CROSS-STANDARD public interest · Wireless / IoT device

China-to-Cyprus Wireless / IoT Device Compliance Gap Matrix

AI-compiled from official public sources — cross-checked by multiple AI models, not human-verified. Informational only; see disclaimer. Public-interest, source-linked comparison of common China wireless and IoT device documentation against Cyprus / EU Radio Equipment Directive (RED 2014/53/EU) requirements enforced by OCECPR (Office of the Commissioner of Electronic Communications and Postal Regulation), covering CE marking, radio performance, EMC, electrical safety, cybersecurity (mandatory from 1 August 2025), EU Authorised Representative, and Greek-language labelling obligations. Note: compliance requirements apply only in the Republic of Cyprus (government-controlled areas); Northern Cyprus (TRNC) is outside EU jurisdiction.

Dataset 2026-06-11 Last verified 2026-06-17 6 rows

GAP MATRIX

Compliance Gap Matrix

Gap matrix
Compliance item Common China baseline Cyprus (OCECPR / CE) Gap / action Source + verification date
Cybersecurity — RED Art. 3.3(d)-(f) + EN 18031 Series (mandatory from 1 Aug 2025, Cyprus / OCECPR) China has no direct regulatory equivalent to RED Art. 3.3(d)-(f) cybersecurity requirements. The closest Chinese frameworks are: (1) GB/T 22239-2019 (Multi-level Protection Scheme / MLPS 2.0) for network security grading — applicable to operators/platforms rather than individual device hardware; (2) MIIT IoT security guidelines (YD/T 3628-2019 series) for IoT terminal security — voluntary, not device-market-access mandatory; (3) SRRC type approval and CCC do not include cybersecurity testing against EN 18031 requirements. No Chinese export certification or approval substitutes for RED Art. 3.3(d)-(f) conformity assessment. The Cyberspace Administration of China (CAC) oversees data security and personal information protection (PIPL), which governs platform/service operators rather than hardware device manufacturers at point of export.GB/T 22239-2019 — Information security technology; baseline for classified protection of cybersecurity (MLPS 2.0) (MIIT/CAC; platform/operator scope, not device hardware)
YD/T 3628-2019 series — IoT terminal security requirements (MIIT; voluntary guideline)
PIPL (Personal Information Protection Law) — CAC; governs data processors, not hardware device market access		 From 1 August 2025, RED Art. 3.3(d)-(f) cybersecurity requirements became mandatory for radio equipment that (d) can communicate over the internet, (e) can process personal data or privacy-sensitive data, or (f) is a child-directed or wearable internet-connected device. The applicable harmonised standard series is EN 18031 (EN 18031-1:2024 for internet-connected radio equipment, EN 18031-2:2024 for internet-connected radio equipment processing personal data, EN 18031-3:2024 for child equipment and toys). Compliance grants presumption of conformity with RED Art. 3.3(d)-(f). Cyprus fully implements these requirements as a direct-application EU regulation; OCECPR enforces RED cybersecurity obligations nationally. Products placed on the Cypriot market before 1 August 2025 benefit from a transitional arrangement, but new models entering after the effective date must comply. The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) will impose broader product security requirements from 2027 — manufacturers should plan for CRA compliance alongside RED cybersecurity obligations.Directive 2014/53/EU (RED), Art. 3.3(d)-(f) — cybersecurity essential requirements mandatory from 1 August 2025
Commission Delegated Regulation (EU) 2022/30 — activating RED Art. 3.3(d)-(f) for specified categories of radio equipment
EN 18031-1:2024 — Internet-connected radio equipment; common security requirements
EN 18031-2:2024 — Internet-connected radio equipment processing personal data
EN 18031-3:2024 — Internet-connected radio equipment for children; toys
