EU regulations that apply to your electronic product
What each regulation requires, who it affects, and what it means for your conformity assessment. Understanding where they apply and how they interact is the first step toward a clean market entry.
Every electronic product placed on the EU market must comply with one or more regulatory frameworks. The challenge is rarely understanding that regulations exist. It is understanding which ones apply to your specific product, how they interact, and what compliance actually requires in practice.
This page covers the five regulatory frameworks most relevant to electronics manufacturers. Each section explains the scope, the core obligations, the conformity assessment options, and the key deadlines you need to know.
01
Cyber Resilience Act (CRA)
02
RED Directive
03
EMC Directive
04
LVD Directive
05
RoHS Directive
Looking for drone and UAS regulation?
EU Regulation 2019/945, class definition, EN 4709 standards and UAS-specific compliance services are covered on its dedicated page.
cra - cyber resilience act
Cyber Resilience Act (CRA): what it means for hardware manufacturers
The Cyber Resilience Act (Regulation (EU) 2024/2847) is the first piece of EU legislation to impose horizontal cybersecurity requirements on all products with digital elements placed on the European market. It entered into force on 10 December 2024, and its obligations are being phased in through December 2027.
Most of the public conversation around the CRA has focused on software. But the regulation applies equally to any product that includes software or firmware and can establish a data connection to a device or network. That definition covers the vast majority of modern electronic products: connected sensors, industrial controllers, IoT devices, network equipment, smart home products, wearables, and embedded systems of all kinds.
Scope: does the CRA apply to your product?
The CRA uses the term "product with digital elements" to define what falls in scope. This means any software or hardware product whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
In practical terms, this captures any product with firmware that communicates via any protocol. It also captures products that do not connect directly to the internet but communicates with any device, as well as hardware products that rely on companion software, cloud services, or remote data processing as part of their intended function.
Key obligations for manufacturers
The CRA introduces obligations across the entire product lifecycle, from design through end-of-support. Not all CRA obligations apply at the same time. Understanding the timeline matters as much as understanding the requirements themselves.
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform. An early warning must be submitted within 24 hours of becoming aware, followed by a more detailed notification within 72 hours. For vulnerabilities, a final report is due within 14 days after a corrective measure is available. For severe incidents, the final report deadline is one month after the 72-hour notification. This obligation applies to all products with digital elements in scope of the CRA.
Applicable from 11 December 2027:
Cybersecurity by design
Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on a risk assessment. The CRA does not prescribe a specific methodology, but manufacturers must demonstrate that they identified relevant threats, evaluated the risks, and implemented proportionate security measures. The essential cybersecurity requirements are set out in Annex I of the regulation and cover areas such as access control, data protection, secure defaults, and attack surface reduction.
Vulnerability handling throughout the support period
Manufacturers must establish and maintain processes to identify, document, and remediate vulnerabilities in their products for as long as the product is expected to be in use. This includes providing security updates to users at no additional cost within a supporting period.
Technical documentation and SBOM
The technical documentation must include the cybersecurity risk assessment, a description of how the essential requirements have been addressed, and specifications of the vulnerability handling processes, among other things. Manufacturers must also identify and document the components contained in their products (including third-party and open-source dependencies) in a Software Bill of Materials. The SBOM is part of the technical documentation available to market surveillance authorities, but there is no obligation to make it public.
Categories and assessment procedure
The CRA classifies products into three categories based on their cybersecurity risk profile. Each category determines the conformity assessment route and whether a Notified Body must be involved.
Default category
Self-assessment always available
Most electronic products: connected sensors, IoT devices...
The manufacturer conducts the cybersecurity risk assessment, applies the essential requirements, prepares the technical documentation, and signs the EU Declaration of Conformity.
Important Class I
Self assessment conditioned
Routers, connected toys, operating systems…
Self-assessment available if the manufacturer has applied a harmonised standard covering the relevant requirements. Otherwise, Notified Body required.
Important Class II
Notified Body required
Firewalls, hypervisors…
Notified Body must examine the product design and a representative specimen before issuing an EU-type examination certificate.
Critical
Mandatory third-party certification
Products with highest cybersecurity risk profile: Smart meters gateways, smartcards…
The European Commission is expected to adopt the EUCC (European Union Common Criteria-based Cybersecurity Certification Scheme) as a means of compliance for critical products. In the meantime, a Notified Body may be used, and one of the following procedures may be applied: Module B+C or Module H.
The CRA does not require manufacturers to use accredited laboratories for testing. Tests can be performed in the manufacturer's own facilities or at external laboratories. However, the manufacturer remains solely responsible for the conformity assessment outcome regardless of where testing takes place.
Not sure whether the CRA applies to your product?
