One person, CE mark: what it actually takes to sell electronics in the EU

My ESP32-S3 sensor design works. It boots, it senses, it survived bring-up with only one bodge resistor’s worth of indignity. Which brought me to the part of hardware nobody warns you about, because the people who know it are all inside compliance departments and the people outside haven’t done it yet: what does it actually take for one person — no lawyer, no regulatory team, no adult supervision of any kind — to legally sell a wireless electronic product in the European Union?

I have now surveyed that answer for my own production plans, and I understand why the accessible write-up doesn’t exist. This post is the map I wish someone had drawn me. It is one maker’s map, not legal advice; the mountain is real, but I’m describing its shape, not guaranteeing your route up it.

The mountain, surveyed

Sell a wireless, battery-powered gadget into the EU and you are dealing with, at minimum, five distinct bodies of law:

• RED, the Radio Equipment Directive — the one that puts the CE mark on anything that deliberately transmits. Wi-Fi counts. Bluetooth counts. An ESP32-S3 counts twice.
• EN 18031, the cybersecurity requirements that now ride along with the radio rules. Your firmware’s security posture, promoted from good practice to paperwork.
• GPSR, the General Product Safety Regulation — the catch-all that says the product must be safe in the ordinary human sense, and that you must be able to prove you thought about it before anyone asks.
• The EU Battery Regulation, which among other things will require user-replaceable batteries from 18th February 2027.
• WEEE/EPR — electronic-waste producer registration, handled separately in every country you sell into. I’m planning three countries. That’s three registrations, three fee schedules, three annual reporting rituals.

Individually, each of these is defensible. Collectively, they are why nobody writes this up for indie hardware: the people who’ve climbed the mountain did it inside companies, with the sherpas on payroll, and the trip reports all assume you have a regulatory affairs department rather than a spare bedroom.

What each acronym wants from you

RED is the big one, because it’s the directive under which the CE mark actually goes onto radio equipment. The part that deserves a beat of silence: for most consumer radio gear, nobody hands you a CE mark. You assess your own product, you compile your own evidence into a technical file, and you sign a Declaration of Conformity with your own name at the bottom. The mark is a claim. The file is what stands behind the claim on the day someone official comes asking. For a publication whose entire thesis is “generative output needs deterministic verification”, there is something almost poetic about the EU requiring me to build the verification myself and then vouch for it personally.

EN 18031 is the newer arrival: cybersecurity requirements attached to the radio rules. The practical shift is subtle but real — the security properties of your firmware stop being engineering hygiene you do because you’re a professional, and become compliance evidence you must be able to show. Everything I already wanted the device to do (no unattended nonsense on the network, a sane update story) now needs to exist as documented fact rather than as good intentions. As forcing functions go, I’ve seen worse.

GPSR is the regulation for everything the other regulations forgot. It’s the general obligation that the product is safe and that you can demonstrate diligence — which, for a solo maker, mostly translates to: the documentation you were planning to skip, written down anyway, filed where you can find it.

The Battery Regulation is the sleeper. Everyone has heard of the CE mark; nobody building their first product has heard of the battery rules, and they reach further into the mechanical design than anything else on this list. The user-replaceable mandate means the glued-shut-pouch-cell school of product design is on notice: the battery has to come out, by the user, which makes the enclosure, the connector, and the cell format compliance decisions rather than aesthetic ones. I would very much rather learn this before the enclosure is final than after. That is not a hypothetical order of events. It is merely, this time, not the order that happened to me.

WEEE/EPR is the least glamorous and the most bureaucratically fractal. Producer responsibility for e-waste is administered nationally — there is no single EU counter to queue at. You register in each member state you sell into, pay each one’s fees, and report to each one on its own schedule. Three countries planned means the same paperwork three times, in three languages, against three different portals of varying vintage. This is also the line item where “it’s a single market, just sell everywhere” goes to die quietly.

The one insight that makes it survivable

Somewhere in the middle of the survey, a structural pattern emerged, and it’s the thing I’d ask you to keep if you keep nothing else from this post: almost all of the expensive parts are per-company, not per-product.

The registrations. The EPR accounts. The learning curve. The document templates, the processes, the understanding of which acronym bites when. You pay for nearly all of it once, and your second product strolls through on infrastructure the first one built. The first product isn’t paying its own toll — it’s paying the toll for every product that comes after it.

That flips the mental accounting entirely. Viewed per-gadget, the mountain is absurd: a crushing overhead on one small circuit board. Viewed as what it actually is — the setup cost of becoming a hardware company, even a hardware company with a headcount of one — it amortises the way infrastructure always does. Compliance is infrastructure, not unit cost. Budget it like a server rack, not like a component.

As for what the mountain costs in actual euros: the honest ranges are still being negotiated with reality, and I’d rather publish numbers that have survived contact with an invoice. In reality, I am still collecting this information. Future update maybe? :D

The other kind of verification

The same production-planning exercise covered the making of the things, not just the blessing of them — unit economics at three volume tiers, because every interesting decision changes depending on which tier you’re honest enough to admit you’re in. The tier where each unit is hand-soldered love. The tier where a contract manufacturer starts returning your emails. The tier where the spreadsheet finally behaves. Same board, three completely different businesses.

And at the end of every one of those lines sits the same requirement: each unit that ships has to demonstrably work. For small batches, the answer is a pogo-pin test jig — spring-loaded contacts pressed onto the board’s test pads by a fixture, a script that exercises each subsystem, and a verdict. Pass or fail, no vibes.

Regular readers will recognise the shape of this. The whole publication has one thesis — generative work gated by deterministic verification — and it turns out the EU independently agrees, minus the AI. The technical file is the design review. The test jig is the CI pipeline. The CE mark is, roughly, DRC for the market: a deterministic gate between “works on my bench” and “a stranger can legally buy one”.

What I’d tell past me

• Read the regulations before you freeze the mechanicals. The battery rules reach into the enclosure, the connector, the cell choice. Compliance is a design input, not a shipping step, and it’s vastly cheaper as the former.
• Count countries, not customers. Every member state you sell into is another WEEE/EPR registration with its own fees and reporting. Pick launch countries the way you pick components: deliberately, and fewer than you’d like.
• Book the cost as infrastructure. The expensive parts are per-company, not per-product. It hurts once, then every future product rides for nearly free. This is either a moat or a toll gate, depending on which side of it you’re standing.
• Build the functional test jig early. It’s the last deterministic gate before a stranger owns your mistake, and designing test pads into the board costs nothing at layout time and everything after.
• Write the file as you go. A technical file is cheap as a habit and brutal as an archaeology project. Every design decision you document today is one you won’t be reconstructing from git blame in a panic later.

The board took one bodge wire to come alive — that resistor has its own story elsewhere on this site. The company takes a binder. The difference, and it’s the whole difference, is that the binder only has to be built once.