Regulation (EU) 2024/2847 (Cyber Resilience Act — CRA) — broader product cybersecurity obligations from 2027		 This is a zero-equivalence gap: no Chinese domestic certification, approval, or standard satisfies RED Art. 3.3(d)-(f) cybersecurity requirements enforced by OCECPR in Cyprus. From 1 August 2025, any Wi-Fi router, smart home device, IoT gateway, or internet-connected wearable placed on the Cypriot market must demonstrate conformity with EN 18031-1 (and EN 18031-2 if personal data is processed; EN 18031-3 if child-directed). Key testing obligations under EN 18031-1 include: (1) network access control — devices must not use universal default passwords; (2) secure update mechanism — software/firmware updates must be authenticated and integrity-checked; (3) exposure minimisation — unused network services, interfaces, and ports must be disabled by default; (4) secure communications — data transmitted over public networks must be encrypted. Manufacturers must either self-declare using harmonised EN 18031 standards or use a notified body for conformity assessment where required. The upcoming EU Cyber Resilience Act (CRA, applicable from late 2027) will extend cybersecurity obligations; manufacturers should align RED Art. 3.3 compliance with CRA planning to avoid double-remediation. Cyprus's Digital Security Authority (DSA) and OCECPR may coordinate on cybersecurity enforcement for networked devices.[INFORMATIONAL] RED Art. 3.3(d)-(f) cybersecurity requirements are mandatory in Cyprus from 1 August 2025 for internet-connected, personal-data-processing, and child-directed radio equipment. No Chinese domestic certification substitutes for EN 18031 conformity. Manufacturers must test to EN 18031-1/2/3 as applicable, include cybersecurity requirements in the DoC, and retain technical documentation for OCECPR inspection. The EU CRA from 2027 will add further obligations; planning should begin now. Cyprus's Digital Security Authority and OCECPR may coordinate enforcement for networked devices. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
Electrical Safety — RED Art. 3.1(a) + EN IEC 62368-1 (Cyprus 230 V/50 Hz, Plug G / BS 1363) In China, information technology equipment safety is governed by GB 4943.1-2022 (equivalent to IEC 62368-1:2018, second edition), mandatory under CCC (CNCA-C17-01) for IT equipment. Chinese mains supply is 220 V/50 Hz with plug types A and I (GB 2099 series); Chinese products are often designed for 100–240 V input, but the plug type will differ from Cyprus's type G (BS 1363) sockets. GB 4943.1-2022 aligns with IEC 62368-1 second edition, while EN IEC 62368-1:2020+A11:2021 is derived from the third edition with an EU-specific A11 amendment. Chinese CCC safety certificates do not satisfy RED Art. 3.1(a) conformity assessment in Cyprus. FCC certification from the USA is also not recognised in Cyprus or any EU country.GB 4943.1-2022 — Information technology equipment; safety; Part 1: General requirements (equivalent to IEC 62368-1:2018 2nd edition) (SAMR/CNCA, mandatory under CCC)
GB 2099 series — Plugs and socket-outlets for household and similar use (Chinese plug types A/I)		 Cyprus applies EU harmonised electrical safety standards without national derogation. Under RED 2014/53/EU Art. 3.1(a), radio equipment must protect the health and safety of persons, domestic animals, and property. For Wi-Fi routers, IoT gateways, smart home devices, and Bluetooth accessories, the mandatory harmonised safety standard is EN IEC 62368-1:2020+A11:2021 (Audio/video, information and communication technology equipment — Part 1: Safety requirements). EN 60950-1 ceased to provide presumption of conformity on 20 December 2020 and is no longer acceptable. Cyprus uses 230 V/50 Hz mains supply. Critically, Cyprus uses plug type G (UK 3-pin BS 1363) — the same plug type as the United Kingdom and Ireland — retained from the British colonial period (Cyprus was a British Crown Colony until 1960). This makes Cyprus unique among EU member states in not using Schuko (type C/F); mains-powered devices intended for Cyprus must be verified for type G plug and socket compatibility and labelled accordingly. Products must be labelled with the supply voltage/frequency in Greek (and English, given co-official status) for consumer-facing products. OCECPR enforces RED Art. 3.1(a) for radio equipment.Directive 2014/53/EU (RED), Art. 3.1(a) — as transposed in Cyprus
EN IEC 62368-1:2020+A11:2021 — Audio/video, information and communication technology equipment; Part 1: Safety requirements (harmonised under RED and LVD)
BS 1363 — UK standard for 13 A plugs, socket-outlets, and adaptors (type G; used in Cyprus)
