European Union - Wireless / IoT device
CE marking and compliance requirements for wireless / IoT device
Connected devices whose core function depends on a radio link. Radio compliance, hazardous substances, product cybersecurity and general safety all apply.
For example: Bluetooth tracker tag, Wi-Fi air quality monitor, LoRaWAN sensor, Zigbee hub.
Radio equipment is excluded from the EU EMC Directive and LVD — their objectives are applied through RED Article 3.1 instead, so the EMC/LVD ids are intentionally not listed. Since 1 August 2025 the RED cybersecurity delegated regulation (EU) 2022/30 adds network-protection, privacy and anti-fraud requirements for internet-connected radio equipment. The EU Cyber Resilience Act is listed in base because IoT devices are 'products with digital elements' — its full requirements bite from 11 December 2027 (reporting from 11 September 2026). UK PSTI applies to consumer connectable products from 29 April 2024. US: FCC certification via a Telecommunication Certification Body is required for intentional radiators; NRTL listing appears only if mains-powered.
Base requirements7 instruments
Horizontal cybersecurity requirements for 'products with digital elements' — connectable hardware and software. In force since 10 December 2024; vulnerability/incident reporting duties start 11 September 2026 and the main obligations (including CE marking against the CRA) apply from 11 December 2027.
Key obligations
- 01Design, develop and produce the product in line with the essential cybersecurity requirements of Annex I, based on a documented cybersecurity risk assessment ('security by design').source
- 02Handle vulnerabilities for the product's support period, which must reflect the time the product is expected to be in use — generally no less than five years — including providing security updates.source
- 03From 11 September 2026: report actively exploited vulnerabilities and severe incidents — early warning within 24 hours of awareness, full notification within 72 hours, and a final report within 14 days (vulnerabilities) or one month (incidents) — via the CRA Single Reporting Platform to your CSIRT coordinator and ENISA.source
- 04Carry out a conformity assessment, draw up technical documentation and an EU Declaration of Conformity, and affix the CE marking before placing the product on the market (from 11 December 2027).source
The EU's baseline safety law for consumer products, applicable since 13 December 2024. It replaces the General Product Safety Directive and adds duties around traceability, online selling, recalls and having a responsible economic operator in the EU.
Key obligations
- 01Only place safe products on the market. Safety is assessed against the product's characteristics, packaging, instructions, the consumers who will use it, its appearance (food-imitating products) and, where relevant, cybersecurity features.source
- 02A product may only be placed on the EU market if there is a responsible economic operator established in the EU — an EU manufacturer, importer, authorised representative or fulfilment service provider (Article 16).source
- 03Carry out an internal risk analysis and draw up technical documentation; keep product identification and traceability information available (manufacturers, importers and distributors each have tiered duties).source
- 04Report accidents caused by your products and notify dangerous products to the authorities through the Safety Business Gateway.source
The EU's enforcement framework for product rules. Its Article 4 is the practical blocker for online sellers: since 16 July 2021, most CE-marked goods can only be placed on the EU market if an economic operator established in the EU is responsible for compliance tasks — and that operator's contact details must accompany the product.
Key obligations
- 01A product covered by the Article 4 list may only be placed on the EU market if there is an economic operator established in the Union responsible for the Article 4 tasks (applies since 16 July 2021).source
- 02That operator can be: the manufacturer established in the EU; an importer (where the manufacturer is not established in the EU); an authorised representative with a written mandate; or an EU-established fulfilment service provider handling the products (Article 4(2)).source
- 03The operator's tasks (Article 4(3)): verify that the EU Declaration of Conformity and technical documentation exist and keep the DoC available; provide information and documentation to authorities on request; inform authorities when a product presents a risk; cooperate on corrective action.source
- 04The name, registered trade name or trade mark and contact details (including postal address) of the Article 4 operator must be indicated on the product or on its packaging, the parcel or an accompanying document (Article 4(4)).source
The CE framework for anything that intentionally transmits or receives radio waves — Wi-Fi, Bluetooth, cellular, NFC and more. It bundles safety, EMC and spectrum requirements, and since 1 August 2025 adds mandatory cybersecurity requirements for internet-connected radio equipment under Delegated Regulation (EU) 2022/30.
