> Or do you still need the product as a whole to be compliant? I'm not 100% sure, but I've been thru a round on RED (on a full-custom device) and much of it in

> Or do you still need the product as a whole to be compliant? I'm not 100% sure, but I've been thru a round on RED (on a full-custom device) and much of it involved security and authentication within application software. RED basically boils down to "we are fucking tired of your little plastic shit running botnets, the customer are clueless, so fix it if you want to sell it". So actual code review and running tests in front of the auditors, basically everything short of a pentest, not just RF PHY stuff. So my gut feeling is that while you can skip the stuff related to RF PHY if you use an off-the-shelf module, the rest will is still be on you. Based on quick googling the certifiers agree with me (but again, that's not same as as a court saying that's true): https://compliancetesting.com/ce-certification-for-espressif-esp32-devices/ https://compliancetesting.com/ce-certification-for-espressif...