Cenitia Library
Practical guides to EU regulatory compliance.
Engineering-grade explainers of the regulations every hardware product entering the EU market has to meet. No legal-pad jargon, no AI filler — written by the same team that built Cenitia.
58 guides across 12 topics
CE Marking & Conformity
4How CE marking actually works — the conformity-assessment routes, when a Notified Body is mandatory, and the mistakes that get products stopped at the border.
- referenceCRA, RED, LVD, EMC, MDR
Conformity assessment Modules A through H — the EU CE marking decision guide
Every EU conformity assessment module — Module A self-assessment through Module H full quality assurance — when each applies and how to choose the right one.
- referenceCRA, RED, LVD, EMC, RoHS
Top 10 CE marking mistakes that trigger product withdrawal
Ten CE marking mistakes seen most often in market surveillance enforcement — each grounded in the specific EU regulation that defines the violation.
- guideCRA, RED, MDR
When you need a Notified Body — the EU CE marking decision guide
Decision guide for when a Notified Body must be involved in EU conformity assessment — by directive, by product type, by module — plus how to find one and what it costs.
- guideCRA, RED, LVD, EMC, RoHS, MDR
CE Marking 101 — the complete EU guide for hardware manufacturers
End-to-end CE marking guide for 2026: which products need it, the 24 directives behind it, the conformity assessment process, common mistakes, and penalties.
Declaration of Conformity
5What an EU Declaration of Conformity must contain, how to translate it, when to re-issue it, and how to sign it electronically.
- referenceeIDAS
eIDAS — qualified electronic signatures on Declarations of Conformity
How eIDAS Regulation 910/2014 (amended by 2024/1183) applies to signing an EU Declaration of Conformity — the three signature levels and what most directives actually require.
- referenceCRA, RED, MDR
Declaration of Conformity translation requirements — every EU language explained
Which EU language(s) the Declaration of Conformity must be drawn up in, which language(s) must accompany the product per market, and what counts as a valid translation.
- tutorialCRA, RED, LVD, EMC, RoHS
Sample Declaration of Conformity — annotated walkthrough with template
Full annotated sample EU Declaration of Conformity for a connected IoT product, citing CRA, RED, LVD, EMC, RoHS — with explanation of each of the nine elements.
- guideCRA, RED
Updating a Declaration of Conformity after a regulation amendment
When a cited EU regulation or harmonised standard is amended, the Declaration of Conformity may need to be reissued. This guide explains when, how, and what to retain.
- guideCRA, RED, LVD, EMC, RoHS
Declaration of Conformity 101 — what it is, who needs it, how it's signed
EU Declaration of Conformity explained: which laws require one, the nine elements it must contain in 2026, common mistakes that void it, what changes the moment you sign.
Technical File & Risk Assessment
4The documentation behind the CE mark — what goes in the technical file, how long to keep it, and how to run a defensible risk assessment.
- referenceCRA, RED, MDR, LVD, EMC
Technical File retention requirements per EU directive
How long the Technical File must be retained under each major CE marking directive in 2026 — CRA, RED, MDR, LVD, EMC, Machinery, with the specific article cited.
- guideCRA, MDR
Risk assessment for CE compliance — methodology overview and standards reference
Overview of the risk assessment methodologies that satisfy CE marking directives — Machinery, MDR, CRA — and the harmonised standards each cites.
- tutorialCRA, RED
Technical File for IoT devices — concrete template aligned with CRA and RED
Concrete Technical File template for connected IoT devices in 2026 — aligned with CRA Annex VII, RED Annex V, and the harmonised standards likely to apply.
- guideCRA, RED, MDR, LVD, EMC
Technical File 101 — what it must contain and how to maintain it
Complete guide to the EU Technical File: required content per directive, software-specific additions under CRA, retention rules, format, and common mistakes.
Cyber Resilience Act (CRA)
9The EU Cyber Resilience Act end to end — Annex I requirements, product classes, the reporting clock, overlap with NIS2, and the 2026–2027 deadlines.
- referenceCRA
CRA for existing products already on the EU market: the Article 69 transitional rules
CRA Article 69 explained: grandfathering for products placed on the EU market before 11 December 2027, substantial modification test, Article 14 reporting carve-back.