Directive 2014/35/EU (LVD) — Low Voltage Directive; may apply to standalone mains-powered accessories		 Five gaps apply for Chinese manufacturers exporting to Cyprus: (1) Edition gap — EN IEC 62368-1:2020+A11:2021 (3rd edition + EU amendment) vs. GB 4943.1-2022 (2nd edition); A11 introduces additional fire enclosure and earthing conductor requirements absent from the Chinese standard; (2) Supply voltage/plug compatibility — China 220 V/A/I plug vs. Cyprus 230 V/50 Hz/type G (BS 1363); Cyprus type G is a 3-pin UK-style plug entirely different from both the Chinese plug types and the Schuko C/F plugs used in most other EU countries; products and their power supplies must be tested and labelled for European supply parameters and equipped with or supplied for type G sockets; (3) Chinese CCC test reports are insufficient for RED Art. 3.1(a) — re-testing at an EU-recognised laboratory is required; (4) EN 60950-1 is no longer valid and must not be cited in the DoC; (5) FCC certification is not recognised in Cyprus. Manufacturers supplying both Cyprus and the UK may leverage the same BS 1363 plug hardware but must note that UK type approval (UKCA) and EU CE marking are separate regulatory regimes post-Brexit.[INFORMATIONAL] EN IEC 62368-1:2020+A11:2021 is mandatory for electrical safety under RED Art. 3.1(a) in Cyprus. EN 60950-1 is no longer valid. Chinese CCC tests to GB 4943.1-2022 (2nd edition) do not cover EU A11 requirements. Products must be verified for 230 V/50 Hz operation and type G (BS 1363) plug compatibility — Cyprus is the only EU member state using the UK-style 3-pin plug. Re-testing at an EU-recognised laboratory and Greek/English-language labelling of supply parameters are required for consumer products. FCC certification is not recognised. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
EMC — RED Art. 3.1(b) + EN 301 489 Series (Cyprus / OCECPR) Chinese EMC requirements for wireless devices are covered by GB/T 9254.1-2021 (emissions, equivalent to CISPR 32:2015) and GB/T 17618-2015 (immunity, equivalent to CISPR 24:2010), administered by SAMR/SAC. CCC-listed products are tested at CNCA-designated laboratories. While the underlying emission limits are broadly aligned with CISPR 32, EN 301 489-17 applies RLAN-specific test modes and duty-cycle-adjusted averaging not present in the Chinese GB/T framework. Chinese test reports are not accepted by OCECPR as evidence of RED EMC conformity.GB/T 9254.1-2021 — Information technology equipment; radio disturbance characteristics (emissions, equivalent to CISPR 32:2015) (SAMR/SAC)
GB/T 17618-2015 — Information technology equipment; immunity characteristics (equivalent to CISPR 24:2010) (SAMR/SAC)		 Cyprus applies EU harmonised EMC requirements without national derogation. Radio equipment must protect the radio spectrum and ensure adequate immunity under RED 2014/53/EU Art. 3.1(b). For Wi-Fi and Bluetooth devices, the applicable harmonised standards are EN 301 489-1 v2.2.3 (common technical requirements) and EN 301 489-17 v3.2.4 (specific conditions for RLAN / Bluetooth broadband data transmission systems). These standards reference CISPR 32 emission limits and IEC 61000-4 immunity levels. OCECPR is the national authority enforcing RED EMC requirements in Cyprus; it can request test reports and DoC documentation from importers or EU Authorised Representatives at any time. Cyprus operates within the standard EU harmonised spectrum framework with no national spectrum derogations for Wi-Fi or Bluetooth bands.Directive 2014/53/EU (RED), Art. 3.1(b) — as transposed in Cyprus
EN 301 489-1 v2.2.3 — Electromagnetic compatibility and radio spectrum matters; common technical requirements
