Regulatory Landscape: FCC, CE, ETSI EN 303 645 IoT

Every radio-equipped product that crosses a border has to satisfy a patchwork of national rules before it can legally be sold, and getting this wrong is not a paperwork inconvenience — it can mean customs seizure, forced recalls, or liability if a compromised device causes harm. For embedded engineers, regulatory compliance is not something bolted on at the end; RF module selection, antenna design, firmware update mechanisms, and even default password handling are now shaped directly by FCC, CE, and security regulations like ETSI EN 303 645. Understanding what each regime actually tests — and when in the design cycle to plan for it — avoids expensive re-spins.

The Three Regimes at a Glance

These are not competing standards — they are layered. A Wi-Fi thermostat sold in Germany needs CE marking (which since 2024 pulls in cybersecurity requirements under the Radio Equipment Directive), while the same product sold in the US needs FCC certification. Neither the FCC nor the base CE marking historically covered cybersecurity — that gap is what EN 303 645 was written to close.

FCC: Spectrum and Interference Control

The FCC regulates any device that intentionally or unintentionally radiates RF energy. For embedded designers, the two categories that matter most:

• Part 15 (unintentional and intentional radiators): covers Wi-Fi, Bluetooth, Zigbee, and most unlicensed ISM-band devices (902–928 MHz, 2.4 GHz, 5 GHz). Requires demonstrating emissions stay below specified field-strength limits, both in-band (intentional radiator) and out-of-band/spurious.
• Authorization procedure:
  • Supplier's Declaration of Conformity (SDoC): self-testing against FCC limits, used for low-risk unintentional radiators (e.g., a microcontroller board with no radio).
  • Certification: required for intentional radiators — the device must be tested at an FCC-recognized accredited lab, and the grantee gets an FCC ID that must be displayed (or, for small products, made available electronically per e-labeling rules).

Design implication: if a product integrates a pre-certified module (e.g., a modular Wi-Fi/BLE SoC with its own FCC grant), the end product may qualify for modular approval — but only if the host design doesn't degrade the module's RF performance (antenna placement, shielding, conducted vs. radiated changes) and doesn't add its own unintentional-radiator sources like a noisy switching regulator near the antenna. Re-testing is required if the module is used outside the conditions of its original grant (e.g., a different antenna gain, different enclosure).

CE Marking: The EU's Multi-Directive Bundle

CE marking is not a single test — it's a declaration that a product meets all applicable EU directives. For a typical connected embedded device, three usually apply:

• RED (Radio Equipment Directive 2014/53/EU): covers radio spectrum use, and since August 2024, Article 3.3(d)/(e)/(f) pulls in cybersecurity, privacy, and fraud-protection requirements for internet-connected radio equipment — effectively mandating the technical content of EN 303 645 for a wide class of products.
• EMC Directive: immunity and emissions for non-radio electronics (conducted/radiated emissions, ESD, surge immunity).
• Low Voltage Directive (LVD): electrical safety for equipment operating between 50–1000 VAC / 75–1500 VDC.

The manufacturer self-declares conformity by testing against harmonized standards (e.g., ETSI EN 300 328 for 2.4 GHz radios, EN 55032/55035 for EMC) and issues a Declaration of Conformity (DoC) — no third-party certification body is mandatory unless the product falls into a higher-risk category. This is a materially different model from FCC certification: CE is manufacturer-attested, backed by technical documentation that must be produced on request, whereas FCC certification requires accredited-lab testing and a formal grant before sale.

Design implication: the RED cybersecurity delegated act means a product without secure boot, unique default credentials, or a documented vulnerability-disclosure process can now fail CE conformity on cybersecurity grounds alone — even if its RF and EMC performance is fine. This converts EN 303 645-style requirements from "best practice" into a legal precondition for EU market access for radio equipment.

ETSI EN 303 645: The Consumer IoT Security Baseline

EN 303 645 is a technical standard (not a law by itself) defining baseline security provisions for consumer IoT. Its 13 provisions are organized around one overriding principle: no universal default passwords. Key provisions relevant to firmware/hardware design:

Worked example — provision 5.1 in practice: A Wi-Fi power outlet ships with an initial setup flow. A non-compliant design burns the same default AP password ("12345678") into every unit's flash image at the factory — trivially discoverable and reused across the whole product line. A compliant design instead provisions a unique password per unit at manufacture, either printed on a physical label (paired with a corresponding secure pairing mechanism, e.g., BLE-based onboarding with out-of-band key exchange) or generated on first boot via a cryptographically random value stored in OTP, with the device rejecting any factory-default credential outside first-time setup. The engineering cost is a per-unit provisioning step in manufacturing test (writing a unique key/credential to secure storage) instead of flashing one golden image — a real production-line change, not just a firmware flag.

Where the Regimes Now Overlap

The historical separation — FCC/CE for RF and safety, EN 303 645 for security — is collapsing:

• The EU RED delegated act (in force from August 2024, enforcement from August 2025) makes cybersecurity requirements a mandatory part of CE conformity for radio equipment, using EN 303 645/EN 18031 series as the harmonized standards manufacturers can point to for presumption of conformity.
• The UK PSTI (Product Security and Telecommunications Infrastructure) Act made the "no default passwords" and "vulnerability disclosure" provisions of EN 303 645 legally mandatory for consumer connectable products sold in the UK, ahead of the EU.
• The US doesn't yet have a direct EN 303 645 equivalent in law, but the voluntary US Cyber Trust Mark program (FCC-administered labeling scheme) draws heavily on the same NIST/EN 303 645 baseline, and state-level laws (e.g., California SB-327) already prohibit default passwords.

Practical takeaway for a design team: treat "no default password, secure storage of keys, OTA-capable, disclosed support lifetime" as a baseline requirement for any connected product regardless of which single market it launches in first — retrofitting these into a shipped product (especially secure key provisioning at manufacture) is far more expensive than designing for it from the first prototype.

Key Takeaways

• FCC (US) and CE (EU) marking primarily govern radio spectrum interference and electrical/EMC safety, with distinct authorization models: FCC requires accredited-lab certification and a grant for intentional radiators, while CE is manufacturer self-declared against harmonized standards.
• ETSI EN 303 645 defines a consumer IoT cybersecurity baseline centered on eliminating universal default passwords, requiring secure credential storage, OTA updates, and a vulnerability disclosure process.
• Since 2024, the EU's RED delegated act folds EN 303 645-style cybersecurity requirements into mandatory CE conformity for radio equipment — security is no longer optional for EU market access.
• Using a pre-certified RF module doesn't guarantee compliance of the end product; antenna, enclosure, and interference sources on the host board must stay within the module's original test conditions or re-testing is required.
• Designing for unique per-device credentials, secure storage, and OTA capability from the first prototype is significantly cheaper than retrofitting compliance after a product has already shipped.