- comparisonISO27001, CRA
ISO/IEC 27001 vs CRA — when to certify both
ISO/IEC 27001:2022 is an organisational ISMS standard; the EU Cyber Resilience Act is a product-level regulation. Where they overlap, where they don't, and why you need both.
- tutorialCRA
CRA December 2027 readiness — the 18-month roadmap to full conformity
18-month preparation roadmap to 11 December 2027 CRA full application. Quarterly milestones for Annex I conformity, Technical File, DoC, and Notified Body engagement.
- tutorialCRA
CRA ENISA 24-hour reporting — the early warning rule in operational detail
Operational walkthrough of CRA Article 14 reporting: the 24-hour early warning content, the ENISA single reporting platform, CSIRT routing, and the three-tier cascade.
- tutorialCRA
CRA September 2026 reporting checklist — preparation for the 24-hour rule
Practical checklist for manufacturers preparing for 11 September 2026 — when CRA Article 14 reporting to ENISA becomes mandatory. Workflow, accounts, escalation, monitoring.
- referenceCRA
CRA Annex III important products — Class I and Class II explained
Full list of CRA Annex III important products Class I and Class II — what categories trigger Notified Body assessment under the Cyber Resilience Act.
- comparisonCRA
CRA vs NIS2 — when both apply and how to handle the overlap
CRA applies to products; NIS2 applies to operators of essential and important services. When both apply to the same organisation, here is what changes.
- referenceCRA
CRA Annex I explained — the 21 essential cybersecurity requirements
Plain-English breakdown of the 13 design and 8 vulnerability-handling requirements under EU Cyber Resilience Act Annex I — what each means for a hardware product.
- guideCRA
CRA timeline and reporting obligations — September 2026, December 2027, and the 24-hour rule
Complete CRA timeline: 11 September 2026 ENISA reporting starts, 11 December 2027 full application. The 24-hour rule, 72-hour update, and final report explained.
Radio Equipment & EN 18031
5The RED cybersecurity delegated act and the EN 18031 harmonised standards — what the three parts cover, the radio conformity path, and where RED meets the CRA.
- referenceEN303645
ETSI EN 303 645 — the 13 consumer IoT controls explained
The 13 high-level provisions of ETSI EN 303 645 v2.1.1 (June 2020) and v3.1.3 (September 2024) explained, with the TS 103 701 conformance assessment mapping.
- referenceRED
RED Annex IV path: when radio equipment needs a Notified Body
RED Annex IV path — when radio equipment requires Notified Body full quality assurance (Module H), versus Module A self-assessment under Article 17(2).
- comparisonRED, CRA
RED and CRA overlap for connected radio products: 2025-2027 transition
RED Delegated Act 2022/30 and CRA overlap for connected radio products — the 2025-2027 transition, EN 18031 coverage, gap to CRA Annex I Part II, dual obligations.
- referenceRED
EN 18031-1 vs -2 vs -3: which part applies to your radio product
EN 18031-1, -2 and -3 compared — scope, mechanism families, and a decision tree for RED Article 3(3)(d), (e) and (f) under Delegated Regulation 2022/30.
- guideRED, CRA
RED Delegated Act + EN 18031 — the self-assessment walkthrough for radio products
Step-by-step walkthrough of RED Delegated Act 2022/30 cybersecurity self-assessment under EN 18031-1, -2, -3 — scope, process, tests, and CRA overlap.
SBOM & Software Supply Chain
4Software Bills of Materials for hardware — CycloneDX vs SPDX, tooling for embedded builds, how often to regenerate, and recovering an SBOM from legacy firmware.
- referenceCRA
SBOM for legacy embedded firmware: building one from binaries when source is gone
Build an SBOM for legacy embedded firmware from binaries — Binwalk extraction, Syft + Trivy scan, EMBA triage, and an honest residual-risk template for CRA Annex I Part II.
- referenceCRA
SBOM tooling for embedded systems: Syft, Trivy, Yocto SPDX and CycloneDX-generators compared
SBOM tools for embedded development compared — Syft, Trivy, Yocto create-spdx, CycloneDX-generators, EMBA — with a decision matrix and CRA Annex I Part II mapping.
