Smart home and security
EU Declaration of Conformity for Wi-Fi Routers and Mesh Systems: requirements and checklist
By Ing. Jaroslav Křepelka, Owner, DoC solutions s.r.o. · Updated 29 October 2026
In short: A Wi-Fi router is declared under the Radio Equipment Directive 2014/53/EU, including the cybersecurity requirements of Delegated Regulation (EU) 2022/30 that apply since 1 August 2025, and the RoHS Directive 2011/65/EU. Its 5 GHz radio has indoor-only restrictions that must be shown on the packaging, and from 11 December 2027 routers are "important products" (class I) under the Cyber Resilience Act (EU) 2024/2847.
Routers are the device the EU cybersecurity rules were written for. They connect a home to the internet, so the RED network-protection requirement applies to every model, and the Cyber Resilience Act lists routers among its important products, with stricter conformity assessment from December 2027.
This page covers Wi-Fi routers, mesh systems, access points, range extenders and 4G/5G mobile routers for home and small-office use.
Checklist: what your wi-fi router / mesh system declaration must contain
- Model exactly as on the label, listing each unit of a mesh set and each regional or radio variant
- Name and postal address of the manufacturer (and of the authorised representative, if appointed)
- The statement that the declaration is issued under the sole responsibility of the manufacturer
- Radio Equipment Directive 2014/53/EU, including Delegated Regulation (EU) 2022/30
- RoHS Directive 2011/65/EU
- The harmonised standards for each radio band, EMC, safety, EMF and cybersecurity, with versions
- Place and date of issue, name and function of the signatory, and the signature
Which EU legislation applies
| Legislation | Applies? | In the DoC? | Notes |
|---|---|---|---|
| Radio Equipment Directive2014/53/EU | Applies | In the DoC: Yes | Covers safety (with no voltage limit), EMC and the radio. Do not cite the LVD and EMC Directives separately; the mains adapter, if separate, has its own declaration. Where use is restricted, as for 5 GHz indoor-only channels, Article 10(10) requires the packaging to identify the Member States or areas concerned. |
| Cybersecurity delegated actDelegated Regulation (EU) 2022/30 | Applies | In the DoC: Yes | Applicable since 1 August 2025. A router is internet-connected radio equipment, so network protection (Article 3(3)(d)) always applies, and data protection (Article 3(3)(e)) applies because it processes personal data such as device lists and traffic. |
| Cyber Resilience Act(EU) 2024/2847 | Applies | In the DoC: No | Annex III lists "routers, modems intended for the connection to the internet, and switches" as important products (class I). Vulnerability reporting applies from 11 September 2026 and the full requirements, including the stricter conformity assessment for class I products, from 11 December 2027. |
| RoHS Directive2011/65/EU | Applies | In the DoC: Yes | Restriction of hazardous substances in electrical and electronic equipment. |
| Ecodesign: standby and networked standbyRegulation (EU) 2023/826 | Depends on model | In the DoC: Yes | Check whether your equipment falls within its scope and which networked standby requirements apply; network equipment with high network availability has specific rules. |
| WEEE Directive2012/19/EU | Applies | In the DoC: No | Producer registration in every EU country where you sell and the crossed-out wheeled bin symbol. |
Typical harmonised standards
A harmonised standard gives presumption of conformity only in the version cited in the Official Journal of the EU. Always check the current list for each directive before you issue or update a declaration (European Commission: harmonised standards); the versions below are the ones commonly used at the time of writing, and the right selection depends on your product.
Radio
Versions shown are cited under RED in Implementing Decision (EU) 2022/2191 as amended. Check the current list for each band before you issue the declaration.