EN 301 489-17 v3.2.4 — Specific conditions for broadband data transmission systems (RLAN / Bluetooth)		 Chinese EMC test reports to GB/T 9254.1 / GB/T 17618 cannot substitute for EN 301 489-1 + EN 301 489-17 compliance in Cyprus. Key gaps: (1) EN 301 489-17 applies RLAN-specific duty-cycle-adjusted emission averaging and dedicated test modes not present in GB/T 9254.1; (2) EU immunity test configurations under EN 301 489-1 reference specific IEC 61000-4 severity levels that may differ from Chinese test setups; (3) OCECPR may request test reports citing the specific harmonised EN version — Chinese GB reports do not meet this evidential standard. Re-testing at an ILAC MRA-member or EU-accredited laboratory to EN 301 489-1 + EN 301 489-17 is required. Test reports must be retained for 10 years and made available to OCECPR on request.[INFORMATIONAL] RED Art. 3.1(b) EMC compliance for Wi-Fi/Bluetooth devices in Cyprus requires EN 301 489-1 + EN 301 489-17 testing. Chinese GB/T 9254.1 / GB/T 17618 reports are not accepted. OCECPR may request test documentation at any time. EU-accredited laboratory re-testing is required, and reports must be referenced in the DoC and retained for 10 years. ETSI (European Telecommunications Standards Institute)2026-06-17 · reference
EMC Directive 2014/30/EU — Applicability to Non-Radio EEE in Cyprus China does not distinguish between radio and non-radio EMC frameworks in the same manner as the EU. GB/T 9254.1-2021 covers emissions for information technology equipment generally. The CCC mandatory certification scope under CNCA-C17-01 covers both radio-enabled and wired IT equipment under the same EMC standard framework. There is no Chinese regulatory analogue to the EU distinction between RED Art. 3.1(b) and the standalone EMCD for IT/AV equipment.GB/T 9254.1-2021 — Information technology equipment; radio disturbance characteristics (SAMR/SAC)
CCC CNCA-C17-01 — China Compulsory Certification for information technology equipment (SAMR/CNCA)		 For electrical or electronic products that are not radio equipment (i.e., do not contain a radio transmitter or receiver), Cyprus applies the EMC Directive 2014/30/EU (EMCD) rather than RED. However, for the wireless/IoT device category covered by this dataset, RED 2014/53/EU is the primary applicable directive and its Art. 3.1(b) EMC essential requirement subsumes EMCD for in-scope radio equipment. Products that combine radio and non-radio functions (e.g., a smart home hub with both Wi-Fi and a wired Ethernet port) are assessed under RED for the radio elements; the non-radio elements may also need EMCD compliance if sold separately as standalone non-radio EEE. OCECPR enforces both EMCD for non-radio EEE and RED for radio equipment in Cyprus.Directive 2014/30/EU (EMCD) — Electromagnetic Compatibility Directive; applies to EEE not covered by RED
Directive 2014/53/EU (RED), Art. 3.1(b) — subsumes EMCD for radio equipment in scope
EN 55032:2015+A11:2020 — Electromagnetic compatibility of multimedia equipment; emission requirements (harmonised under EMCD)		 For wireless/IoT products exported from China to Cyprus, RED Art. 3.1(b) is the primary EMC gate and the relevant EN 301 489 series standards must be applied. If the product also contains non-radio EEE functionality sold standalone or the product is borderline for RED scope, EMCD EN 55032 compliance may additionally be needed. Manufacturers should confirm product scope under RED Article 1 before selecting the conformity assessment route. OCECPR enforces both RED and EMCD; incorrect directive selection is a common compliance deficiency found in EU market surveillance.[INFORMATIONAL] For wireless/IoT devices exported to Cyprus, RED Art. 3.1(b) and EN 301 489 series are the mandatory EMC pathway; EMCD 2014/30/EU applies to any non-radio EEE component sold separately. Incorrect directive selection is a recognised market-surveillance risk. Chinese GB/T EMC reports satisfy neither pathway. Manufacturers must confirm scope under RED Art. 1 and apply the correct harmonised standards. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
EU Authorised Representative & Importer Obligations — RED Art. 11–14 (Cyprus / OCECPR) China has no requirement for an EU-style Authorised Representative for domestic market placement. Chinese regulatory frameworks (SRRC, CCC, MIIT NAL) are manufacturer-facing obligations administered by Chinese authorities. For export products, Chinese manufacturers are not required by Chinese law to appoint a representative in the destination country. The concept of a third-party legal representative bearing manufacturer obligations in the destination market has no direct Chinese equivalent. REACH/RoHS-equivalent obligations in China (GB/T 26572-2011 on restricted substances) are self-certified by manufacturers without a separate representative requirement.SRRC Type Approval — NRA/MIIT; manufacturer-facing obligation; no EU AR equivalent