A compliance gap assessment gives you a clear answer and a practical roadmap.
RED — RADIO EQUIPMENT DIRECTIVE
Radio Equipment Directive (RED) — the regulatory framework for anything with a transmitter or receiver
The Radio Equipment Directive 2014/53/EU applies to any product that intentionally transmits or receives radio waves for communication or radio determination purposes. If your product uses Bluetooth, Wi-Fi, NFC, Zigbee, LoRa, cellular, UWB, RFID, GNSS, radar, or any other radio technology, the RED is your primary regulatory framework.
One consequence that manufacturers sometimes miss: products that fall under the RED are explicitly excluded from both the Low Voltage Directive (LVD) and the EMC Directive. The RED absorbs their essential requirements and applies them without the voltage limits of the LVD.
Essential requirements under the RED
Article 3.1(a) — Safety and health
All radio equipment must protect the health and safety of persons, domestic animals, and property. This requirement references the safety objectives of the Low Voltage Directive but applies without any voltage limitation. In practice, the assessment covers electrical safety, mechanical safety, thermal safety, and limits on human exposure to electromagnetic fields. For devices used near the body, this includes SAR (Specific Absorption Rate) evaluation.
Article 3.1(b) — Electromagnetic compatibility
All radio equipment must meet the electromagnetic compatibility objectives of the EMC Directive: it must not cause interference that prevents other equipment from operating correctly, and it must tolerate the electromagnetic environment in which it is intended to operate. The testing scope covers emissions (conducted and radiated) and immunity (ESD, RF fields, transients, surges, voltage dips).
Article 3.2 — Effective use of radio spectrum
This is the radio-specific requirement. Equipment must operate within authorised frequency bands, respect power limits, use appropriate modulation and channel access methods, and achieve adequate receiver performance to avoid unnecessary spectrum occupation. Unlike Articles 3.1(a) and 3.1(b), where generic safety or EMC standards may apply across product types, Article 3.2 relies on technology-specific harmonised standards. The applicable standard depends entirely on the radio technology and frequency band involved.
Article 3.3(d) — Network protection
Applies to any internet-connected radio equipment. The equipment must not harm the network or its functioning, nor misuse network resources in a way that causes unacceptable degradation of service.
Article 3.3(e) — Personal data and privacy protection
Applies to internet-connected radio equipment, equipment designed for childcare, toys with radio functionality, and wearable radio equipment, provided the equipment processes personal data, traffic data, or location data. A device does not need to be internet-connected to fall under 3.3(e): a radio-enabled child monitoring device that processes personal data but only communicates locally is still in scope.
Article 3.3(f) — Fraud prevention
Applies to internet-connected radio equipment that enables the transfer of money, monetary value, or virtual currency.
These RED cybersecurity requirements 3.3(d)(e)(f) are transitional. The Commission plans to repeal the Delegated Regulation on 11 December 2027, when the CRA becomes fully applicable. Products placed on the market between 1 August 2025 and 10 December 2027 comply under these RED articles. Products placed on the market from 11 December 2027 comply under the CRA. There is no period of dual obligation.
Article 3.3(g) — Emergency service access
Activated by several delegated acts for specific equipment categories: GMDSS maritime radio, avalanche beacons, AIS transponders, and Cospas-Sarsat locator beacons. If your product falls into one of these categories, Article 3.3(g) imposes additional requirements on emergency signal reliability. These obligations are long-standing and unaffected by the CRA transition.
Article 3.4 — Common charging solution
Added to the RED by Directive (EU) 2022/2380, this requirement mandates that certain categories of radio equipment use USB Type-C as their wired charging receptacle. The requirement has applied since 28 December 2024 for mobile phones, tablets, digital cameras, headphones, headsets, portable game consoles, portable speakers, e-readers, keyboards, mice, portable navigation systems, and earbuds. For laptops, the application date was 28 April 2026. Products charging above 15W must also support the USB Power Delivery (USB PD) protocol. Manufacturers must also meet specific labelling requirements: a pictogram indicating whether a charger is included in the packaging, and a label showing the product's charging specifications and compatible charging devices.
Conformity assessment under the RED
The conformity assessment route depends on which essential requirements apply to your product and whether harmonised standards provide full coverage.
For Articles 3.1 (safety and EMC) and 3.4 (common charger)
The manufacturer can always choose between self-declaration, EU type examination with a Notified Body, or full quality assurance. Self-declaration is available regardless of whether harmonised standards have been applied. Most manufacturers take this route: they conduct or commission the relevant testing, prepare the technical documentation, and sign the EU Declaration of Conformity.
