Kablosuz cihaz
IoT device testing and certification
A sensor, control or monitoring device that connects to the internet.
IoT device — conformity scope
For an IoT device, the file adds cybersecurity requirements on top of radio equipment legislation, EMC and electrical safety. How the device processes data and its update mechanism directly affect which headings the scope extends to.
The list below is the European Union framework. The same product falls under a different mark and approval regime in another market; Smart Service Finder shows that market's requirements when you select it.
Regulation
IoT device legislation that typically comes into play for
The following is the European Union framework and shows typical application. Which title actually applies depends on the class, intended use and components of the product; The scope is determined by examining the product.
The Radio Equipment Directive. Spectrum, EMC and electrical safety are assessed together on the radio interface; the 3.3(d)(e)(f) cybersecurity articles apply from 1 August 2025.
The Cyber Resilience Act. Cybersecurity requirements for products with digital elements; reporting from 11 September 2026, full application from 11 December 2027.
Restriction of certain hazardous substances in electrical and electronic equipment; an integral part of the CE declaration.
Registration, evaluation, authorisation and restriction of chemicals; SVHC notification.
Waste electrical and electronic equipment. Requires marking and registration with the collection system.
Devices that process personal data incur a data-protection-by-design obligation.
Standards
Standards typically referenced in the dossier
- IEC 62368-1Security in audio, video and information technology devices
- ETSI EN 300 328
- ETSI EN 300 220
- ETSI EN 303 645
- EN 18031-1
- EN 18031-2
- EN 55032
- EN 55035
What is required?
Each item links to the relevant service page: the legislation entry to the certification scheme, the test family to the laboratory page, and the mark to the market page.
European Union — required mark
4- CE — European UnionThe umbrella for entering the EU market; all regulations applicable to the product are met.
- RED — European UnionRadio Equipment Directive — covers safety, EMC and spectrum together.
- RoHS — European UnionRestriction of hazardous substances in electrical equipment; part of the CE declaration.
- REACH — European UnionChemical legislation — not covered by CE, but affects almost all products.
Required legislation
3- Radio Equipment Directive (RED)Radio, EMC and safety under one roof
- RoHS
- REACH
Required tests
4- RF & Wireless TestingRF parameters and protocol conformity
- EMC / EMI Testing
- Electrical Safety
- Environmental & Climatic Testing
What must be in the technical file
6- Technical file and radio spectrum assessment
- EU declaration of conformity (DoC)
- SAR assessment (for near-body use)
- Frequency band and output power declaration
- User manual and warnings
- Details of the authorised representative or importer established in the EU
How does the process work?
The flow below is a general order independent of product type; timing and acceptance criteria are determined by the standard the product falls under.
1Defining the scope
It is determined which legislation the product falls under based on its technical characteristics and intended use.
2Testing and evaluation
Tests are planned for the applicable headings; results are evaluated according to the relevant standards.
3Technical file
Design, production and test records are compiled in the technical file, accompanied by a risk assessment.
4Declaration or certificate
Depending on the product group, the manufacturer's declaration is prepared or third-party certification is carried out.
IoT device which market is it going to?
Who bears the obligation, where the test will be performed, and what customs will require all vary by market.
What changes depending on the market?
Same product, different regimen
- European UnionUnder RED, spectrum, EMC and cybersecurity together; a presumption of conformity is provided via the EN 18031 series. Because it carries a digital element, the CRA timetable also applies.
- United KingdomThe UKCA regime carries the same technical requirements into its own legislation; CE marking is recognised indefinitely for many product groups, and the declaration runs through a UK-based responsible person.
- United StatesEquipment authorisation under FCC Part 15; on the cybersecurity side, the US Cyber Trust Mark programme runs on a voluntary basis.
Products in the same group
IoT device — let's work out the scope together
Share the product's technical characteristics; let us tell you in writing which headings apply to your scope and which tests are required.
This result is a starting roadmap, not a conformity assessment. Which legislation a product falls under depends on its technical characteristics, intended use and user group; it is only finalised by examining the product. You may have an obligation not shown in the list, and an item shown here may not apply to your product.