Which EU Regulations Apply to My Product?

An electronic device with wireless connectivity — whether via WiFi, Bluetooth Low Energy, or cellular network — is arguably the product type that accumulates the greatest regulatory burden under the current European framework. The reason is simple: it combines digital elements with radio connectivity and, if intended for consumers, also falls within the orbit of general product safety.

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, applies to "products with digital elements marketed on the market whose intended or reasonably foreseeable use includes a logical or physical, direct or indirect, connection to a device or network" (Art. 2(1)). A WiFi/BLE/cellular device fits directly within this definition. The CRA will be generally applicable from December 11, 2027, although vulnerability notification obligations are brought forward to September 11, 2026.

The Radio Equipment Directive (RED), Directive 2014/53/EU, is the reference regulation for all equipment using the radio spectrum for communication or radiodetermination (Art. 1(1)). A WiFi, BLE, or cellular device is radio equipment by definition. Furthermore, Delegated Regulation (EU) 2022/30 activates from August 1, 2025 the essential requirements of Art. 3(3)(d), (e), and (f) of the RED for internet-connected equipment, equipment processing personal data, and equipment enabling monetary transfers, introducing cybersecurity, data protection, and fraud protection obligations. Delegated Reg. 2022/30 is expected to be repealed from December 11, 2027, when the CRA enters full application.

The RoHS Directive (Dir. 2011/65/EU) restricts the use of hazardous substances in electrical and electronic equipment (Art. 2(1)). A connected electronic device is electrical and electronic equipment for the purposes of this Directive, unless it falls within one of the exclusions in Art. 2(4), such as medical devices, military equipment, or non-road mobile machinery intended exclusively for professional use.

The Data Act (Reg. 2023/2854) applies to "connected products" that obtain, generate, or collect data relating to their performance, use, or environment and that can communicate such data (Art. 1(2) and definition in Art. 2(5)). A WiFi/BLE/cellular device that generates usage data falls within its scope. The Data Act has been applicable since September 12, 2025.

If the device incorporates an artificial intelligence system, the AI Act (Reg. 2024/1689) could apply. The AI Act applies to providers that market or put into service AI systems in the EU, as well as to importers and distributors (Art. 2(1)). Application depends on whether the product contains an "AI system" as defined in Art. 3(1) and its risk level.

If the product is intended for consumers, the GPSR (Reg. 2023/988) acts as a safety net for aspects and risks not covered by specific sectoral legislation (Art. 2(1)). The GPSR excludes products entirely covered by EU harmonization legislation, but applies complementarily for aspects not covered.

If the device is a general-purpose computer, a smartphone, or a terminal accessing electronic communications services or audiovisual services, the European Accessibility Act (EAA), Directive 2019/882, could apply (Art. 2(1)). Accessibility obligations have been applicable since June 28, 2025. Micro-enterprises (fewer than 10 employees and turnover or balance sheet not exceeding €2M) are exempt regarding services.

A connected toy — for example, a doll with Bluetooth, a children's tablet with WiFi, or a toy drone with app control — is perhaps the product type with the highest regulatory density. It combines the status of toy, electronic equipment, radio equipment, product with digital elements, and potentially, connected product for data purposes.

The Toy Safety Regulation (Reg. 2025/2509) applies to all products designed or intended, whether exclusively or not, for use in play by children under 14 years of age (Art. 2(1)). A product shall be deemed intended for play by children when a parent or supervisor could reasonably assume, by virtue of its functions, dimensions, and characteristics, that it is intended for such use. The new Regulation, published on December 12, 2025, will be generally applicable from August 1, 2030, replacing Directive 2009/48/EC. It includes specific essential safety requirements for toys with digital elements and internet-connected toys, requiring cybersecurity safeguards and privacy protection.

The CRA applies to the connected toy as a product with digital elements (Art. 2(1)). The RED applies if the toy uses the radio spectrum (Art. 1(1)), and Delegated Reg. 2022/30 extends privacy and personal data protection obligations specifically to toys covered by the Toy Directive and to childcare equipment, even without an internet connection (Art. 1(2)(a)). RoHS applies to the toy's electronic component as electrical and electronic equipment (Art. 2(1)).

The Data Act could apply if the toy is a "connected product" that generates data about its use (Art. 2(5)). The GPSR applies as a complementary safety net for aspects not covered by sectoral legislation (Art. 2(1)). If the toy incorporates AI, the AI Act could apply, and since AI toys interact with minors, they could be classified as high-risk under the criteria of Annex III of the AI Act.

Industrial machinery intended exclusively for professional use has a different regulatory profile from consumer products. The GPSR generally does not apply, as it targets products intended for consumers or that can foreseeably be used by consumers (Art. 2(1)). B2B industrial machinery falls outside this definition unless, by its characteristics, a consumer could reasonably come to use it.

If the machinery incorporates digital elements with network connectivity — a PLC controller with Ethernet, an HMI interface with WiFi, industrial IoT sensors — the CRA could apply (Art. 2(1)). The CRA does not distinguish between consumer and industrial products: its scope covers all products with digital elements marketed on the EU market whose intended use includes a connection to a device or network. Recital 12 of the CRA confirms that it covers from consumer products to industrial systems.

RoHS applies to electrical and electronic equipment across all Annex I categories, including category 11 "Other EEE not covered by the above categories" (Art. 2(1)). However, Art. 2(4) specifically excludes large-scale stationary industrial tools, large-scale fixed installations, and non-road mobile machinery intended exclusively for professional use.

If the machinery uses radio modules (WiFi, Bluetooth, cellular), the RED applies to the radio module (Art. 1(1)). If it generates usage data and can communicate it, the Data Act could apply (Art. 2(5)). If it incorporates an AI system — for example, an artificial vision system for quality control or a predictive maintenance system — the AI Act could apply (Art. 2(1)), and certain industrial AI uses are classified as high-risk in Annex III of the Regulation.

A pure digital service — an e-commerce platform, a SaaS web application, a streaming service — has a different regulatory profile from physical products. The CRA, RED, RoHS, and the Toy Safety Regulation apply to products, not services, so they fall outside their scope.

The most relevant regulation is the European Accessibility Act (EAA), Directive 2019/882, which includes in its scope services provided to consumers such as e-commerce, consumer banking services, access services to audiovisual media, and certain passenger transport services (Art. 2(2)). If the platform or digital service provides any of these services, accessibility obligations have been applicable since June 28, 2025. Micro-enterprises providing services are exempt.

If the digital service uses or constitutes an AI system, the AI Act could apply (Art. 2(1)). The AI Act applies to AI system providers that market or put them into service in the EU, regardless of where they are established, as well as to those who deploy them in the EU.

If the service is a "related service" to a connected product — for example, the cloud platform that collects data from an IoT device — the Data Act could apply, imposing data access obligations for connected product users (Art. 2(6) and Chapter II).

If the platform is an online marketplace, the GPSR imposes specific obligations on online marketplace providers (Art. 22), including Safety Gate registration, designation of contact points, and cooperation with authorities to remove dangerous products. The EUDR and Pay Transparency are not applicable to digital services as such.