ETSI and 3GPP Joint Webinar on Security, Privacy and Trustworthiness for Integrated Sensing and Communications

ETSI has published GR ISC 004, the first consolidated set of ISAC security standards groundwork covering security, privacy, trustworthiness and sustainability for Integrated Sensing and Communications in 6G systems. The report identifies 19 key issues — 15 on security and privacy, 4 on sustainability — and feeds directly into 3GPP work on 5G-Advanced ISAC security and a planned 3GPP study on ISAC security for 6G. Nothing here is yet a harmonised standard, and nothing yet creates a conformity assessment obligation, but the technical requirements being consolidated now are the ones your radio equipment will be tested against later.

ISAC lets a 6G system communicate and sense its environment using the same radio resources. That means a base station or a device can detect, locate and track objects and people — including people who are not subscribers and who never agreed to anything. That single fact is what moves ISAC from an RF performance question into a data protection and product security question.

The ETSI Industry Specification Group on Integrated Sensing and Communications (ISG ISAC) was set up as a pre-standardisation body: its remit includes developing a roadmap of prioritised ISAC 6G use cases and sensing types not expected to be covered by 3GPP Release 19, developing advanced radio channel models, specifying KPIs and their evaluation methodology, studying architectural changes at system and RAN levels, and studying mechanisms in the system and RAN architectures to meet security and privacy requirements for sensing. The group's terms of reference explicitly include exchange with relevant standardisation bodies, including 3GPP and IEEE 802, so that those groups are informed of ISG ISAC output in their own specification development.

Three Group Reports are published. ETSI GR ISC 002 V1.1.1 was published in August 2025. ETSI GR ISC 003 V1.1.1, Integrated Sensing And Communications (ISAC); System and RAN Architectures, and ETSI GR ISC 004 V1.1.1, Integrated Sensing And Communications (ISAC); Security, Privacy, Trustworthiness and Sustainability, were both published in February 2026. GR ISC 004 is the deliverable of Release #1 Work Item #4.

ETSI announced GR ISC 004 on 2 March 2026. The report identifies 19 key issues, including 15 related to security and privacy and 4 focused on sustainability. Its main topics are protection against unauthorised use of 6G systems for sensing; safeguards against target-based eavesdropping and over-the-air signal manipulation; secure transport, storage and immutability of sensing data; consent, transparency and privacy-preserving mechanisms for sensing humans, both connected and non-connected; confidentiality in non-public and sensitive spaces; and sustainability challenges including power consumption, spectrum efficiency, environmental footprint and health considerations. ETSI states that the report consolidates potential technical and non-technical requirements that future 6G systems should meet to ensure ISAC services are secure, privacy-preserving, trustworthy and environmentally sustainable.

The ISG entered its second two-year release on 17 November 2025, following the leadership election of 21 October 2025. Release #2 Work Item #7 continues the security, privacy and trustworthiness thread. According to the work item overview presented to the EU Smart Networks and Services Joint Undertaking, the next Group Reports are scheduled with due dates in Q2 2026 and Q4 2027.

The fourth joint ETSI–3GPP ISAC webinar, scheduled for 26 November 2026 at 10:00 CET for 75 minutes, will present key outcomes from Release #1 WI #4, update on Release #2 WI #7, cover progress in 3GPP on 5G-Advanced ISAC security, and look ahead to the planned 3GPP study on ISAC security for 6G.

3GPP is running ISAC work in parallel and at a more specification-ready level. 3GPP published a status report on 18 August 2026 on ISAC architecture progress in both 5G and forward-looking 6G studies, based on a presentation by the co-rapporteurs of the 3GPP SA2 5G-Advanced ISAC Study Item, describing work to integrate sensing capabilities into future mobile network architectures. On the security side, 3GPP SA3 is handling 5G-Advanced ISAC security, and a dedicated study on ISAC security for 6G is planned.