- ETSI EN 300 328 V2.2.22.4 GHz wideband data transmission
- ETSI EN 301 893 V2.2.15 GHz RLAN, including dynamic frequency selection
- ETSI EN 303 687 V1.1.16 GHz RLAN, for Wi-Fi 6E and Wi-Fi 7 models (cited with a notice on narrowband devices)
- ETSI EN 301 908 seriesIMT cellular networks, for 4G and 5G mobile routers
EMC, safety and EMF
- ETSI EN 301 489-1 and EN 301 489-17 V3.3.1EMC standard for radio equipment — wideband data transmission systems
- EN 55032:2015 + A11:2020 and EN 55035:2017 + A11:2020EMC of multimedia equipment, used for the wired network parts
- EN 62368-1Safety of ICT equipment (current edition EN IEC 62368-1:2024 + A11:2024)
- EN 62311 or EN 62479Human exposure to electromagnetic fields
Cybersecurity
- EN 18031-1:2024Internet-connected radio equipment (cited with restrictions)
- EN 18031-2:2024Radio equipment processing data (cited with restrictions)
Hazardous substances (RoHS)
- EN IEC 63000:2018Technical documentation for the assessment of electrical and electronic products with respect to the restriction of hazardous substances
Already have a declaration for your wi-fi router / mesh system?
A certification expert checks it against everything on this page and tells you exactly what to fix. Written report in 48 hours, €99 per product (excl. VAT).
Among other things, we check for the mistakes we find most often:
- Cybersecurity not addressed
- 5 GHz restrictions not on the packaging
- 6 GHz models assessed with old standards
Common mistakes in wi-fi router / mesh system declarations
Cybersecurity not addressed
Default passwords shared across units, open management interfaces and no update mechanism are the classic gaps. Since 1 August 2025 every router must meet RED Article 3(3)(d), typically shown with EN 18031-1.
5 GHz restrictions not on the packaging
The 5150–5350 MHz band is restricted to indoor use. Article 10(10) of RED requires the packaging to show where such restrictions apply, usually with a country code table.
6 GHz models assessed with old standards
Wi-Fi 6E and Wi-Fi 7 routers need EN 303 687 for the 6 GHz band in addition to the 2.4 and 5 GHz standards.
LVD and EMC listed next to RED
For radio equipment RED covers safety and EMC; listing the other directives is a template error.
No plan for the Cyber Resilience Act
Routers are class I important products. From 11 December 2027 the manufacturer's own internal control is only enough when harmonised standards are applied in full; otherwise a notified body is needed.
What you need besides the declaration
- Technical documentation
- Radio, EMC, safety and EMF test reports for each band, a cybersecurity risk assessment with EN 18031 evidence, the security update policy, and RoHS documentation. Keep it for 10 years.
- Security support and information
- A vulnerability disclosure contact, security updates for a defined support period, and secure-setup information for users, which the CRA will make mandatory.
- Packaging and instructions
- Frequency bands and maximum power in the instructions, the restrictions table on the packaging, and installation and safety information in the local language.
- Economic operator in the EU
- An importer, authorised representative or responsible person established in the EU (Article 4 of Regulation (EU) 2019/1020).
No EU presence yet? We can act as your EU authorised representative or responsible person.
Frequently asked questions
Do Wi-Fi routers have to meet the RED cybersecurity requirements?
+
Yes. Every router is internet-connected radio equipment, so Delegated Regulation (EU) 2022/30 has applied since 1 August 2025.
Is a router an important product under the Cyber Resilience Act?
+
Yes. Annex III of Regulation (EU) 2024/2847 lists routers, modems for internet connection and switches as class I important products, with full requirements from 11 December 2027.
Why does the router box need a country table?
+
Part of the 5 GHz band may only be used indoors. RED Article 10(10) requires the packaging to identify the countries or areas where such restrictions apply.
What does MyCECheck check on a router declaration?
+
RED and the cybersecurity delegated act, the radio standards for every band and their versions, the identification of every unit in a mesh set, and the economic operator. Written report within 48 hours.
Already have a declaration for your wi-fi router / mesh system?
A certification expert checks it against everything on this page and tells you exactly what to fix. Written report in 48 hours, €99 per product (excl. VAT).
Among other things, we check for the mistakes we find most often:
- Cybersecurity not addressed
- 5 GHz restrictions not on the packaging
- 6 GHz models assessed with old standards