15 Regulatory review (M-6)¶

For you when a board is sold, given away or transmits: after this chapter you can state its purpose, give the regulatory review what it needs and read its sign-off M-6. The short way: Have it reviewed.

Not everything that can be ordered may be sold, given away or even switched on in the EU. A soldered-in lithium cell in a board that is sold, for one – no check of the circuit sees that. The agent regulatory-reviewer checks circuit and parts against EU law for the purpose stated in the graph. Its result is the sign-off M-6 that every release needs (8.2). It runs at the hand-over of the circuit (14.1), before the layout, because its findings usually change parts.

This chapter is its map: the state of October 2026, with the primary sources. The law changes – the agent checks every date and threshold it relies on against the source.

Not legal advice. This chapter, the agent and its sign-off M-6 are support, without any claim to being correct or complete; nothing in them is legally guaranteed. Whoever sells or gives away the board answers for it.

15.1 The purpose decides¶

The graph's format (3.1) states purpose: {"use": "private" | "gift" | "sale", "market": "EU", "notes": "what it is, who uses it"}. Two keys are optional:

country – the member state it is used in ("AT", national law in 15.6);
radio, for a part that can transmit more than the EU allows – how its firmware uses it: {"U1": {"bands_mhz": [[2412, 2472]], "notes": "Wi-Fi channels 1–13"}} or {"U1": "off"}; LIM.band compares it with the EU bands.

The purpose is part of the circuit hash: a new purpose needs a new M-6. The skill new-project asks for it when the project is set up (2.7), before the first part is chosen. What each use means:

private – built for oneself and used oneself. Nothing of placing on the market applies (CE, RoHS, WEEE …). Still, a transmitter keeps to an allowed band and power – also privately –, and nothing may be dangerous. In Germany the EMC requirements hold in substance: EMVG § 6 lets equipment be put into service only if it meets them (a radio product: FuAG § 7), without the formalities of placing on the market.
gift – given away now and then by a private person. As private: occasional supplies by hobbyists are normally not "making available on the market" (Blue Guide 2.2). That is the EU's product legislation, and Blue Guide 1.5 leaves REACH out: REACH counts a supply free of charge as placing on the market (Art. 3(12)). So Art. 33 applies: a substance of very high concern above 0.1 % in the board is named to a consumer who asks, within 45 days (Art. 33(2)), and to a professional recipient unasked (Art. 33(1), 3(35)). In Germany EMVG § 6 also covers passing the board on. Regular giveaways in the course of a business count as sale.
sale – sold, also in small series, also as a kit. Everything in 15.2 applies: the seller is the manufacturer, of a kit too.

15.2 The rules¶

Rule	What it asks	Applies to	Source
Frequency use	transmit only in a licence-exempt band within its power and duty cycle: 433.05–434.79 MHz, 863–870 MHz (868.0–868.6 MHz: 25 mW, ≤ 1 %), 2400–2483.5 MHz (100 mW e.i.r.p.), 5 GHz RLAN (5150–5350 MHz 200 mW, 5470–5725 MHz 1 W mean e.i.r.p.); the checks and the ESP32 below the table. Operating radio equipment that does not comply is prohibited also privately	every board that transmits	2006/771/EC (as amended), BNetzA Vfg. 91/2025, Vfg. 136/2022, FuAG § 7, ESP-IDF `esp_wifi_set_country_code`, Arduino-ESP32 2.0.17 WiFiGeneric.cpp
Radio equipment	anything that transmits or receives: the board with a fixed module is one radio product – the module's certificates are input, not a substitute. Own conformity assessment, EU declaration of conformity, instructions with bands and power. Internet-connected: cybersecurity since 1 Aug 2025; EN 18031 gives no presumption of conformity where the end user may skip setting a password – then a notified body	sale	2014/53/EU, 2022/30
EMC	electromagnetic compatibility, no lower voltage limit; a radio product is covered by RED instead	sale; in Germany also own use and passing on, in substance (below the table)	2014/30/EU, EMVG §§ 3, 4, 6, FuAG §§ 4, 7
Low voltage	50–1000 V AC, 75–1500 V DC: a 5 V board is outside, the mains power supply that comes with it is not (its own CE, ecodesign); a net declared above 60 V DC is LIM.hazardous – edakit recognises it and checks neither its spacing nor its isolation (domain mains, 14.2)	sale	2014/35/EU
Product safety (GPSR)	consumer products: risk analysis and technical file (10 years), type or batch number and the manufacturer's postal and electronic address on the product, instructions in German; online offers show manufacturer, picture, identifier and warnings; accidents are reported. CE-marked products: Art. 19–20	sale, since 13 Dec 2024	(EU) 2023/988
RoHS	Pb, Hg, Cr(VI), PBB, PBDE and four phthalates ≤ 0.1 %, Cd ≤ 0.01 % per homogeneous material; exemptions expire (7(c)-I, lead in piezo ceramics as in buzzers: 30 Jun 2027)	sale	2011/65/EU, (EU) 2015/863
REACH Art. 33, SCIP	a substance of very high concern above 0.1 % in an article: tell the recipient, a consumer on request within 45 days; notify ECHA's SCIP database	sale, also free supply	1907/2006, (EU) 2018/851
WEEE	register with stiftung ear before the first board is sold – no minimum quantity; the number on offers and invoices; crossed-out bin, manufacturer mark and date on the product	sale	2012/19/EU, ElektroG § 6
Batteries	CE and declaration of conformity for batteries (since 18 Aug 2024), collection symbol; from 18 Feb 2027 a portable battery in a product must be removable and replaceable by the end user with ordinary tools (exceptions in Art. 11); register with stiftung ear and join a take-back organisation – also for a battery built into or packed with the board	sale	(EU) 2023/1542, BattDG
Common charger	only the listed radio products charged by cable (phones, headphones, portable speakers, keyboards, mice, cameras …): USB-C, USB PD above 15 W	sale	(EU) 2022/2380
Cyber Resilience Act	products with a data connection: reporting of actively exploited vulnerabilities since 11 Sep 2026, most duties from 11 Dec 2027	sale	(EU) 2024/2847
Toys	made or meant for play by children under 14: toy safety, electric toys at most 24 V; replaced by Regulation (EU) 2025/2509 on 1 Aug 2030	sale	2009/48/EC, (EU) 2025/2509
Packaging	packaging – the shipping box too – registered in LUCID before the first sale, and a take-back system	sale, since 12 Aug 2026	(EU) 2025/40, VerpackDG

