What is CE Marking?
CE marking is the mandatory European conformity mark with which a manufacturer declares that a product complies with all EU harmonisation legislation that applies to it, such as the requirements for safety, health, environmental protection and electromagnetic compatibility. Without CE marking, such a product may not be placed on the market or put into service in the European Economic Area. In industrial and OT environments, CE touches almost every component: PLCs, HMIs, sensors, network switches, control cabinets and complete machines in factories, utilities and critical infrastructure.
CE marking is not a government approval and not a quality label. It is a declaration by the manufacturer, who thereby takes full responsibility for the product’s conformity.
🧠 What exactly does CE marking mean?
The letters CE are usually explained as Conformité Européenne. The mark stems from the 1985 “New Approach”; in 1993 Directive 93/68/EEC standardised its form and use and replaced the older “EC mark” with “CE marking” across a series of product directives. Since 2008, its foundation has been the New Legislative Framework: Regulation (EC) 765/2008 and Decision 768/2008/EC. The European Commission explains that framework in its Blue Guide, the most recent edition of which was published in June 2022.
Article 30 of Regulation 765/2008 sets out the general principles:
- Only the manufacturer or its authorised representative affixes the CE marking
- Only on products for which EU legislation requires it - CE on a product without any applicable directive or regulation is prohibited
- Responsibility for all applicable requirements - by affixing the mark, the manufacturer declares compliance with all relevant legislation, not just one directive
- The only mark that attests conformity - other marks are allowed as long as they do not cause confusion with, or reduce the visibility of, the CE marking
- Enforcement and penalties - member states must penalise misuse, with criminal sanctions possible for serious infringements
CE applies in the 27 EU member states and in the EEA countries Norway, Iceland and Liechtenstein. After Brexit the United Kingdom introduced the UKCA mark, but decided in 2023 to keep recognising CE marking in Great Britain indefinitely for most product groups.
🧱 Which EU rules lead to CE marking in OT?
A CE marking is always the sum of all applicable rules. For industrial automation, these are the most important:
| Legislation | Number | What it covers | Relevant for |
|---|---|---|---|
| Machinery Directive | 2006/42/EC | Safety of machinery and safety components | Machines, production lines, safety components |
| Machinery Regulation | (EU) 2023/1230 | Successor to the Machinery Directive, including cybersecurity | Machines from 20 January 2027 |
| Low Voltage Directive | 2014/35/EU | Electrical safety at 50–1000 V AC or 75–1500 V DC | Mains-powered equipment, switchgear assemblies |
| EMC Directive | 2014/30/EU | Electromagnetic emissions and immunity | Virtually all electronics |
| Radio Equipment Directive | 2014/53/EU | Radio, EMC, electrical safety and, since 1 August 2025, cybersecurity | Wi-Fi, Bluetooth, 4G/5G and LoRa devices |
| ATEX | 2014/34/EU | Equipment for explosive atmospheres | Instrumentation and cabinets in Ex zones |
| RoHS Directive | 2011/65/EU | Restriction of hazardous substances in electronics | Industrial monitoring and control instruments since 22 July 2017 |
| Cyber Resilience Act | (EU) 2024/2847 | Cybersecurity of products with digital elements | Almost all connected hardware and software from 11 December 2027 |
Other directives apply in specific situations, such as the Pressure Equipment Directive (2014/68/EU) for vessels and piping under pressure and the Measuring Instruments Directive (2014/32/EU) for legal metrology, for example energy or water meters used for billing.
📦 Which directives apply to which OT component?
A common mistake is to assume that a PLC falls under the Machinery Directive. A standard PLC is not a machine: it falls under the EMC and RoHS directives, and under the Low Voltage Directive only if it runs directly on mains voltage. Most PLCs and HMI panels run on 24 V DC, which is below the 75 V DC lower limit.
