Alexandre Bloch
CTO, Engineering
CE marking in 2026: from physical goods to digital products.
CE marking is the European passport for products. Roughly 25 harmonisation directives and regulations cover machinery, electrical equipment, radio devices, toys, medical devices, PPE, construction products and more — and from December 2027, software and connected devices join the list under the Cyber Resilience Act. Here is what 2026 actually requires across both worlds.
What CE marking actually is
CE marking is not a quality label. It is a manufacturer’s declaration that a product meets all the EU harmonisation requirements that apply to it. The CE mark is affixed by the manufacturer (or the authorised representative) — not by an EU agency — and it makes the product legally placeable on the market across all 30 EEA countries.
A product needs CE marking only if it is covered by at least one EU harmonisation directive or regulation. If your product falls outside that perimeter (e.g. furniture without electrical components, most non-toy household items), CE marking does not apply — but the General Product Safety Regulation (GPSR) almost certainly does.
CE marking · the four roles
01
Manufacturer
Affixes the mark, holds the technical file
02
Authorised rep.
EU-based, if manufacturer is non-EU
03
Importer
Verifies CE before placing on market
04
Notified body
Third-party assessment for high-risk products
The directives and regulations behind the mark
A single product often falls under several texts at the same time. A connected industrial robot can trigger Machinery, EMC, RED and (from 2027) the Cyber Resilience Act simultaneously. Here are the ones you are most likely to meet.
| Reference | Scope | Notified body? |
|---|---|---|
| Machinery Reg. 2023/1230 | Machines, AI-driven equipment, safety components (replaces Dir. 2006/42 from Jan 2027) | Sometimes |
| Low Voltage Dir. 2014/35 | Electrical equipment 50–1000 V AC / 75–1500 V DC | No |
| EMC Dir. 2014/30 | Electromagnetic compatibility — almost any electrical product | No |
| RED 2014/53 | Radio equipment (Wi-Fi, Bluetooth, cellular, IoT radios) | Sometimes |
| RoHS 2011/65 | Hazardous substances in electrical & electronic equipment | No |
| Toy Safety Dir. 2009/48 | Toys for children under 14 | Sometimes |
| MDR 2017/745 | Medical devices (class I to III) | Class IIa+ |
| PPE Reg. 2016/425 | Personal protective equipment | Cat. II–III |
| CPR 305/2011 | Construction products (under revision in 2025/2026) | Most |
| Pressure Eq. 2014/68 | Pressure equipment above 0.5 bar | Most |
| CRA 2024/2847 | Products with digital elements (software, IoT) — applies Dec 2027 | Critical only |
The five steps to CE-mark a product
01
Identify the applicable directives and regulations
A toaster might need Low Voltage + EMC + RoHS. A connected toaster adds RED and the CRA. Get this list wrong and the rest of the file is moot.
02
Apply the harmonised standards or run a risk assessment
Each directive points to a list of harmonised EN standards. Following them grants a presumption of conformity. Otherwise, document the gap and a risk-based justification.
03
Build the technical file
Product description, design drawings, list of standards used, risk analysis, test reports, instructions, packaging — everything that proves the product meets the essential requirements. Kept for 10 years after last placing on the market.
04
Run the conformity assessment (self or notified body)
For most products, the manufacturer self-assesses (Module A). For higher-risk ones — class IIa+ medical devices, certain machines, lifts, pressure equipment — a notified body must be involved (Modules B/C/D/F/G/H).
05
Sign the EU Declaration of Conformity, affix the mark
A single dated, signed declaration covers all the directives applied. The CE mark goes on the product (or packaging if impossible), at least 5 mm tall. The four-digit notified body number sits next to it when relevant.
Three big shifts to track through 2026 and 2027
1. The Machinery Regulation (EU 2023/1230) replaces the Directive
From 14 January 2027, the new Machinery Regulation applies. It introduces explicit requirements for AI-enabled machines (autonomous behaviour, safety functions implemented in software), cybersecurity, and digital instructions. Any manufacturer with a machine in the catalogue should have begun the gap analysis by now.
2. The Cyber Resilience Act (EU 2024/2847) extends CE marking to software
From 11 December 2027, every "product with digital elements" — connected devices, IoT, embedded software, sometimes standalone software — needs CE marking under the CRA. Concretely: secure-by-default configuration, documented vulnerability handling, free security updates for the expected lifetime (minimum 5 years), and a Software Bill of Materials (SBOM). Self-assessment for most; third-party for "important" and "critical" categories.
3. The Construction Products Regulation overhaul
The new Construction Products Regulation (CPR) replaces Regulation 305/2011, with phased application across 2026–2030. New: a Digital Product Passport for construction products, sustainability requirements, and tighter market surveillance. If you sell concrete, steel, insulation, doors, windows or any product covered by a harmonised technical specification, the obligations are moving fast.
Where teams trip up
- Missing a directive: most CE-marked products fall under 3 to 5 texts simultaneously, not one.
- Treating notified-body involvement as optional when the module clearly mandates it.
- Ignoring "substantial modifications": a firmware update can re-trigger the entire conformity assessment.
- Importing under your own brand without verifying the manufacturer’s technical file — the importer becomes liable.
- Confusing CE marking with the UKCA mark, the Eurasian EAC mark, or the Swiss equivalent — they overlap but are not the same.
CE marking is no longer just a physical-goods discipline
For 30 years, CE was a physical-goods passport. From 2027 it covers software too. The teams that will scale fastest are the ones treating CE marking as a living portfolio mapping — every product, against every applicable text, against every market — rather than a one-time launch checklist.
Frequently asked questions
Which products need CE marking?
Any product covered by at least one of about 25 EU harmonisation directives or regulations: machinery, electrical equipment (Low Voltage), EMC, radio equipment (RED), RoHS, toys, medical devices (MDR), PPE, pressure equipment, lifts, gas appliances, construction products, etc. From December 2027, software and connected devices join the list under the Cyber Resilience Act.
When do I need a notified body?
For most low-risk products, the manufacturer self-assesses conformity (Module A). For higher-risk products — class IIa+ medical devices, certain machinery, lifts, pressure equipment above set thresholds, category II–III PPE, most construction products — an EU notified body must conduct or witness the assessment (Modules B/C/D/F/G/H). The notified body issues a certificate and its four-digit ID is affixed next to the CE mark.
What is changing for CE marking in 2026 and 2027?
Three big shifts: (1) the new Machinery Regulation (EU 2023/1230) replaces the old Machinery Directive from 14 January 2027, with explicit requirements for AI-driven machines and cybersecurity; (2) the Cyber Resilience Act (EU 2024/2847) extends CE marking to products with digital elements from 11 December 2027, requiring vulnerability handling and free security updates; (3) the new Construction Products Regulation phases in from 2026 to 2030 with a Digital Product Passport for construction products.
Related resources
Solutions
Product Compliance SolutionCompliance · 2026-03-06
Product Compliance in the EU: The Complete Guide for Tech Companies
Compliance · 2026-03-11
Multi-Market Product Compliance for Retail & Consumer Goods: The Definitive Guide
Product Compliance · 2026-03-12
Global Chemical Product Compliance: CAS Numbers, Formulations & Multi-Country Regulations
Try Cleo: free regulatory risk scan
See your regulatory landscape mapped in minutes. No signup, no credit card.
