EN 18031 · RED 2014/53/EU · CYBER RESILIENCE ACT — for connected-product brands selling in the EU
Your CE technical file, built and attacked before an auditor ever sees it.
Since August 2025, every Wi-Fi and Bluetooth product sold in the EU needs a cybersecurity assessment under EN 18031. Consultants charge €3,800–15,000 per product and take weeks. Konform generates the assessment and the technical file, runs a hostile verification pass against every claim, and hands you an audit-ready dossier — from €400 per SKU.
Documentation support — not certification. The difference matters, and we put it in writing.
AH-W1-CYB-001 · V1.1 · SAMPLE
RED Cybersecurity Assessment & Technical Documentation Package
AuraPlug W1 · Wi-Fi smart plug · EN 18031-1/-2:2024
| AUM-1 | Default credentials operable unchanged FAIL |
| SUM-2 | Signed OTA, ECDSA P-256 chain PASS |
| SCM-4 | Replay protection — no test record OPEN |
| CCK-3 | Static default secret present FAIL |
| CRY-1 | SOG-IS agreed mechanisms only PASS |
31 requirements · derived totalsprovenance-tagged
§01 — The regulatory clock
Four deadlines. None of them move.
The EU spent 2025–26 softening its reporting mandates — and left every product-conformity mandate untouched. If you ship connected hardware, this is your calendar now.
EN 18031 mandatory
Cybersecurity essential requirements under RED apply to all internet-connected radio equipment. In force — today.
CRA reporting begins
24-hour early warning and 72-hour notification for exploited vulnerabilities — including products already on the market.
Machinery Regulation
Regulation (EU) 2023/1230 replaces the Machinery Directive. No transition for products placed after this date.
CRA in full
Annex VII technical documentation, SBOM, support-period declaration — for every product with digital elements.
§02 — Method
Generate. Attack. Tag. Then a human signs.
Most AI document tools have one model write something plausible and stop. Plausible is exactly what gets you excluded at audit. Konform is built around the opposite instinct.
Structured intake, grounded generation
You answer a product questionnaire and upload what you have — schematics, test reports, SDK docs. The assessment is drafted against the normative clause text of the licensed standards, never a paraphrase. That distinction is written into the OJEU citation itself.
A second system tries to destroy the draft
Before you see anything, an adversarial pass reviews the dossier the way a market-surveillance authority or competing consultant would: unverifiable claims, arithmetic that doesn't derive, verdicts without clause anchors, wrong standards in the DoC. What it finds gets fixed or flagged — never shipped silently.
Every verdict carries its evidence tag
Nothing in a Konform dossier claims to be "verified" unless someone verified it. Each verdict is tagged — declared, documented, or tested — and the Declaration of Conformity stays locked in draft until your responsible person signs. We never sign. That's the law, and it's also the point.
§03 — Verification, shown not told
We ran our own hostile review on our own sample. Here's what it caught.
DRAFT v1.0, ANNEX A: Declaration of Conformity cited EN 62368-1 as the safety standard for a mains smart plug.
The conventional standard for that product class is EN 60669-2-1 (electronic switches). A competing consultant would use this single line to discredit the entire file.
RESOLVED in v1.1 — DoC restructured to Annex VI; safety standard corrected; change recorded in document history.
The first draft of our own sample dossier went through the same adversarial pass every customer dossier gets. The reviewer found ten defects — including three we're glad no customer ever saw:
- A fabricated privacy section. The draft assessed EN 18031-2 with invented GDPR-style criteria instead of the standard's real mechanism families. Rebuilt from the actual structure.
- Arithmetic that didn't derive. Headline totals summed to 35 against a 31-requirement register. Every number is now derived from the register — or it doesn't appear.
- "Verified by scan" — by nobody. Observational language on evidence no one had observed. Every claim now carries a provenance tag instead.
A compliance product that can't audit itself has no business auditing your product. This page shows our findings because your auditor will look for the same ones.
§04 — The provenance rule
Three tags. No exceptions.
The fastest way to lose an audit is a technical file that overstates its own evidence. Every verdict in a Konform dossier declares exactly what it rests on:
§05 — The arithmetic
Same file. Different decade.
| Compliance consultant | Konform | |
|---|---|---|
| One product's EN 18031 assessment + technical file | €3,800 – €15,000 | from €400 |
| Turnaround | 4–10 weeks | Days — most of it your evidence gathering |
| When a harmonised standard changes | New engagement, new invoice | Affected sections flagged & regenerated — included |
| Your 40-SKU catalogue | €150,000+ | €690/month, all SKUs monitored |
| Tells you when you're not ready | Sometimes | Always. Our sample dossier fails its own product — on purpose |
§06 — Pricing
Priced against the consultant, not the template.
First assessment
€400 / SKU, one-time
- Full EN 18031-1/-2 requirement register — 31 requirements, derived totals
- RED Annex V technical file index with blocker classes
- Findings, remediations & draft Declaration of Conformity
- Hostile verification pass included
- CRA forward-mapping for every artefact
Portfolio
€690 / month, up to 50 SKUs
- Everything in First assessment, for every SKU
- Standards watch: OJEU citations, restriction changes, CRA harmonised standards — affected dossiers flagged & regenerated
- EPR registration tracking per marketplace & country
- CRA readiness: SBOM scaffolding, support-period declarations, incident-reporting runbook
- Marketplace document packs (Amazon, Etsy compliance requests)
Signed
Custom / with human sign-off
- Everything in Portfolio
- Review & counter-signature by a partner EU Responsible Person
- Notified-body coordination where presumption of conformity is unavailable
- In preparation — join the waitlist to be first
§07 — What we are not
Read this before you pay us anything.
- We are not a certification body. Konform produces audit-ready documentation. Conformity is declared by you, on your responsibility — that is how CE self-declaration works, and anyone who tells you otherwise is selling you a liability.
- We do not replace your lab. Functional evidence — scans, update tests, RF reports — comes from real testing. We orchestrate it, structure it, and tell you exactly what's missing. We don't invent it, and our provenance tags make that impossible to hide.
- Our sample dossier fails its own product. The AuraPlug W1 sample ships with two non-conformities and a blocked Declaration — because a tool that always says yes is worthless to you and dangerous to your director, who signs. Read the live sample report →
§08 — Questions
Asked by every brand we've spoken to.
Does my product actually need an EN 18031 assessment?
Is an AI-generated assessment even acceptable?
What happens when the standards change?
Amazon asked me for compliance documents. Can you help before they delist?
Why should I trust this over a consultant?
We onboard five brands per month during beta.
Connected-product brands with 5–300 SKUs selling into the EU. First assessment delivered within days of intake — priority to catalogues facing the 11 Sep 2026 CRA reporting date.
Received. We reply within two working days, from a person.
No newsletter. No "content". One reply, from a person.