Ongoing Compliance / Maintenance
Certified once isn't compliant forever
A CE or FCC file freezes the day it's issued. The regulations don't. Harmonised standards get revised, exemptions expire on fixed calendar dates, and delegated acts add new obligations to products already on the market — none of it triggered by anything you did. We track what's changed against your actual product line and tell you before it's a problem, not after a market-surveillance letter or a customs hold.
Last updated 27th September 2026 · By Vas Parshin and Anabel Amar
Why an already-certified product can fall out of step
Three real mechanisms do this, all without a single component on the product changing. Harmonised standard references get revised in the EU Official Journal, and a Declaration of Conformity that still cites a withdrawn version loses its presumption of conformity. Exemptions carry their own sunset dates set at EU level, independent of when a given product was first certified — RoHS Annex III lead exemptions expire on a staggered schedule running from 11th December 2026 (lead as an alloying element, most product categories) through 30 June and 31st December 2027 (high-melting-point solders, lead in glass and ceramics). And delegated or implementing acts can add obligations that reach backward to products already for sale: RED's cybersecurity requirements (EN 18031) became mandatory in August 2025 for radio equipment that, in many cases, had been CE-marked for years beforehand.
What this looks like on real products
What we actually do
We track the specific regulations, standards revisions and exemption dates relevant to each product's actual technical scope — not a generic regulatory newsletter — matched against your real product line and its radio/battery/materials profile. When something changes, we tell you which SKUs are affected and how much runway you have, and where a re-test, an updated declaration or a technical file amendment is genuinely needed, we manage that the same way we manage first-time certification.
Questions
What is post-certification regulatory monitoring?
An ongoing service that tracks regulatory changes affecting products you've already certified and placed on the market — revised harmonised standards, expiring exemptions, and new delegated or implementing acts — and flags which of your specific products are affected before a deadline hits, rather than waiting for a market-surveillance letter or a customs hold.
Why would an already-certified product become non-compliant without changing?
Three real mechanisms: harmonised standard references get revised in the EU Official Journal, and a Declaration of Conformity citing a withdrawn version loses its presumption of conformity; exemptions have fixed sunset dates regardless of when a product was first certified (RoHS Annex III lead exemptions (lead in steel, aluminium and copper alloys, high-melting-point solders, glass and ceramics) expire on staggered dates from 11th December 2026 through 31st December 2027); and delegated acts can add obligations that reach back to products already on sale, such as the RED cybersecurity requirements (EN 18031) that became mandatory in August 2025 for radio equipment certified years earlier.
What kinds of products need this?
Anything with a technical file that was closed years, or even months, ago and hasn't been revisited since: Bluetooth or Wi-Fi products certified before August 2025 and never checked against the RED cybersecurity delegated act, products relying on a RoHS Annex III/IV exemption with its own expiry date, and any connected device now in scope of the Cyber Resilience Act's incident-reporting duties (Article 14, live from 11th September 2026) regardless of when it was first placed on the market.
How is ongoing regulatory monitoring priced?
Differently from a one-off certification project, since it scales with how many products and markets are being tracked rather than a single test scope. Our indicative reference point, reviewed as we complete more projects, is from £1,500/year for a single ongoing representative role. Market Access Lab acts as UK Authorised Representative itself; an EU Authorised Representative or GPSR Responsible Person must be established in the EU, so we arrange an EU-established representative to hold that role. A monitoring programme across a wider product line is scoped to the portfolio on a call.
Where we fit
Most teams treat certification as a project with an end date, then stop looking at it. The regulations don't stop moving once the file closes. We're the ongoing layer that keeps watching after the certificate is issued — so a standards revision or an exemption deadline shows up as a scheduled task, not a surprise from a customs officer or a marketplace compliance team.
Contact usGet updates
Get regulatory updates for your markets and product
Tell us which markets you sell into and what kind of product it is, and we'll send you the changes that actually apply — not a general newsletter.
Sources
- Delegated Regulation (EU) 2022/30, Art. 3(3)(d)(e)(f); Commission Delegated Directives (EU) 2025/1802, 2025/2363 and 2025/2364 amending Directive 2011/65/EU (RoHS) Annex III; Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14
- European Commission, Cyber Resilience Act policy page — Article 14 incident-reporting duties apply from 11th September 2026