CE marking for industrial sensors and gateways

For an industrial sensor, gateway or controller, document the final configuration, intended environment, interfaces, rated supply voltage and safety function. Determine the actual scopes of EMC, LVD, RED, RoHS and ATEX. LVD covers rated voltages of 50–1000 V AC or 75–1500 V DC subject to its scope and exclusions. Assess machinery or safety-component scope under the current Directive and the replacement Regulation, whose main mandatory application is 20 January 2027.

From 11 December 2027 products meeting the connection and other scope conditions, subject to Article 2 exclusions and the Article 69 transition, must be assessed under the Cyber Resilience Act, Regulation (EU) 2024/2847. That is the new horizontal layer on top of the existing sectoral CE stack — and it is the one most teams underestimate.

The CE stack for an industrial sensor — directive by directive

EMC Directive 2014/30/EU

Directive 2014/30/EU (OJ L 96, 29.3.2014, p. 79) is the universal layer. Article 6 requires equipment to meet the essential requirements in Annex I — namely that generated electromagnetic disturbance does not exceed the level above which equipment cannot operate as intended, and that the equipment has an adequate level of intrinsic immunity. Article 2 excludes radio equipment, which is regulated under the RED instead.

The directive itself is environment-neutral. The "industrial environment" idea sits in the harmonised standards, where the EN 61000-6-x series and EN 55032 (emissions for multimedia equipment) split products into residential/light-industrial and heavy-industrial classes. Choose the class that matches the actual deployment, not the most permissive one — choosing wrongly is one of the most common audit findings on industrial gear.

Low Voltage Directive 2014/35/EU

The LVD applies when the equipment's rated voltage is "between 50 and 1 000 V for alternating current and between 75 and 1 500 V for direct current" — Article 1 of Directive 2014/35/EU. Many 24 V DC sensors sit below the threshold and therefore escape the LVD entirely. Check the actual rated voltage of each item. A low-voltage PoE device does not automatically enter LVD scope; a separate mains adapter may have its own LVD assessment. Radio equipment uses the RED safety requirements without the LVD voltage limits.

Radio Equipment Directive 2014/53/EU

If your gateway transmits intentionally — Wi-Fi, BLE, LoRaWAN, NB-IoT, sub-GHz — RED 2014/53/EU replaces both the EMC Directive and the LVD for that product. The delegated RED cybersecurity requirements have applied since 1 August 2025. Check the product scope and the exact EN 18031 citation and restrictions; voluntary standards themselves do not become mandatory merely because that date has passed.

RoHS Directive 2011/65/EU

Industrial monitoring and control instruments are explicitly in scope under category 9 of Annex I to Directive 2011/65/EU. The restricted-substance list (lead, mercury, cadmium, chromium VI, PBB, PBDE plus four phthalates added by Delegated Directive 2015/863) applies to homogeneous materials and must be declared on the DoC alongside other applicable EU acts.

ATEX Directive 2014/34/EU

Directive 2014/34/EU covers equipment and protective systems intended for use in potentially explosive atmospheres. Article 1 also captures safety, controlling and regulating devices required for the safe functioning of such equipment, and components intended to be incorporated into them.

An ATEX sensor stacks ATEX on top of EMC, RoHS and — where applicable — RED. Verify the notified body’s scope under each applicable act. One organisation may have more than one notification; neither its name nor an unrelated certificate establishes the required scope.

Machinery Regulation (EU) 2023/1230

Regulation (EU) 2023/1230 repeals Directive 2006/42/EC and starts applying 20 January 2027. It defines a "safety component" as a physical or digital component, including software, that fulfils a safety function and is independently placed on the market. Sensors sold as standalone safety components — light curtains, safety laser scanners, safety-rated proximity switches — must comply directly. Sensors integrated into a machine before placing on the market are assessed by the machine builder. Manufacturers must also adopt "proportionate measures" against malicious third-party action that could compromise safety.

The CRA layer — and why it is different

CRA scope must be checked independently; it does not apply to every digital product without exclusions. Article 71 sets staged application:

"This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026."