Key obligations
- 01Meet the essential requirements of Article 3: (1)(a) health and safety (incorporating the LVD safety objectives), (1)(b) electromagnetic compatibility, and (2) effective and efficient use of radio spectrum to avoid harmful interference.source
- 02From 1 August 2025, meet the cybersecurity essential requirements of Article 3(3)(d) (network protection), (e) (personal data and privacy) and (f) (protection from fraud) activated by Delegated Regulation (EU) 2022/30 for the radio equipment categories it covers (internet-connected radio equipment; childcare, toy and wearable radio equipment for point (e); equipment handling virtual money for point (f)).source
- 03Draw up technical documentation (Annex V), perform a conformity assessment (Article 17), issue the EU Declaration of Conformity, affix CE marking, and keep documentation for 10 years (Article 10).source
- 04Include in the instructions the frequency band(s) the equipment operates in and the maximum radio-frequency power transmitted, plus any usage restrictions; supply the EU DoC or a simplified DoC with a link to the full version (Article 10).source
The EU's chemicals regulation. For physical-product (article) sellers the practical duties are: communicating Candidate List substances of very high concern (SVHCs) above 0.1% down the supply chain and to consumers, notifying ECHA in some cases, and respecting the Annex XVII restrictions. Full chemical registration applies to substance manufacturers/importers, not typical article sellers.
Key obligations
- 01Article 33(1): if an article contains a Candidate List SVHC above 0.1% weight by weight, provide recipients (businesses in the supply chain) with sufficient information for safe use — at minimum the name of that substance. This applies per article within a complex product.source
- 02Article 33(2): on request from a consumer, provide the same safe-use information (at minimum the substance name) within 45 days, free of charge.source
- 03Article 7(2): EU producers/importers of articles must notify ECHA when a Candidate List substance is present above 0.1% w/w AND its total quantity in those articles exceeds 1 tonne per producer/importer per year — no later than 6 months after the substance is added to the Candidate List. Notification is not required where exposure of humans and the environment can be excluded.source
- 04Notify articles containing Candidate List SVHCs above 0.1% w/w to ECHA's SCIP database (a duty under the Waste Framework Directive, submitted via ECHA).sourceUnverified — check source
Restricts ten hazardous substances — including lead, mercury, cadmium and four phthalates — in electrical and electronic equipment. Compliance is self-assessed, documented through material declarations, and forms part of the CE marking.
Key obligations
- 01Ensure homogeneous materials do not exceed the Annex II maximum concentrations: 0.1% by weight for lead, mercury, hexavalent chromium, PBB, PBDE, DEHP, BBP, DBP and DIBP; 0.01% for cadmium.source
- 02The four phthalates (DEHP, BBP, DBP, DIBP) were added by Delegated Directive (EU) 2015/863 and apply to most EEE from 22 July 2019 (medical devices and monitoring/control instruments from 22 July 2021).source
- 03Carry out the internal production control procedure in line with Module A of Decision 768/2008/EC, draw up technical documentation, and keep it (with the EU Declaration of Conformity) for 10 years (Article 7).source
- 04Draw up an EU Declaration of Conformity and affix the CE marking to the finished product (Article 7).source
Extended producer responsibility for electronics: producers must register in each EU country where they sell, finance the collection and recycling of e-waste, and mark products with the crossed-out wheeled bin symbol. It is a waste-law obligation, separate from CE marking.
Key obligations
- 01Register as a producer in the national WEEE register of each Member State where you place EEE on the market before selling there (Article 16).source
- 02Finance at least the collection, treatment, recovery and environmentally sound disposal of WEEE from private households (Article 12; Article 13 covers non-household WEEE) — in practice usually via a producer compliance scheme.source
- 03Distance sellers: appoint an authorised representative in each Member State where you sell but are not established, to fulfil the producer obligations there (Article 17).source
- 04Mark EEE with the crossed-out wheeled bin symbol shown in Annex IX (Article 14(4)), plus a mark identifying that it was placed on the market after 13 August 2005 (Article 15(2)).source
If your product also...
