CE marking, answered for importers

The framework is the New Legislative Framework: Decision No 768/2008/EC, which fixes the same modular structure — obligations, conformity assessment, CE marking, DoC — into every product act written since 2008, and Regulation (EC) No 765/2008 on accreditation and market surveillance. That is why the importer duties below read the same in every directive.

• There is no "CE authority" and no CE licence. The mark is not granted by anyone; using it without the documentation behind it is the offence.
• A notified body is involved only where the act's assessment route requires it — see below.
• CE says nothing about quality or safety beyond the legislation it covers. A dangerous product can be perfectly CE-marked for the directives it was assessed against; that is what GPSR covers on top.

The acts an importer most often meets, with what changed recently:

• Low Voltage 2014/35/EU — electrical safety, 50–1000 V AC and 75–1500 V DC.
• EMC 2014/30/EU — not interfering, and not being interfered with. Applies to almost everything electronic, even battery-powered below the LVD range.
• Radio Equipment 2014/53/EU (RED) — anything with Wi-Fi, Bluetooth, LTE, a remote control. Its cybersecurity requirements (Delegated Regulation (EU) 2022/30, standards EN 18031) apply since 1 August 2025 and are being folded into the Cyber Resilience Act.
• Toys 2009/48/EC — until the Toy Safety Regulation (EU) 2025/2509 fully applies on 1 August 2030, bringing digital CE marking and a product passport for toys.
• Machinery 2006/42/EC — until 20 January 2027, when Regulation (EU) 2023/1230 takes over with no transition after that date.
• PPE 2016/425, plus the sector acts for medical devices, construction products, pressure equipment, lifts, ATEX, marine equipment.
• RoHS 2011/65/EU — substance restrictions for all electrical and electronic equipment, declared in the same DoC. Covered on its own page, together with WEEE.

Product-level detail per sector: electronics, toys, the product groups overview.

The importer's duties, the same in every act that follows the NLF:

• Before placing on the market: verify that the manufacturer drew up the technical documentation and the EU Declaration of Conformity, that the CE marking is affixed correctly, that the product is accompanied by instructions and safety information, and that the product shows no obvious non-conformity. "Verify" means you have seen the DoC — not that your supplier promised one exists.
• Your name and address on the product — or on its packaging where the product is too small, and in the accompanying documents where even that is impossible. This is how market surveillance reaches you, and it is the check marketplaces run first.
• Instructions and safety information in the language of every member state you sell into — not just the country your warehouse sits in.
• Keep a copy of the Declaration of Conformity for ten years after the product was placed on the market, keep a register of non-conformities and recalled products, and cooperate with market-surveillance authorities on request.
• If you have reason to believe the product is non-compliant: do not place it until it is fixed, and inform the manufacturer and the authorities. Continuing to sell "because it was already ordered" is the classic enforcement case.

Where the manufacturer has no establishment in the EU and appointed no authorised representative, several acts shift part of the manufacturer's own duties to the importer — read the importer article of your directive before assuming the split. On top sits GPSR for consumer products: its Responsible Person requirement applies even to fully CE-marked goods.

• Routine notified-body territory: machinery in the high-risk categories of Annex IV, PPE risk category III (ongoing surveillance), most pressure equipment and lifts, ATEX equipment, radio equipment assessed outside the harmonised standards, medical devices under their own system.
• Where a notified body was involved, its four-digit number must stand behind the CE mark — CE followed by 0086-type numbering. CE with no number on a product that required a body is invalid on its face.
• Toys are self-certified using the EN 71 standards; a test report from an accredited lab is normal and useful, but no notified body "approves" a toy under the current directive.

What to demand from a non-EU manufacturer, in this order:

• The EU Declaration of Conformity, signed, naming every directive and regulation that applies, the harmonised standards used, and the notified-body certificate number where one was involved. One DoC may — and for multi-directive products should — cover them all.
• Technical documentation availability: the importer must be able to produce it, and the DoC must be in the languages the product is sold in or accompanied by a translation.
• Test reports from an accredited laboratory (check the accreditation, not the logo) — for the importer these are the evidence that the DoC is not aspirational.

If none of that exists, the product is not CE-compliant, whatever the listing photo says. The cheapest moment to discover that is before the container ships — sellers from China meet this exact trap, and marketplaces enforce it at listing level.

• 1 August 2025 — RED cybersecurity applies. Internet-connected radio equipment must meet the essential requirements of Delegated Regulation (EU) 2022/30 (network protection, privacy, fraud prevention; EN 18031 standards). Products without it are non-compliant now, not in 2027.
• 11 September 2026 — CRA reporting starts. The first obligation of the Cyber Resilience Act (Regulation (EU) 2024/2847): manufacturers of products with digital elements must notify actively exploited vulnerabilities and severe incidents. A year before the rest of the act applies.
• 20 January 2027 — Machinery Regulation (EU) 2023/1230 applies, replacing Directive 2006/42/EC. No transition period after that date: machinery placed on the market from that day is assessed under the new rules, with cybersecurity and digital documentation built in.
• 11 December 2027 — the CRA's main obligations apply: essential cybersecurity requirements and CE marking for products with digital elements. The RED cybersecurity delegated act is being repealed to avoid duplication — radio products move from the RED route to the CRA route.
• 1 August 2030 — Toy Safety Regulation (EU) 2025/2509 fully applies: digital CE marking and a Digital Product Passport for toys. Until then the 2009/48/EC regime runs; the passport machinery is the same registry the ESPR uses.

All of these sit in the compliance calendar with the rest of what actually applies.

• GPSR applies alongside CE, not instead of it. Where a CE act fully covers an obligation, GPSR steps back — but traceability, the EU Responsible Person, online-marketplace duties and accident reporting apply to consumer products regardless. The GPSR page carries the detail; the checklist turns it into fifteen checks.
• Great Britain does not recognise the EU regime as its own (Northern Ireland, under the Windsor Framework, largely does). Selling into GB can require UKCA marking and a UK Responsible Person: the UK page maps which system applies where.