{"id":12254,"date":"2025-11-06T16:30:30","date_gmt":"2025-11-06T14:30:30","guid":{"rendered":"https:\/\/www.phoenixcontact-emobility.com\/?p=12254"},"modified":"2025-11-25T09:45:07","modified_gmt":"2025-11-25T07:45:07","slug":"cybersecurity-for-ac-charging-infrastructure-red-and-cra","status":"publish","type":"post","link":"https:\/\/www.phoenixcontact-emobility.com\/en\/news-and-events\/charging-infrastructure\/cybersecurity-for-ac-charging-infrastructure-red-and-cra\/","title":{"rendered":"Cybersecurity for AC charging infrastructure: How CHARX control modular complies with RED and CRA"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The new reality for connected charging points.<\/h3>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Today, charging infrastructure is more than just technology for refueling with electricity. It is part of a digital ecosystem with wireless modules, backend communication, user identification, and payment processing. This also drastically increases the requirements for its cybersecurity. And legislation is following suit.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Since August 1, 2025, the Delegated Regulation to the RED Directive (EU 2022\/30) has been binding. It obliges manufacturers of radio equipment \u2013 including charging points with RFID, Wi-Fi, or cellular communication \u2013 to comply with strict security requirements. Technical implementation is carried out via the harmonized standards EN 18031-1, -2, and -3, which define requirements for network resilience, data protection, and fraud protection. Only those who fully implement these standards can claim “presumption of conformity.” This is a decisive advantage for CE marking.
But the RED is only the beginning: on December 10, 2024, the Cyber Resilience Act (CRA) came into force. The first reporting requirements for security incidents will apply from September 11, 2026, with full compliance required from December 11, 2027.<\/p>

The CRA significantly expands the scope of application: it affects all products with digital elements, regardless of whether they contain wireless modules. The aim is to create uniform cybersecurity requirements throughout the entire product lifecycle: from development and maintenance to vulnerability reporting.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Why both laws are important and how they are related<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The RED Delegated Regulation and the CRA pursue the same goal: greater cybersecurity for digital products. While the RED focuses on radio equipment, the CRA is much broader in scope. According to ENISA and CENELEC, the EN 18031 standards developed for the RED also serve as the technical basis for CRA compliance.<\/p>

This means that anyone who develops RED-compliant products today will be prepared for the Cyber Resilience Act tomorrow.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

CHARX control modular: The answer to regulatory and technical challenges<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With a specialized development team, Phoenix Contact is constantly working to keep the software for the AC charging controller CHARX control modular<\/a> up to date and improve it. This ensures that CHARX control modular always meets the latest security requirements and closes security gaps reliably and promptly. In addition, the charging controller meets the requirements of the RED directive and is prepared for the requirements of the Cyber Resilience Act.<\/p>

The following features ensure security at all required levels:<\/p>