- guideCRA
SBOM update frequency under CRA: release-based maintenance and historic retention
How often the SBOM must be updated under CRA Annex I Part II item (1) and Annex VII — release-based maintenance, historic version retention, and vulnerability monitoring cadence.
- guideCRA
SBOM for hardware manufacturers — CycloneDX vs SPDX practical guide
Practical SBOM guide for hardware manufacturers in 2026: CycloneDX vs SPDX format comparison, generation tooling, maintenance lifecycle, and CRA Annex I compliance.
EU Authorised Representative
4When a non-EU manufacturer needs an EU Authorised Representative (EC REP), what it costs, how it differs from an importer, and the software-product specifics.
- guideCRA, RED, MDR
EC REP cost guide 2026: what you pay, what you get, what to avoid
Cost guide for EU Authorised Representative services in 2026 by directive — CRA Article 18, RED Article 11, MDR Article 11 — what drives premium and how to verify a quote.
- guideCRA
EC REP for software products under the CRA: when SaaS, pure software, and firmware need an EU authorised representative
When EC REP appointment is required for software products under CRA — SaaS, pure software, firmware-as-product, with Article 3 scope analysis and Article 13 EC REP duties.
- comparisonCRA, RED, MDR
EC REP vs Importer: Responsibilities Under CRA, RED, and MDR
EC REP vs Importer — the two distinct EU economic operator roles, their obligations under CRA, RED, MDR, and Regulation 2019/1020, and when one entity can be both.
- guideCRA, RED, MDR
EU Authorised Representative (EC REP) — the complete guide for non-EU manufacturers
Complete EC REP guide for non-EU manufacturers: when required, responsibilities under CRA, RED, MDR, the mandate document, costs, and how to choose a representative.
Directives & Standards
8Per-directive and per-standard deep dives — EMC, Low Voltage, RoHS, Machinery, GPSR, and the harmonised standards that demonstrate conformity.
- referenceLVD
EN 62368-1 — safety for audio/video and ICT equipment
EN IEC 62368-1 (3rd ed., 2018) is the hazard-based safety standard replacing EN 60950-1 and EN 60065 — energy classes, safeguards, LVD presumption of conformity.
- referenceIEC62443, CRA, RED
IEC 62443 family overview for product manufacturers
Practical map of the IEC 62443 industrial cybersecurity standards — what -1-1, -2-1, -2-4, -3-2, -3-3, -4-1 and -4-2 cover, and which parts hardware manufacturers actually need.
- referenceEMC
EN 55032 — EMC emissions classes A and B for ITE
Reference on EN 55032 (CISPR 32) emissions classes A and B for multimedia equipment — limits, frequency ranges, and presumption of conformity under the EMC Directive.
- referenceGPSR
General Product Safety Regulation 2023/988 — when it applies
Regulation (EU) 2023/988 GPSR applies from 13 December 2024, replacing Directive 2001/95/EC. Scope, traceability, online marketplaces, Safety Gate, recalls.
- referenceMachineryReg
Machinery Regulation 2023/1230 — transition from the Machinery Directive
EU Machinery Regulation 2023/1230 — entry into force, 20 January 2027 application, repeal of Directive 2006/42/EC, key substantive changes.
- guideEMC
EMC Directive 2014/30/EU — the complete guide
EMC Directive 2014/30/EU explained: scope, Annex I essentials, Modules A and B+C, technical file, EU DoC, CE marking, harmonised standards.
- referenceLVD
Low Voltage Directive 2014/35/EU — what it covers
Plain-English walk-through of the EU Low Voltage Directive 2014/35/EU: scope, voltage limits, safety objectives, Module A, technical file, DoC, harmonised standards.
- referenceRoHS
RoHS Directive 2011/65/EU — Annex II restricted substances
Annex II of RoHS 2 lists 10 restricted substances with maximum concentration values. The 2015 phthalate amendment, exemptions, and CE marking explained.
Product-Type Playbooks
4CE-marking playbooks for specific product categories — consumer IoT, industrial sensors, medical wearables, and AI-enabled hardware.