Extra regulations triggered by specific features
Contains a battery
Intended for or marketed to children (under 14)
Documents you will need
Deduplicated across the regulations above
- Cybersecurity risk assessmentDocumented and kept up to date; feeds design decisions and the technical documentation.source
- Technical documentation + EU Declaration of ConformityCovering Annex I essential requirements and the vulnerability handling processes.source
- User information and instructionsIncluding the support period end date and how users receive security updates.source
- Technical documentationBased on an internal risk analysis; must describe the product and its safety-relevant characteristics. No EU Declaration of Conformity is required under the GPSR itself.source
- Traceability informationProduct identification (type/batch/serial) plus manufacturer and EU responsible operator contact details must accompany the product.source
- Written mandate (when using an authorised representative)The authorised representative must hold a written mandate covering the Article 4 tasks.source
- EU Declaration of Conformity + technical documentation availabilityThe EU operator must be able to verify these exist and produce them for authorities on request.source
- EU Declaration of ConformityFull or simplified version (with internet link to the full DoC) must accompany the equipment; kept 10 years.source
- Technical documentation (Annex V)Includes risk analysis, design/manufacturing details, test reports covering all applicable Article 3 requirements.source
- Instructions with radio informationMust state frequency bands and maximum transmitted RF power, plus safety information and any usage restrictions.source
- Supplier declarations / full material disclosuresEvidence that Candidate List SVHCs are below 0.1% w/w per article, or the basis of your Article 33 communications.source
- Article 33 safe-use communicationsRecords of the information passed to recipients and provided to consumers within the 45-day deadline.source
- Technical documentation per EN IEC 63000Material declarations, analytical test reports and supplier certificates organised per the harmonised documentation standard.source
- National producer register entries and registration numbersMany Member States require the WEEE registration number on invoices/webshop; requirements vary nationally.source
- User informationInstructions/packaging must inform users about separate collection and the crossed-out bin symbol.source
- Treatment information for recyclersFree of charge, identifying components, materials and the location of dangerous substances (Article 15).source
Frequently asked
When do I actually have to comply with the Cyber Resilience Act?+
Two dates matter: from 11 September 2026 you must report actively exploited vulnerabilities and severe incidents (24-hour early warning), and from 11 December 2027 every product with digital elements placed on the EU market must meet the full requirements and carry CE marking against the CRA.
My product already has CE marking — does the GPSR still apply?+
Yes, partially. Sector CE legislation takes precedence for the risks it covers, but GPSR duties that go beyond it — such as the responsible EU economic operator, online marketplace rules, accident reporting and recall remedies — still apply to consumer products.
I sell CE-marked products online from outside the EU — do I need someone in the EU?+
Yes, for products on the Article 4 list (most CE-marked consumer goods). Since 16 July 2021 they can only be placed on the EU market if an EU-established economic operator — importer, authorised representative or fulfilment service provider — is responsible for the compliance tasks, and their details must accompany the product.
My product has Bluetooth — which directives apply, RED or LVD/EMC?+
The RED alone. Radio equipment is excluded from the LVD and EMC Directives; the RED incorporates their safety and EMC essential requirements, so your Declaration of Conformity cites 2014/53/EU.
I sell finished products, not chemicals — does REACH really apply to me?+
Yes, in a limited way. You don't register chemicals, but you must know whether any Candidate List substance of very high concern exceeds 0.1% by weight in any article you supply, tell business customers proactively, and answer consumer requests within 45 days.
Which substances does RoHS restrict?+
Ten: lead, mercury, cadmium, hexavalent chromium, the flame retardants PBB and PBDE, and the phthalates DEHP, BBP, DBP and DIBP. The limit is 0.1% by weight in each homogeneous material, except cadmium at 0.01%.
Other markets, same product
Get this for your exact product
Add your product's real features (wireless, battery, mains, children) to see every extra regulation they trigger.