[Home](/)/[Resources](/resources)/CE marking and firmware updates EUProcess guide # CE Marking and Firmware Updates Firmware updates are one of the most overlooked CE compliance risk areas in connected product development. Enabling a new frequency band or increasing transmit power via an OTA update is the regulatory equivalent of launching a new product — without the accompanying test campaign. RED Article 4 makes it a legal obligation to prevent firmware from taking a product outside its compliant radio configuration. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fce-marking-firmware-updates) At a glance Firmware change types 7 RED software restrictions 5 Technical file versioning steps 5 ## How different firmware changes affect CE compliance Change typeCE impactRetest? Bug fixes — no change to RF parameters, safety functions, or performance LowNo Performance improvements — same feature set, same RF configuration LowNo New operating frequency or frequency band enabled HighRequired Increased transmit power above previously tested maximum HighRequired New radio protocol or modulation scheme HighRequired New safety-critical function added (e.g., enabling machinery safety stop behaviour) HighRequired Security patch fixing a vulnerability Low (under GPSR and CRA: mandatory)No ## RED Article 4 and software-defined radio restrictions RED Article 4 permits the Commission to require certain radio equipment to be operable only in certain EU member states, or in combination with certain network configurations. Commission Delegated Regulation (EU) 2021/1971 adds specific restrictions on software-defined radio equipment — requiring that firmware preventing non-compliant radio configurations be in place. Firmware that can be modified to change the operating frequency, channel plan, transmit power, or modulation scheme to values outside the CE-tested and compliant range is restricted. Manufacturers must implement controls to prevent firmware modification that would result in non-compliant radio operation — this applies to devices using software-defined radio architectures. OTA update mechanisms that could allow a third party to modify radio parameters need to be cryptographically secured and access-controlled to maintain CE compliance. ## Technical file version control for firmware releases 01 Maintain a hardware/firmware version matrix: for each released firmware version, document which hardware revision it applies to and which test reports cover that combination 02 Date-stamp DoC versions: if a firmware update does not require re-testing, update the DoC date and firmware version reference; do not change the substantive compliance declaration without verifying it remains valid 03 Use semantic versioning: distinguish between major (potential compliance impact), minor (functional changes, no compliance impact), and patch (bug/security fix) releases in your technical file 04 Archive test reports with firmware version references: test reports should identify the firmware version installed during testing — this links the test evidence to the specific product configuration 05 Document the compliance assessment for each firmware release: even low-impact updates should have a documented decision record confirming no CE re-assessment is required and the rationale ## Frequently asked questions ### Does every firmware update require a new Declaration of Conformity? Not necessarily. If the firmware update does not change any characteristics covered by the applicable directives (RF parameters, safety functions, EMC performance), the existing DoC remains valid. However, the technical file should be updated to record the new firmware version and the assessment confirming no compliance impact. If the update does affect compliance-relevant characteristics, a new or updated DoC is required. ### What does RED Article 4 mean for software-defined radio devices? RED Article 4 and Commission Delegated Regulation (EU) 2021/1971 introduce specific requirements for radio equipment where software changes can alter the radio characteristics. Manufacturers must ensure that firmware update mechanisms cannot be used to modify the product into a non-compliant radio configuration. This means OTA update channels must be cryptographically secured, and radio-related firmware components must be protected from unauthorised modification. ### Does CRA require manufacturers to provide firmware security updates indefinitely? No — but CRA requires security updates throughout the product's 'expected lifetime' or minimum five years (whichever is longer). The 'expected lifetime' is determined by the manufacturer based on the product type and intended use. CRA also requires that security updates be provided free of charge to consumers. The obligation covers updates necessary to address known exploitable vulnerabilities that pose a security risk. ### If a firmware update enables a feature that was available in hardware but disabled at launch, does CE marking need to be redone? This depends on whether the enabled feature introduces new compliance obligations. If the hardware-enabled but firmware-disabled feature was tested and included in the original CE technical file and DoC as an in-scope function, enabling it via firmware requires no new CE assessment. If the feature was not assessed in the original CE marking (e.g., a radio band that was present in hardware but explicitly excluded from scope), enabling it constitutes a substantial modification requiring a new CE assessment for the newly-enabled functionality. **Disclaimer:** Educational resource only. The compliance impact of specific firmware changes depends on the product type and applicable directives. Always assess with your compliance engineer before releasing firmware updates that affect radio parameters or safety functions. 🇪🇺 CE Marking roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇪🇺 CE Marking compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/01-ce-marking-for-electronics-engineers)[Prefer to read? Get the book — $24.99](/books/01-ce-marking-for-electronics-engineers) Related guides * [EU Cyber Resilience Act (CRA)EU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [Radio Equipment Directive (RED) complianceEverything you need to know about the Radio Equipment Directive: scope, essential requirements, testing, harmonised standards, …](/guides/red-directive-compliance) * [CE compliance across a product familyCE marking strategy for product families: how to use the representative model principle, build a variant matrix, apply delta te…](/guides/ce-compliance-product-family) * [CE marking for accessories and spare partsPractical guide to CE marking for accessories and spare parts: when accessories need their own CE marking, when spare parts inh…](/guides/ce-marking-accessories-spare-parts)