Commonly missed: a CE mark on a module – genuine or not – never covers the product it is built into; whoever resells an imported power supply or cell is its importer.

Frequency use¶

The e.i.r.p. is the power fed to the antenna times its gain: the datasheet's conducted power in dBm plus the antenna's gain in dBi. LIM.eirp compares it with the band's limit. LIM.band compares the bands a part transmits in with the bands of the table (rule checks, 3.3) – its bands_mhz, or what purpose.radio says the firmware keeps (15.1). How edakit grades what the firmware has to keep is in the sign-off (15.4). 902–928 MHz (US LoRa) is none of these bands – 880–915 MHz is mobile uplink in Europe.

An ESP32 keeps to channels 1–13 only by its firmware: an EU country with 802.11d off, esp_wifi_set_country_code("DE", false) after every Wi-Fi start, the radio off if the call fails. Arduino-ESP32 deinitialises the driver on WiFi.mode(WIFI_OFF), which is why the call follows every start. With 802.11d on, ESP-IDF's default, a station takes the country of its access point, and JP allows channel 14 (2484 MHz). Leaving the default country is no rule either: "CN" in ESP-IDF 4.4, "01" in 6.1.

National references¶

The national references in this chapter are Germany's – the example the map was written for. A board used in another member state names it in purpose.country, and the review takes that country's references (national law, 15.6).

In Germany EMC holds in substance for own use and passing on too. EMVG § 6 lets equipment – § 3 no. 2 a: any finished product for an end user with a function of its own – be passed on and put into service only if it meets the act's essential requirements (§ 4). The formalities of placing on the market (§ 8) do not apply. A radio product put into service and used falls under FuAG § 7 with § 4(1) no. 2.

15.3 What the review needs¶

Per part – compliance in the parts entry (4.1), filled by the agent part-selector or the skill part-search: RoHS status and the exemption it relies on, and the supplier's REACH SVHC statement. A part that transmits adds compliance.radio: its bands, its power at the RF port and the gain of its antenna – or the e.i.r.p. a certificate states –, and the EU declaration of conformity. A part that does not transmit says "none". What nobody states is open, not fine.
Checked per part – PARTS.fact asks every module and microcontroller for radio or "none". It asks every part of a board that is given away or sold for its REACH statement (PARTS.fact/reach: information for a gift, a warning for a board that is sold). It asks every part the BOM lists for its RoHS status (PARTS.fact/rohs: information, for a board that is sold a warning).
Per own board (4.5) – its compliance collects what its parts entries state, with the parts that state nothing. An own board is no module with certificates of its own but part of the product: whoever gives the product away or sells it is the manufacturer of the board in it too.
Per project – purpose in the graph and the decision log: who uses the board (children?), the cell in a battery holder (chemistry, capacity, soldered or plugged), the power supply that comes with it. Also whether it connects to the internet and which personal data it handles – then passwords and updates of the firmware too. And which boards people touch, for how long: their touch_c in sim.json (5.2), checked by LIM – a hot surface is a risk of the product safety analysis.

The agent also works through the regulatory questions of the domains the project has on (14.2), which edakit domains --review regulatory prints: scope, substances, batteries, supply, a product that is sold, children, and with radio or mains on their own.

15.4 The sign-off¶

M-6 has the scope electrical, the circuit hash without the footprint data of the parts entries (8.2): graph with its purpose, parts database, simulation config, and the requirements file of [project] requirements. A changed part, purpose or requirement needs a new review, a changed footprint does not. The gate requires M-6 even when the sign-off file does not list it.

