Radio and Safety Approvals for a Connected Product: FCC, CE/RED and UKCA

Why approval comes early

Approvals are tested on the finished hardware: the circuit board, the antenna, the enclosure and the firmware settings that control the radio. A change late in the project, such as a new antenna position or a different radio chip, can mean testing again. The choice of connectivity also decides which rules and tests apply, so it is worth reading our guide to choosing connectivity for an IoT product alongside this one.

United States: FCC equipment authorization

The FCC's rules in 47 CFR 2.901 explain that radio frequency equipment must meet technical standards and, depending on the service rules, be authorized either under a "Supplier's Declaration of Conformity" or by "a grant of certification from a Telecommunication Certification Body".

Part 15 of the rules covers many unlicensed radio devices, and calls transmitters "intentional radiators". Section 15.201 says that, apart from listed exceptions, "all intentional radiators operating under the provisions of this part shall be certified by the Telecommunication Certification Bodies" before marketing. In practice that means testing at an accredited lab and a certification grant before the product is advertised or sold in the US. Other radio types can fall under other parts of the rules, so confirm the rule part for your radio with the lab.

Pre-approved radio modules

One way to avoid designing the radio from scratch is to use a pre-certified module. The FCC's section 15.212 defines a modular transmitter as "a completely self-contained radiofrequency transmitter device that is typically incorporated into another product". A module approval comes with conditions: the module has its own shielding, power regulation and approved antenna, and must be tested on its own.

A module approval does not automatically cover the finished product: the host must follow the module's grant conditions, including its antenna, and the rest of the product may have obligations of its own. Ask the lab early what the module's approvals cover in each market you plan to sell in.

European Union: the Radio Equipment Directive

The European Commission's RED page says Directive 2014/53/EU "establishes a regulatory framework for placing radio equipment on the market", with essential requirements for "safety and health, electromagnetic compatibility, and the efficient use of the radio spectrum". Article 3 of the directive sets them out:

• 3(1)(a): health and safety, with the safety objectives of the Low Voltage Directive but "with no voltage limit applying".
• 3(1)(b): electromagnetic compatibility.
• 3(2): effective and efficient use of radio spectrum "to avoid harmful interference".
• 3(3): extra requirements for categories the Commission specifies by delegated act, including (d) not harming the network, (e) protecting personal data and privacy and (f) protection from fraud.

Under Article 17, the manufacturer carries out the conformity assessment. For the safety and EMC requirements it can use internal production control, EU-type examination, or full quality assurance. For the spectrum requirements and Article 3(3), internal production control is available when harmonised standards published in the Official Journal have been applied; otherwise a notified body must be involved. The result is a declaration of conformity, technical documentation and the CE marking. The Commission also warns that "voluntary certificates" from bodies not acting as notified bodies "are not a recognised means to prove compliance".

EU cybersecurity: RED now, the CRA from 2027

In 2021 the Commission adopted Delegated Regulation (EU) 2022/30, activating Articles 3(3)(d), (e) and (f) for certain categories of radio equipment. The Commission says it "entered into application in August 2025". So if your product falls into one of the categories the regulation covers, it needs to meet those cybersecurity requirements as part of its CE marking today.

That will change. The Commission's page says the Cyber Resilience Act's main obligations apply from 11 December 2027, and that Delegated Regulation (EU) 2026/339, published on 29 April 2026, repeals 2022/30 with effect from the same date, "to avoid overlapping legislative requirements". For a product launching in 2026 or 2027, plan for both: the RED cybersecurity requirements now, and the CRA for products placed on the market after December 2027. Our guide to security basics for connected products covers the CRA, ETSI EN 303 645 and the UK's PSTI regime, so they are not repeated here.

Great Britain: UKCA or CE

Great Britain has its own Radio Equipment Regulations 2017, with the UKCA marking. GOV.UK's guidance on placing UKCA or CE marked products on the market says that under the Product Safety and Metrology (Amendment) Regulations 2024 "the UK continues to recognise the CE marking, alongside or in place of the UKCA marking", which gives businesses "flexibility on which conformity process they wish to use". The same regulations allow "Fast-Track UKCA": UKCA marking where recognised EU requirements and conformity assessment have been met. Northern Ireland has different arrangements, which GOV.UK covers separately.

Separately, connectable consumer products sold in the UK must meet the PSTI security requirements, which our IoT security guide explains.

Planning approvals into the project

• List the markets you will sell in at launch and in the first year.
• Choose radios, and if possible pre-certified modules, with approvals in those markets.
• Talk to an accredited lab before the hardware design is frozen; ask about pre-compliance testing on prototypes.
• Freeze the antenna, enclosure and radio firmware settings before formal testing.
• Plan the cybersecurity work (RED now, CRA later, PSTI in the UK) alongside the radio testing, not after it.
• Keep the technical documentation and declarations of conformity together; you will need them for every market.
• Allow time in the schedule for testing and any re-test before the launch date.

Firmware changes after launch can also matter for compliance, which is one more reason to plan over-the-air updates carefully.

Frequently asked questions

Does a pre-certified radio module mean our product needs no testing?

No. Under the FCC's modular transmitter rules the host must follow the module's grant conditions, including its approved antenna, and the finished product may have obligations of its own. The same applies in the EU, where the manufacturer of the final product carries out the conformity assessment.

Can we self-declare CE marking for a radio product?

It depends on the standards you apply. Under Article 17 of the Radio Equipment Directive, internal production control is available when harmonised standards published in the Official Journal have been applied. If they have not been applied in full, a notified body must be involved for the relevant requirements.

Do the EU's RED cybersecurity rules still apply?

Yes, for now. Delegated Regulation (EU) 2022/30 has applied since August 2025. It is repealed with effect from 11 December 2027, the date the Cyber Resilience Act's main obligations apply.

Is CE marking accepted in Great Britain?

GOV.UK says the UK continues to recognise the CE marking for the Great Britain market, alongside or instead of UKCA, under the Product Safety and Metrology (Amendment) Regulations 2024.

We build the connectivity layer, the backend and the apps for connected products, with security planned in from the first prototype. See our IoT development service and all our services, or email [email protected].