For Articles 3.2 (spectrum) and 3.3 (delegated requirements)
The picture changes. When the manufacturer has applied harmonised standards whose references have been published in the Official Journal, the same three options remain available, including self-declaration. When harmonised standards have not been applied, have been only partially applied, or do not exist, self-declaration is no longer an option. The manufacturer must go through a Notified Body.
The distinction between "applied" and "partially applied" is important in practice. Harmonised standards can be published in the Official Journal with restrictions, meaning certain clauses do not provide presumption of conformity. A manufacturer who applies such a standard has only partially covered the essential requirement. This is the current situation with the EN 18031 series supporting the cybersecurity articles under 3.3(d), (e), and (f), the standards exist and can be applied, but they were published with restrictions, so Notified Body certification remains necessary if the product is affected by those restrictions.
Need clarity on which RED requirements apply to your product?
emc directive
EMC Directive: electromagnetic compatibility for non-radio electronic products
The EMC Directive (2014/30/EU) applies to any apparatus that could generate electromagnetic disturbance or whose performance could be affected by electromagnetic disturbance. For electronics manufacturers, this effectively means almost every electronic product that does not fall under the RED.
The distinction matters: if your product includes intentional radio functionality, the RED applies and the EMC Directive does not. The RED absorbs the EMC requirements through Article 3.1(b). The EMC Directive covers everything else.
The two essential requirements:
- Emissions
The electromagnetic disturbance generated by the apparatus must not exceed a level that prevents other equipment from operating as intended. This is measured as conducted emissions (disturbance fed back into the mains or telecomunications cables) and radiated emissions (disturbance propagated through the air). The applicable limits depend on the product category and the intended operating environment (residential or industrial).
- Immunity
The apparatus must tolerate the electromagnetic disturbance expected in its intended environment without unacceptable degradation of performance. Immunity testing covers electrostatic discharge, radiated RF fields, conducted RF disturbance, electrical fast transients, surges, voltage dips and interruptions, and magnetic fields. Which tests apply and at what severity depends on the product's characteristics.
Conformity assessment under the EMC Directive
The EMC Directive allows self-declaration for all products. There is no mandatory Notified Body involvement, regardless of product type. The manufacturer normally applies the relevant harmonised standards (typically from the EN 61000 series for generic standards, or product-family standards where they exist), conducts or commissions EMC testing, prepares the technical documentation, and signs the EU Declaration of Conformity.
directive lvd
Low Voltage Directive (2014/35/EU) — electrical safety for products within defined voltage limits
The Low Voltage Directive applies to electrical equipment designed for use with a voltage rating between 50V and 1,000V for alternating current, or between 75V and 1,500V for direct current. These voltage limits refer to the mains power.
For electronics manufacturers, LVD typically applies to mains-powered equipment: power supplies, industrial controllers, laboratory instruments, professional equipment, LED lighting systems, battery chargers operating above the voltage thresholds, and similar products.
What falls outside the LVD
Products operating below 50V AC or 75V DC are outside scope. This excludes a significant portion of modern electronic products — battery-operated consumer devices, USB-powered equipment, low-voltage embedded systems, and similar products. These products are not exempt from safety obligations, but those obligations come from other legislation: the General Product Safety Regulation for consumer products, or the RED if the product has radio functionality (which applies safety requirements without voltage limits).
Safety objectives
The LVD defines its essential requirements as safety objectives rather than prescriptive rules. Equipment must be designed and manufactured so that it does not endanger persons, domestic animals, or property when properly installed, maintained, and used for its intended purpose. The safety objectives cover protection against hazards arising from the equipment itself (electric shock, dangerous temperatures, non-electrical hazards such as mechanical or chemical risks), as well as protection against external influences — the equipment must withstand the environmental conditions it will encounter without compromising safety, like dust or rain.
Conformity assessment under the LVD
The LVD provides a single conformity assessment path: self-declaration through internal production control. The manufacturer applies the relevant harmonised safety standards (typically EN 62368-1 for IT and audio/video equipment, EN 61010 for laboratory and measurement equipment, EN 60335 for household appliances, or other product-specific standards), conducts or commissions safety testing, prepares the technical documentation, and signs the EU Declaration of Conformity. Unlike the RED or the CRA, the LVD does not include any provision for Notified Body involvement.
RoHS Directive
Restricted substances in electrical and electronic equipment
The RoHS Directive (2011/65/EU) restricts the use of ten hazardous substances in electrical and electronic equipment (EEE) placed on the EU market. Unlike the directives above, which focus on how a product performs, RoHS focuses on what a product contains.