Technical literature refers to a Release 20 SA3 study in draft TR 33.777 examining the security and privacy aspects of ISAC. That document reference is not confirmed by any of the official ETSI or 3GPP publications cited here, and should be treated as unverified until the specification appears in the 3GPP work programme.

The practical point for compliance teams: ETSI ISG ISAC produces Group Reports, which are informative pre-standardisation deliverables. A GR is not a harmonised standard, is not listed in the Official Journal, and confers no presumption of conformity. The requirements in GR ISC 004 become binding only if and when they are taken up in 3GPP specifications and subsequently in European harmonised standards.

There is currently no EU legal instrument that specifically regulates cellular sensing. The existing hooks are the ones already in force for radio equipment. Delegated Regulation (EU) 2022/30 made the essential requirements of Article 3(3)(d), (e) and (f) of the Radio Equipment Directive 2014/53/EU applicable to certain categories of radio equipment — protection of networks, protection of personal data and privacy, and protection against fraud — with application from 1 August 2025. EN 18031-1, EN 18031-2 and EN 18031-3 were published in January 2025 as harmonised standards supporting those requirements, with restrictions affecting presumption of conformity in relation to passwords, parental controls and secure updates.

Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027. Products with digital elements, including radio equipment, placed on the EU market on or after that date must comply with Regulation (EU) 2024/2847 (Cyber Resilience Act), published at OJ L, 2024/2847, 20.11.2024, with the cybersecurity objectives previously covered under RED Article 3(3)(d), (e) and (f) addressed under Annex I of the CRA. Manufacturer reporting obligations under the CRA apply from 11 September 2026.

The connection between ISAC trustworthiness work and these instruments is analytical, not legal. Protection of personal data and privacy under RED Article 3(3)(e), and the Annex I CRA essential requirements that replace it, are the obvious landing points for sensing-specific controls — consent and transparency for sensing non-connected humans, confidentiality in sensitive spaces, immutability of sensing data. That mapping is my inference from the content of GR ISC 004 and the scope of the existing instruments; no EU authority has stated it.

Network operators planning 6G, 3GPP delegates, IEEE 802 delegates, 6G ISAC industrial and academic research communities, and participants in EU Smart Networks and Services ISAC research projects are the stated target audience for the ETSI–3GPP work. Those are the organisations with a current input opportunity.

For manufacturers of radio equipment already on the market, there is no new obligation. The exposure is forward-looking: product architecture decisions taken now for sensing-capable equipment — where sensing data is processed, whether raw measurements leave the device, whether there is any consent or transparency mechanism for detected non-subscribers — will determine how expensive retrofitting becomes when the requirements harden.

Read GR ISC 004 against your own roadmap. Take the 15 security and privacy key issues and map each one to a product decision owner in your organisation; the ones that bite hardest in hardware are secure transport and storage of sensing data and immutability, because those constrain silicon and memory architecture, not firmware.

If you build radio equipment with any sensing or positioning function, treat the consent, transparency and privacy-preserving mechanisms for sensing humans — connected and non-connected — as a design input now, not a documentation exercise later. Retrofitting a consent model into a deployed RAN product is not realistic.

If you intend to influence the outcome, the input channel is ETSI ISG ISAC Release #2 Work Item #7 and 3GPP SA3. The planned 3GPP study on ISAC security for 6G has not yet started; contributions are cheaper than compliance.

For products shipping into the EU today, keep the existing programme on track: RED Article 3(3)(d), (e) and (f) with EN 18031-1/-2/-3 until 10 December 2027, then CRA Annex I from 11 December 2027, with CRA reporting obligations live from 11 September 2026.

The joint ETSI–3GPP ISAC webinar on 26 November 2026 will give the first consolidated public view of Release #2 WI #7 direction and the scope of the planned 3GPP 6G ISAC security study. The next ETSI ISG ISAC Group Reports carry due dates in Q2 2026 and Q4 2027. The operative EU deadline remains 11 December 2027, when Delegated Regulation (EU) 2022/30 is repealed and Regulation (EU) 2024/2847 applies in full.