A pre-certified ESP32 module makes certifying your product much easier, though it doesn't do it for you. What the FCC's modular approval actually covers, what the EU's RED cybersecurity rules have required since August 2025, how the Cyber Resilience Act takes over in December 2027, and a realistic path for a small hardware team.
The radio is the hardest part of a wireless product to certify. Espressif sells ESP32 modules that already hold FCC and other regional approvals for their radios, so a product built around one, rather than around a bare chip with your own RF layout and antenna, inherits that work. It is the single biggest decision a small team can make to keep certification affordable, and it constrains the design: use the module as approved, with its antenna or an approved one, and follow the module's integration instructions.
Under the FCC's modular approval guidance (KDB 996369), the module's grant covers the module's intentional radio emissions. The host product's manufacturer — you — remains responsible for everything the grant does not cover: most importantly the product's unintentional emissions under Part 15 Subpart B (the digital circuitry, power supply and cables), any other transmitters in the product, and a limited set of verification tests with the module operating inside your product. The finished product must carry a physical or electronic label stating "Contains FCC ID" with the module's ID.
Plan a pre-scan at a test lab early, on a prototype board, so emissions problems are found while layout is cheap to change.
Keep the module's antenna clearance and ground rules exactly as its integration guide says; most failures are self-inflicted here.
If you add a second radio — a sub-GHz transceiver, LTE — co-location rules apply and the scope grows.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
In the EU the radio module's own CE marking does not carry over automatically: the finished product is radio equipment and needs its own conformity assessment against the Radio Equipment Directive — safety, EMC and radio — although the module's test reports make the radio part much easier. Since August 1, 2025 the RED's cybersecurity requirements also apply to internet-connected radio equipment, with the EN 18031 series as the harmonised standards: protecting the network, protecting personal data and, for some products, preventing fraud. In practice that means no shared default passwords, protected credentials and communications, secure updates and minimal exposed services.
The Commission has repealed the RED cybersecurity delegated regulation with effect from December 11, 2027 — the day the Cyber Resilience Act's main obligations apply to products with digital elements. The CRA asks for more: security by design across the product's life, a software bill of materials, security updates for a defined support period, a vulnerability-handling process and — already since September 11, 2026 — reporting actively exploited vulnerabilities within 24 hours. A device designed for EN 18031 is a good start; plan the CRA's process and documentation on top.
Secure Boot V2, so only firmware you signed runs.
Flash encryption and encrypted NVS, so credentials cannot be read off a stolen board.
HTTPS over-the-air updates in ESP-IDF, with rollback — the mechanism behind every security update you will be required to ship.
Unique per-device credentials provisioned at manufacture, never a shared key compiled into the firmware.
An SBOM generated from the ESP-IDF build, versioned with each release.
Prototype on a dev kit with the exact module you will ship.
Design the board around the module following its integration guide; get a lab pre-scan on the first spin.
Turn on Secure Boot, flash encryption and signed OTA before any unit leaves your hands.
Formal testing: FCC Part 15B and module verification for the US; RED including EN 18031 for the EU.
Write the support-period, update and vulnerability-reporting process now, so the CRA in 2027 is documentation of what you already do.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Choosing an ESP32 in 2026: S3, C6, C5, H2 or P4, and Getting It to the Cloud Safely
Espressif's range now spans dual-band Wi-Fi 6 with Thread on one chip, Thread-only parts for Matter networks and a 400 MHz media processor with no radio at all. Which chip fits which product, and the device-to-cloud design (identity, transport, updates) that keeps a fleet secure after it ships.
Read
The EU Cyber Resilience Act and AI Act in 2027: What Software and Connected-Device Teams Need to Do
CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.