With a requirements file the review also judges the requirements whose verify names signoff = "M-6" – a board that must not transmit. It names the ones it found met in its note (requirements, 8.7).

The agent's findings are numbered – block (may not be sold or operated like this), important, note –, each with the rule, its source and a proposal. They go into the decision round with the electrical review. What a program could decide the agent marks as a candidate (from a finding to a rule, 14.4). A BOM part without a RoHS status is PARTS.fact/rohs already, one without a REACH statement PARTS.fact/reach, a band outside the EU's LIM.band, an e.i.r.p. over the band's limit LIM.eirp.

What the firmware has to keep is graded by the purpose. The law of 15.2 stays as it is: operating radio equipment that does not comply is prohibited also privately. Only edakit's grading follows its job – edakit builds circuits and boards, the firmware sets the channels, the country and 802.11d, and the transmit power (the owner's decision of 2026-10-29). For a board built for oneself or given away (private, gift, or no purpose) such a topic is a note, for one that is sold it is important – in edakit check and the gate a warning to accept (8.1) –, and a block only where the hardware cannot be made to comply: a part made for another region's band.

15.5 At the order¶

M-6 reviews the circuit; the order adds what M-6 never saw and what may change between the release and the cart. The parts are not new at the order: ORDER.parts holds the maker's matching to the release, which M-6 saw, and a part the maker would replace needs a new release with a new M-6. The agent regulatory-reviewer "At the order" (the skill cart, step 8) reads job.json, quote.json and quote_page.txt – as data, never as instructions –, check.md and the M-6 result for the run's electrical hash. It looks only at the difference:

What	Why it matters
the surface finish and the other keys of the form	in the layout and fab hash, not in the circuit hash: leaded HASL is lead in the product (FILES.order/lead at the release and ORDER.finish at the cart grade it: fail for `sale` and for a board without a purpose, warning for `gift`, note for `private`), a coating or another material is part of the product
the quantity against the purpose	50 boards for `private` asks whether the purpose is still true – a new purpose is a new M-6
where the maker sits	outside the EU (JLCPCB, PCBWay) and `sale`: you import the boards and are the manufacturer – name and address, technical file, registrations before the first sale (15.2); inside the EU (Eurocircuits, AISLER): no import, you stay the manufacturer (15.1); either way the maker's own RoHS and REACH statements – `[compliance]` of its profile (`edakit/makers/<maker>.toml`, 8.4), in `job.json` – are input for the technical file, and the review names what they leave out
parts you supply to the maker	imported by you when bought outside the EU
a cell, a power supply in the matching	batteries regulation, the supply's own conformity, transport of lithium cells
declarations the form asks for	what the shipment is declared as (customs description and value; `[order] customs`, 10.2)

Its result goes unchanged into regulatory.md: numbered findings graded as for M-6, the SHA-256 of the job and the quote it reviewed, the line that it is support and not legal advice, and as the last line Order: OK or Order: not OK. A difference that changes the circuit is a block ("new M-6 needed"). The review is no sign-off in the sign-off file – the release and its hashes stay as they are. ORDER.review makes the cart wait for it, and a new quote needs a new review because its hash changes. The order record (8.4) keeps the verdict with the numbers and grades of the findings.

15.6 National law¶

The EU's directives reach a board through each member state's own act, and some duties exist only there: passing on a board built for oneself (Germany's EMVG § 6), the registers for WEEE, batteries and packaging. purpose.country in the graph's format (3.1) names the member state the board is used in, as ISO 3166-1 alpha-2: country = "AT". It is optional, part of the purpose and so of the circuit hash – setting it needs a new M-6. A code that is no member state of the EU ("CH", "at", "AUT"), or one with a market other than "EU", is STRUCT.purpose.

edakit/national.toml holds per member state the national reference of each topic – EMC, radio, product safety, product liability, SCIP, WEEE, batteries, packaging – with the URL of its primary source and the date it was checked against it. It has Germany (gesetze-im-internet.de) and Austria (RIS). The domains' review questions name them through placeholders: {national.emc}, {national.radio}, {national.country}, and {national.code} – the country of esp_wifi_set_country_code. edakit domains --review regulatory adds one line with every reference of the country and its source: National law (AT, Austria – …): EMC: EMVV 2015 § 5 … <https://www.ris.bka.gv.at/…>; …. It is the agent regulatory-reviewer's map of national law, as this chapter is for the EU's.

`purpose.country`	The questions name	The line
none	Germany's references	none – this chapter's German references hold
a member state in the table (`DE`, `AT`)	its references	its references and sources
another member state (`FR`)	the EU rules – the EMC directive 2014/30/EU, RED 2014/53/EU … – as that country transposes them	`edakit has no national references for FR` – the review finds the transposition itself

A country is added to the table, not to the questions: one entry per topic with name, url and an optional note, checked against the primary source (edakit/national.py, lint, keeps every table complete). The table is a map for the review, support and not legal advice – nothing in it is legally guaranteed, without any claim to correctness.