per device, plus authenticated vendor updates, and owners can still flash their own builds.

Ordering information

Three fixed-price jobs. Most clients start with the gap check.

PartJobIncludesPriceLead time
RL-GAP Gap checkCredited in full against a sprint booked within 30 days.
  • Firmware, setup flow and docs reviewed against all eleven mechanisms
  • Each gap with its clause and the fix, ranked by effort
  • Walkthrough call
 EUR 950 1 week
RL-OPEN Readiness sprintFor Tasmota, ESPHome, WLED or your own open firmware. Owners can still reflash.
  • Password at first setup, unique per device
  • Authenticated, integrity-checked vendor updates
  • SBOM, vulnerability scan, disclosure policy
  • Evidence pack mapped to each clause
 from EUR 4,500 3–4 weeks
RL-LOCK Lockdown sprintFor products whose owners should never reflash. Proven on sacrificial boards first.
  • Everything in RL-OPEN
  • Secure Boot v2 and flash encryption
  • Signed OTA with anti-rollback
  • JTAG and UART lockdown, factory provisioning
 from EUR 7,500 4–6 weeks

Fixed scope and end date agreed in writing, 30-day bug warranty on every sprint. We implement and document; you sign your own Declaration of Conformity.

How a job runs

  1. You describe the product

    A few lines on the device and access to the firmware repository.

  2. We fix the scope

    Price, deliverables and end date agreed in writing before work starts.

  3. We do the work

    In your codebase, tested on your hardware, with progress you can see.

  4. You get the evidence

    Code, documentation and the clause-by-clause file, plus 30 days of fixes.

Who you work with

Emre, embedded engineer: ESP-IDF, Wi-Fi and BLE firmware, hardware bring-up. Based in Ankara, working remotely with companies selling into the EU.

Email Emre