| Component | Typical CE basis | Point of attention |
|---|---|---|
| PLC (standard) | EMC, RoHS, Low Voltage if mains-powered | Not a machine, but part of the machine’s CE. From 11 December 2027 also the CRA, usually with self-assessment |
| Safety PLC / Safety Relay | Machinery Directive as a safety component, EMC, RoHS | ”Logic units to ensure safety functions” are listed in Annex IV of the Machinery Directive |
| HMI | EMC, RoHS, Low Voltage at 230 V, RED with Wi-Fi | 24 V DC panels fall outside the Low Voltage Directive |
| Industrial network switch | EMC, RoHS, Low Voltage if mains-powered | With a radio module also RED and EN 18031; from late 2027 the CRA, which lists switches as important products of class I, as for Industrial Internet of Things gateways |
| Sensor / transmitter | EMC, RoHS, ATEX in Ex zones | Measuring Instruments Directive only for legal metrology |
| Control cabinet | Low Voltage via IEC 61439, EMC | As part of a machine, the cabinet is covered by the machine’s CE |
| Complete machine or line | Machinery Directive, plus all directives above | The builder or integrator is the manufacturer |
🔧 How does the CE procedure work step by step?
The route to CE marking is broadly the same for every directive:
- Determine the applicable legislation - which directives and regulations apply, and which product category (for example an Annex IV machine)
- List the essential requirements - the legal requirements are set out in the annexes of each directive
- Carry out a risk assessment - for machinery according to ISO 12100: identify hazards, estimate and reduce risks
- Apply harmonised standards - following a standard cited in the Official Journal gives a presumption of conformity. Examples: IEC 60204-1 for electrical equipment, ISO 13849 or IEC 62061 for functional safety and EN IEC 61000-6-2/-4 for EMC in industrial environments
- Choose the conformity assessment module - self-assessment or involvement of a notified body
- Compile the technical file - design, diagrams, risk assessment, test reports, instructions; keep it for at least ten years after placing the product on the market
- Sign the EU declaration of conformity - a single declaration listing all applicable legislation
- Affix the marking - at least 5 mm high, visible, legible and indelible, followed by the notified body’s four-digit number if it is involved in the production phase
The modules come from Decision 768/2008/EC and are selected per directive. The Machinery Directive uses its own annexes (VIII internal checks, IX EC type-examination, X full quality assurance), which are equivalent in substance; the Machinery Regulation does align with the standard modules.
| Module | Name | Role of notified body | Typical use |
|---|---|---|---|
| A | Internal production control | None | Most PLCs, sensors, machines outside Annex IV |
| B + C | EU-type examination + conformity to type | Assesses the design | Annex IV machines without full application of standards; under ATEX combined with a production module |
| H | Full quality assurance | Assesses the quality system | Manufacturers of large series, alternative to B + C |
| G | Unit verification | Inspects the individual product | One-off installations, such as pressure equipment |
Notified bodies and their numbers are listed in the public European NANDO database. The number next to the CE logo, such as 0344 for DEKRA Certification, shows which body was involved.
🏭 What does CE mean for system integrators and end users?
In practice, OT teams become a manufacturer more often than they think:
- Machine for own use - anyone who builds a machine and puts it into service themselves must CE-mark it
- Assembly of machinery - an integrator who links separate machines into one line with a common control system becomes the manufacturer of the assembly
- Partly completed machinery - a module intended for incorporation into another machine receives no CE marking but a declaration of incorporation; the final builder takes care of the CE marking of the whole
- Substantial modification - a retrofit that introduces new hazards, for example a new control system in a legacy installation, may require a new CE procedure. The Machinery Regulation makes this explicit from 2027: whoever substantially modifies a machine becomes its manufacturer
- Fixed installation - a plant installation does not need CE marking under the EMC Directive, but must be built and documented according to good engineering practice
Dutch context: the Machinery Directive is transposed into the Dutch Warenwetbesluit machines, and the Netherlands Labour Authority carries out market surveillance of machinery for professional use. The Dutch Authority for Digital Infrastructure (RDI, called Agentschap Telecom until 2023) supervises the EMC and Radio Equipment directives, and since 1 August 2025 also checks the cybersecurity requirements for wireless equipment. The Dutch bill implementing the Cyber Resilience Act also designates the RDI as market surveillance authority for the CRA.
🔐 Does CE marking also guarantee cybersecurity?