That gives you the 11 September 2026 reporting obligations for actively exploited vulnerabilities and severe incidents, and the full December 2027 obligation set for essential cybersecurity requirements, vulnerability handling and the DoC layer.

Annex III lists important products and Annex IV critical products. Classify the final product by its main functionality and the technical descriptions in Implementing Regulation 2025/2392. A PLC, gateway or industrial sensor label, or the presence of an embedded HSM, does not by itself determine the class. See our classification guide.

Cybersecurity essential requirements: IEC 62443 as the working baseline

Harmonised standards under the CRA are still being drafted. Until they land, IEC 62443 is the credible baseline for industrial sensors and gateways. The two parts that matter most for product manufacturers:

• IEC 62443-4-1 — secure product development lifecycle requirements across eight practice areas (security management, specification, design, implementation, verification, defect management, release, update).
• IEC 62443-4-2 — technical security requirements for IACS components, organised around seven foundational requirements with security-level capabilities SL-C 1 through 4.

IEC 62443 can support the evidence plan. Map its actual coverage to CRA Annex I and technical documentation in Annex VII; it does not automatically establish CRA presumption or complete every requirement.

A typical CE compliance matrix for three device archetypes

These rows are scope questions, not declarations that an unexamined product meets a particular act. Resolve the exact design, exclusions and placement date before issuing the declaration.

DoC layout for a multi-instrument device

Article 14 of the ATEX Directive, Article 15 of the EMC Directive and equivalent provisions in the LVD and RED all require a single EU Declaration of Conformity. List every Union act in scope, identify the harmonised standards relied on (with publication year), Add a CRA conformity claim only for an in-scope product and affected units when the actual assessment supports it; do not convert a future evidence plan into a completed declaration. Our DoC 101 and sample DoC walkthrough show the layout.

Common mistakes

• Confusing emissions class with the immunity plan. An emissions classification under EN 55032 does not alone choose every immunity requirement. Assess the intended environment, exact product scope and the applicable emissions and immunity standards separately.
• Forgetting that RED supersedes EMC for radio equipment. Listing both Directive 2014/30/EU and Directive 2014/53/EU on the DoC for the same radio function is a red flag during market surveillance.
• Assuming ATEX equals "industrial." ATEX only applies to potentially explosive atmospheres. The intended use and legal scope determine whether ATEX applies; absence of an Ex marking does not prove that an in-scope product is exempt.
• Skipping CRA classification. Default-tier self-assessment is the lowest CRA burden, but only if the product is genuinely not in Annex III or IV. Use the exact Annex III/IV categories rather than treating all industrial automation products or HSM-containing devices as upper-tier.
• Stopping at IEC 62443-4-2 without 4-1. The secure development lifecycle is the part regulators and notified bodies will most want to audit. The technical SL-C levels are easier to demonstrate than the process maturity.
• Underestimating the 11 September 2026 reporting cut-off. Article 14 applies 15 months before the rest of the CRA. See our ENISA 24-hour reporting walkthrough.

Using Cenitia for this work

Cenitia helps prepare evidence-linked working drafts within its supported regulatory catalogue. Confirm the product scope, actual applied standards and completed assessments, and review the result before issuance. Source-change alerts prompt a review; they do not certify conformity, automatically reissue a signed declaration or guarantee monitoring of every national rule and standard edition.

Related from the Library

• CRA Annex III — important products — where industrial gateways and HSMs sit.
• IEC 62443 family overview — the de facto industrial cybersecurity series.
• RED–CRA overlap for connected radio — how the two regimes interact on wireless gateways.
• EN 18031 parts 1/2/3 comparison — harmonised RED cybersecurity standards.
• Technical file template for IoT — the documentation structure for connected devices.

Further reading

• Directive 2014/30/EU — EMC — official OJ text.
• Directive 2014/35/EU — Low Voltage Directive — official OJ text.
• Directive 2014/53/EU — Radio Equipment Directive — official OJ text.
• Directive 2014/34/EU — ATEX — official OJ text.
• Directive 2011/65/EU — RoHS — official OJ text.
• Regulation (EU) 2023/1230 — Machinery — official OJ text.
• Regulation (EU) 2024/2847 — Cyber Resilience Act — official OJ text.