CCC — China Compulsory Certification (CNCA-C17-01); no EU AR equivalent
GB/T 26572-2011 — Requirements for concentration limits for certain restricted hazardous substances in electronic and electrical products (Chinese RoHS equivalent)		 Under RED 2014/53/EU Articles 11–14, a manufacturer established outside the EU must appoint an EU Authorised Representative (EU AR) before placing radio equipment on the EU market, including Cyprus. The EU AR is a natural or legal person established in the EU who acts on behalf of the manufacturer and is the point of contact for OCECPR and other market surveillance authorities. The EU AR must be named in the Declaration of Conformity (DoC), on the product label, and in the technical documentation. The importer (the person who places third-country products on the EU market) bears distinct legal obligations: verifying conformity, ensuring DoC and technical file are available, affixing importer name and address on the product, and retaining documentation for 10 years. Cyprus's small market size means goods often enter via regional hubs (Limassol port, Larnaca airport) or through intermediaries; the importer role may fall on a Cypriot distributor unless a dedicated EU importer entity is established. OCECPR can request the DoC and full technical documentation from the EU AR or importer at any time. Note: the EU AR must be established in an EU member state — following Brexit, a UK-based representative no longer qualifies as an EU AR for Cyprus or any other EU market.Directive 2014/53/EU (RED), Art. 11 (Importers), Art. 12 (Distributors), Art. 13 (Cases in which obligations of manufacturers apply to importers and distributors), Art. 14 (Authorised representatives)
Regulation (EU) 2019/1020 — market surveillance and conformity of products; importer and distributor obligations
Cyprus Radio Equipment Law 107(I)/2017 — national transposition of RED 2014/53/EU		 Chinese manufacturers exporting wireless devices to Cyprus must appoint a named EU Authorised Representative established in an EU member state before first shipment. The EU AR must be: (1) named in the EU Declaration of Conformity; (2) named on the product or packaging label (name and EU address); (3) named in all technical documentation retained for OCECPR. A UK-based representative does not qualify as an EU AR post-Brexit, which is a particular pitfall for Chinese manufacturers who historically routed EU compliance through UK representatives before Brexit. Failure to appoint an EU AR renders the product non-compliant under RED Art. 14 and subjects both the manufacturer and importer to OCECPR enforcement action. Where no dedicated EU importer exists, the Cypriot distributor bears importer-level obligations including 10-year document retention. RoHS 2 (Directive 2011/65/EU) and WEEE registration with Green Dot Cyprus are additional obligations linked to EU AR appointment that have no Chinese domestic equivalent.[INFORMATIONAL] EU Authorised Representative appointment is mandatory for Chinese manufacturers placing wireless devices on the Cypriot market. The EU AR must be established in an EU member state (UK-based representatives do not qualify post-Brexit). The EU AR must be named in the DoC, on the product label, and in all technical documentation. No Chinese certification (SRRC, CCC, MIIT NAL) substitutes for this obligation. OCECPR enforces at import stage. RoHS 2 compliance and Green Dot Cyprus WEEE registration are linked obligations. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
CE Marking — RED 2014/53/EU + OCECPR National Enforcement (Cyprus) In China, market access for wireless devices requires SRRC Type Approval (NRA/MIIT) for the radio transmitter module and, for IT equipment such as Wi-Fi routers and IoT gateways, CCC (China Compulsory Certification) under CNCA-C17-01. A separate MIIT Network Access Licence (NAL) is required for certain telecom terminal equipment. The SAMR supervises market surveillance through its provincial bureaus. Neither SRRC nor CCC confers CE marking or satisfies RED conformity assessment obligations in Cyprus or any EU country.SRRC Type Approval — NRA/MIIT mandatory radio licence for wireless transmitters