For a long time the answer was simply no: CE covered electrical safety, EMC and physical construction, not digital security. That changes in three steps:
| Date | Legislation | What changes for CE |
|---|---|---|
| 1 August 2025 | Radio Equipment Directive (Delegated Regulation 2022/30) | Wireless, internet-connected equipment must meet cybersecurity requirements, demonstrated with EN 18031 |
| 20 January 2027 | Machinery Regulation | Protecting control systems against corruption and manipulation becomes a safety requirement |
| 11 December 2027 | Cyber Resilience Act | Secure design, vulnerability handling, security updates and an SBOM become conditions for CE |
For the CRA, CEN, CENELEC and ETSI are developing CRA Harmonised Standards, partly based on IEC 62443, including IEC 62443-4-1 for the development process and IEC 62443-4-2 for component requirements.
There is still a clear boundary, though. CE assesses the product at the moment it is placed on the market; it says nothing about how you deploy it. What CE will not guarantee, even after 2027:
- Secure configuration - default settings, open ports and shared accounts on site
- Network segmentation and remote access - the architecture of your installation
- Patch management in practice - the manufacturer must supply updates, but you must install them
- Organisational measures - duty of care and incident reporting for operators follow from NIS2 and the Dutch Cybersecurity Act, not from CE
🔄 How does CE relate to other frameworks?
| Framework | Relationship to CE marking |
|---|---|
| Machinery Directive | Main rule for machinery until 20 January 2027 |
| Machinery Regulation | Successor from 20 January 2027, with cybersecurity as a safety requirement |
| Cyber Resilience Act | Makes cybersecurity part of CE for digital products from 11 December 2027 |
| IEC 61439 | Harmonised standard for demonstrating conformity of low-voltage switchgear assemblies |
| ATEX | Directive for equipment in explosive atmospheres, with additional Ex marking |
| IEC 62443 | Basis for CRA standards; certification does not in itself provide CE |
| NIS2 | Obligations for organisations, not a CE requirement for products |
❓ Frequently asked questions
Is CE marking a quality mark or certificate?
No, CE marking is neither a quality mark nor a government certificate. It is a declaration by the manufacturer that the product complies with all applicable EU legislation. Only for higher risks does a notified body assess the design or production, and even then the manufacturer affixes the CE marking itself.
Does a PLC need CE marking under the Machinery Directive?
A standard PLC does not fall under the Machinery Directive, but it does fall under the EMC and RoHS directives, and under the Low Voltage Directive if mains-powered. A safety PLC or safety relay is a safety component under the Machinery Directive. The machine in which the PLC is installed receives its own CE marking under the Machinery Directive.
Do I have to CE-mark a machine I built for my own use?
Yes, a machine that you build and put into service yourself must comply with the Machinery Directive and bear CE marking, even if it is never sold. You are then the manufacturer, including the risk assessment, technical file and EU declaration of conformity. The same applies when you link existing machines into a single assembly with a common control system.
How long must the technical file for CE marking be kept?
Under most CE directives, such as the EMC Directive and the Low Voltage Directive, the manufacturer keeps the technical file and the EU declaration of conformity for at least ten years after the product is placed on the market. Market surveillance authorities can request the file during that period. For machinery the period is also ten years, counted from the date of manufacture or, for series production, from the last unit produced.
When does cybersecurity become part of CE marking?
For wireless, internet-connected equipment, cybersecurity has been part of CE since 1 August 2025 through the Radio Equipment Directive and EN 18031. For machinery it follows on 20 January 2027 with the Machinery Regulation. From 11 December 2027, the Cyber Resilience Act requires cybersecurity for almost all products with digital elements before they may bear CE marking.
Is CE marking still valid in the United Kingdom?
Yes, for most product groups Great Britain recognises CE marking indefinitely, alongside its own UKCA mark. That decision was announced in 2023 and written into law in 2024. Separate rules apply to some groups, such as construction products and medical devices.
📌 In summary
CE marking is the manufacturer’s declaration that a product complies with all applicable EU rules, and it is the condition for placing industrial equipment on the market or putting it into service in the EEA. For OT, this means knowing which directives apply to each component, taking the manufacturer role seriously as an integrator, and accepting that cybersecurity becomes a CE requirement step by step between 2025 and 2027. Secure deployment in your own installation remains a task for IEC 62443 and cybersecurity management.