- guideAIAct, CRA, CEMark
CE marking AI-enabled hardware — CRA + AI Act overlap
How CE marking works for hardware embedding AI under the AI Act (Regulation (EU) 2024/1689) and the CRA — Article 6 high-risk routing, Article 48 CE, Annex I integration.
- guideCEMark, EMC, CRA, ATEX, LVD, RED, RoHS
CE marking for industrial sensors and gateways
EMC, LVD, RED, RoHS, ATEX, Machinery Regulation and CRA stack for industrial sensors, gateways and edge devices placed on the EU market.
- guideMDR, CRA, RED
CE marking medical wearables — MDR + CRA overlap
How CE marking works for a medical wearable: MDR is binding, CRA is carved out by Article 2(2), and RED still applies to the wireless side.
- guideCEMark, CRA, RED, EMC, LVD, RoHS, GPSR
CE marking for IoT consumer products — end-to-end
End-to-end CE marking process for consumer IoT — RED, EMC, LVD, RoHS, CRA (from 11 December 2027), and GPSR — sequenced from scope to vulnerability handling.
Country Guides
5National specifics that sit on top of the EU framework — Germany, France, Spain, Italy, and the UK’s post-Brexit UKCA mark.
- guideCEMark, GPSR
Italy — CE marking and Codice del Consumo
How CE marking works in Italy: MIMIT as competent authority, Italian-language requirements under Codice del Consumo, and Ministero della Salute's role.
- guideCEMark, LVD, EMC, RED
Spain — CE marking, language and MITECO requirements
Spanish CE marking rules — the key Reales Decretos that transpose LVD, EMC and RED, the castellano labelling requirement, MITECO environmental duties, and the legacy DIE regime.
- guideCEMark
France — CE marking and additional national obligations
France-specific add-ons to CE marking: DGCCRF market surveillance, Loi Toubon French-language documentation, Triman waste-sorting logo, AGEC law and REP eco-organisme registration.
- comparisonUKCA, CEMark
UKCA mark vs CE mark — post-Brexit clarity 2025-2026
How UKCA and CE marking actually work in Great Britain after the 2024 indefinite recognition decision — plus Northern Ireland UK(NI), construction, and medical device carve-outs.
- guideProdSG, GPSR, MarketSurveillance
Germany ProdSG and CE marking — what changes for the German market
How Germany's Produktsicherheitsgesetz (ProdSG 2021) interacts with CE marking: GS mark, BAuA, Länder market surveillance, and German-language obligations.
Research Tools
4How to read the primary sources yourself — CELEX numbers, EUR-Lex, the NANDO Notified Body database, and harmonised standards in the Official Journal.
- tutorialCEMark, CRA, RED, MDR
How to check NANDO for Notified Bodies
Step-by-step guide to NANDO — the Commission's public database of Notified Bodies. Search by Directive, by 4-digit ID, by country, and verify a quoted NB number on a DoC.
- tutorialCEMark, RED
How to find harmonised standards in the Official Journal
Tutorial: locate the current list of harmonised standards giving presumption of conformity in the OJEU, verify references, and read excluded clauses.
- tutorialEURLex
How to navigate EUR-Lex — find the consolidated version
Tutorial on EUR-Lex search, ELI URIs, CELEX numbers, and how to find the current consolidated version of an EU regulation plus subscribe to updates.
- tutorialEURLex, RED
How to read CELEX numbers — EUR-Lex navigation
Decode CELEX numbers like 32014L0053 (RED): sector code, year, document type, and number. Includes consolidated text identifiers and worked examples from EUR-Lex.
Trackers & Deadlines
2Living trackers we keep current — CRA enforcement countdown, harmonised-standards status, EN 18031 progress, and the quarterly Official Journal digest.
- guideCRA
CRA enforcement countdown — T-365d, T-180d, T-90d
Operational countdown to the CRA general application date of 11 December 2027. Concrete checkpoints at T-12m, T-6m, T-3m and T-0 for hardware manufacturers.
- referenceCRA
CRA harmonised standards — OJEU tracker (July 2026)
Live status of harmonised standards under the Cyber Resilience Act: standardisation request M/606, EN 40000 series, expected OJEU listings 2027.