CCC — China Compulsory Certification (CNCA-C17-01 for IT equipment)
MIIT Network Access Licence (NAL) — for telecom terminal equipment		 Cyprus is an EU member state; the Radio Equipment Directive (RED) 2014/53/EU applies directly and in full within the Republic of Cyprus (government-controlled areas). All wireless and radio equipment placed on the Cypriot market must bear the CE marking, backed by a signed EU Declaration of Conformity (DoC). The DoC must reference all applicable directives and harmonised standards (RED Art. 3.1(a) safety, Art. 3.1(b) EMC, Art. 3.2 radio performance, and Art. 3.3(d)-(f) cybersecurity where in scope). OCECPR (Office of the Commissioner of Electronic Communications and Postal Regulation) is Cyprus's national regulatory authority for electronic communications and postal services and serves as the national market surveillance authority for RED; it conducts market checks, can issue withdrawal orders, and reports non-compliant products to the EU Safety Gate / RAPEX system. CE marking must be affixed to the product or its packaging before placement; minimum marking height is 5 mm. Greek-language labelling is required as Greek is one of Cyprus's two official languages; English-language labelling is also widely expected given English co-official status. Important jurisdictional note: compliance requirements apply only in the Republic of Cyprus; Northern Cyprus (TRNC) is outside Republic of Cyprus and EU jurisdiction — products sold there require a separate compliance path.Directive 2014/53/EU (RED) — transposed into Cypriot law via the Radio Equipment Law of 2017 (Law 107(I)/2017) implementing RED in Cyprus
Regulation (EU) 2019/1020 — market surveillance and conformity of products (OCECPR as national authority for RED)
Decision 768/2008/EC — CE marking conformity assessment modules
Cyprus Radio Equipment Law 107(I)/2017 — national transposition of RED 2014/53/EU		 CE marking under RED is a hard legal prerequisite for placing wireless devices on the Cypriot market (Republic of Cyprus government-controlled areas only). SRRC and CCC are not recognised and cannot substitute. Key Cyprus-specific points beyond the standard EU RED gap: (1) OCECPR actively enforces RED through market surveillance and product withdrawals; (2) Greek-language labelling is mandatory for consumer products (product name, manufacturer/EU AR name and address, model identifier, intended use where not self-evident) — English labelling is also standard practice given English co-official status; (3) Plug type G (UK 3-pin BS 1363, 230 V/50 Hz) must be confirmed for mains-powered devices — Cyprus uniquely uses UK-style plugs within the EU due to its British colonial history, unlike most EU countries which use Schuko C/F; (4) WEEE registration with Green Dot Cyprus (the national producer compliance scheme) is required before market placement of EEE; (5) Northern Cyprus (TRNC) is outside EU and Republic of Cyprus jurisdiction — goods sold there do not benefit from and are not subject to EU RED requirements; a separate compliance assessment is required for that territory. Chinese manufacturers must complete the full EU RED conformity assessment (testing, DoC, CE mark, EU AR appointment) before any shipment to the Republic of Cyprus.[INFORMATIONAL] CE marking under RED 2014/53/EU is the primary market-access gate for wireless devices entering the Republic of Cyprus. OCECPR enforces RED nationally; non-compliant products are subject to withdrawal and Safety Gate / RAPEX notification. SRRC and CCC are not recognised. Greek-language labelling, plug type G (BS 1363) compatibility, and WEEE registration with Green Dot Cyprus are additional mandatory obligations. Compliance does not extend to Northern Cyprus (TRNC). OCECPR — Office of the Commissioner of Electronic Communications and Postal Regulation (Cyprus)2026-06-17 · reference

E-E-A-T

Named editorial review

Pending named reviewer

Official regulator, standards body, notified body, customs, or primary legal source preferred. Local PDFs are not accepted.

Editorial controls

Rows must include publisher, official URL, access date, verification flag, and last_verified before human_reviewed can be true.

SOURCES

Official-source register.