The restricted substances are:
- Lead
- Mercury
- Cadmium
- Hexavalent chromium
- Polybrominated biphenyls (PBB)
- Polybrominated diphenyl ethers (PBDE)
- Bis(2-ethylhexyl) phthalate (DEHP)
- Butyl benzyl phthalate (BBP)
- Dibutyl phthalate (DBP)
- Diisobutyl phthalate (DIBP)
The maximum permitted concentration is 0.1% by weight in homogeneous materials for all substances except cadmium, which is restricted to 0.01%. Homogeneous material means a single substance of uniform composition throughout, such as plastic, ceramic, metal or coating.
Scope
RoHS applies to electrical and electronic equipment falling within the categories defined in the directive, which effectively covers the full range of electronic products.
Exemptions exist for specific applications where technically reliable substitutes are not yet available. These exemptions are reviewed periodically and have defined expiry dates. Manufacturers relying on an exemption must identify which one applies, verify that it has not expired, and document this in their technical documentation.
What RoHS compliance actually requires
RoHS compliance is primarily a supply chain management exercise. Manufacturers must collect material declarations from every level of the supply chain — every component, sub-assembly, solder paste, surface finish, cable, connector, and housing material must be traced to material composition data. This typically takes the form of supplier declarations, material test reports, or standardised formats.
Where exemptions apply, the manufacturer must document which exemption covers which application and confirm that it remains valid.
The technical documentation for RoHS is separate from the technical file required by other directives. It must include a product description, documentation of materials and components used, evidence of compliance, and identification of any exemptions applied. EN IEC 63000 is the only one harmonised standard for RoHS.
Prefer to build in-house regulatory knowledge?
Training sessions tailored to your product portfolio and your team's level. CE marking fundamentals, RED compliance for connected products, CRA readiness — choose the focus and the depth.
Multiple regulations, one compliance strategy
Most electronic products fall under two or more of these frameworks simultaneously. A compliance gap assessment maps every applicable regulation to your product and builds a single, coherent path to market.
faqs
Frequently asked questions
How do I know which EU regulations apply to my product?
It depends on the product's characteristics: whether it uses radio technology (RED), operates above certain voltage thresholds (LVD) or contains software or firmware with data connectivity (CRA), among others. Most electronic products fall under at least two or three of these frameworks simultaneously. A compliance gap assessment identifies exactly which regulations apply to your specific product and maps the conformity assessment path for each one.
What is a "product with digital elements" under the CRA?
It is any software or hardware product whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. For hardware manufacturers, this means any product that contains software or firmware and can communicate via any protocol. The connection does not need to be to the internet; a device that communicates only with a local component is still in scope. Products without any software or firmware component, and products with no data connection capability of any kind, fall outside the definition.
Can I self-declare compliance, or do I need a Notified Body?
For the EMC Directive self-declaration is always possible. For the RED, self-declaration is always available for Articles 3.1 and 3.4; for Articles 3.2 and 3.3 it depends on whether harmonised standards have been fully applied. For the CRA, most products in the default category can rely on self-declaration, but important and critical products may require a third-party. For LVD and RoHS, there is no Notified Body role, compliance is always the manufacturer's responsibility through internal production control.
What is the relationship between the RED cybersecurity requirements and the CRA?
The RED cybersecurity requirements under Articles 3.3(d), (e), and (f) apply to internet-connected radio equipment placed on the market since 1 August 2025. These requirements are transitional. The Commission will repeal the RED Delegated Regulation that activated them on 11 December 2027, when the CRA becomes fully applicable. Products placed on the market between those two dates comply under the RED. Products placed on the market from 11 December 2027 onward comply under the CRA. There is no period of dual obligation: one framework succeeds the other.
My product has radio functionality. Do I also need to comply with the LVD and EMC Directive?
No. Products that fall under the RED are explicitly excluded from both the LVD and the EMC Directive. The RED incorporates their essential requirements: safety through Article 3.1(a) and electromagnetic compatibility through Article 3.1(b). You produce one conformity assessment under the RED, not three under separate directives.
Are CRA reporting obligations already in force?
Yes. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform. This obligation applies to all products with digital elements in scope of the CRA, including products that are been plancing on the market before the full application date of 11 December 2027.
Do I need to test my product for RoHS compliance?
Not necessarily. RoHS compliance is typically demonstrated through supply chain documentation: material declarations from suppliers, evidence of due diligence, and identification of any applicable exemptions. Analytical testing may be used to verify supplier declarations or when documentation is insufficient, but it is not a mandatory step.
What happens if I place a non-compliant product on the EU market?
Market surveillance authorities in EU Member States can request technical documentation, conduct inspections, and order products to be withdrawn or recalled. Under the CRA, penalties can reach up to €15 million or 2.5% of global annual turnover, whichever is higher. Other directives carry their own enforcement provisions defined at Member State level.