CROSS-STANDARD public interest · Wireless / IoT device

China-to-Portugal Wireless / IoT Device Compliance Gap Matrix

AI-compiled from official public sources — cross-checked by multiple AI models, not human-verified. Informational only; see disclaimer. Public-interest, source-linked comparison of common China wireless and IoT device documentation against Portugal / EU Radio Equipment Directive (RED 2014/53/EU) requirements enforced by ANACOM, covering CE marking, radio performance, EMC, electrical safety, cybersecurity (mandatory from 1 August 2025), EU Authorised Representative, and Portuguese-language labelling obligations.

Dataset 2026-06-11 Last verified 2026-06-17 6 rows

GAP MATRIX

Compliance Gap Matrix

Gap matrix
Compliance item Common China baseline Portugal (ANACOM / CE) Gap / action Source + verification date
Cybersecurity — RED Art. 3.3(d)-(f) + EN 18031 (mandatory from 1 August 2025) + EU CRA 2027 China has a separate national cybersecurity framework for network-connected products. GB/T 22239-2019 (classified protection of cybersecurity, MLPS 2.0) applies to information systems but is not a product-level standard in the same sense as EN 18031. For IoT and smart devices, TC260 (National Information Security Standardization Technical Committee) has issued guidelines including GB/T 41387-2022 (IoT security) and GB/T 37093-2018 (IoT device security). CNNVD (China National Vulnerability Database) manages vulnerability disclosure. China's MIIT has issued IoT cybersecurity requirements under the 'Management Measures for the Security of Internet of Things.' However, none of these Chinese frameworks are recognised as equivalent to or substituting for EN 18031 compliance under RED Art. 3.3 in the EU. CCC certification does not include cybersecurity testing equivalent to EN 18031.GB/T 22239-2019 — Information security technology; baseline for classified protection of cybersecurity (MLPS 2.0) (TC260/MIIT)
GB/T 41387-2022 — Information security technology; security requirements for IoT (TC260)
GB/T 37093-2018 — Information security technology; security requirements for IoT sensing layer gateway (TC260)
MIIT Management Measures for IoT Security — administrative rules for IoT network security (MIIT)		 From 1 August 2025, RED 2014/53/EU Article 3.3(d), (e), and (f) cybersecurity requirements become mandatory across the EU, including Portugal, for internet-connected radio equipment and equipment that processes personal data, location data, or financial data. The applicable harmonised standards are the EN 18031 series: EN 18031-1 (general IoT and wired network equipment), EN 18031-2 (internet-connected radio equipment processing personal data), and EN 18031-3 (internet-connected radio equipment processing data related to financial transactions and virtual currencies). These standards require, inter alia, network resilience, access control, software update mechanisms, and data protection measures. Manufacturers must include cybersecurity conformity in their DoC from 1 August 2025 for newly placed products. In addition, the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847), which entered into force on 11 December 2024, will apply to most product categories from 11 December 2027 and introduces mandatory security-by-design, vulnerability disclosure, and support period requirements. ANACOM enforces RED cybersecurity requirements in Portugal. Portugal and Brazil share the Portuguese language but the EU cybersecurity regulatory framework (RED Art. 3.3 + CRA) does not apply to the Brazilian market, which has its own Anatel cybersecurity framework.Directive 2014/53/EU (RED), Art. 3.3(d)(e)(f) — cybersecurity essential requirements; mandatory from 1 August 2025 via Commission Delegated Regulation (EU) 2022/30
EN 18031-1:2024 — Common security requirements for radio equipment; Part 1: Internet connected radio equipment
EN 18031-2:2024 — Common security requirements for radio equipment; Part 2: Radio equipment processing personal data
EN 18031-3:2024 — Common security requirements for radio equipment; Part 3: Radio equipment processing data related to financial transactions
Regulation (EU) 2024/2847 — Cyber Resilience Act (CRA); applies from 11 December 2027 for most product categories		 From 1 August 2025, RED Art. 3.3(d)-(f) cybersecurity compliance via EN 18031 is mandatory for in-scope products placed on the Portuguese market. The gap is total: Chinese GB/T cybersecurity standards and CCC certification provide no presumption of conformity with EN 18031. Key gaps: (1) EN 18031-1/2/3 require documented security-by-design, access control, network resilience, and software update mechanisms that must be demonstrated in the technical file; (2) DoC for newly placed products after 1 August 2025 must explicitly reference the applicable EN 18031 part(s); (3) the EU Cyber Resilience Act (CRA) will impose additional mandatory vulnerability disclosure, SBOM, and minimum support period obligations from December 2027 — manufacturers should begin design planning now; (4) Portuguese-language user-facing security documentation (update instructions, vulnerability reporting channel) must be provided where required. ANACOM enforces RED Art. 3.3 in Portugal. Note that CE marking with EN 18031 does not confer any cybersecurity compliance for the Brazilian market.[INFORMATIONAL] RED Art. 3.3(d)-(f) cybersecurity requirements via EN 18031 are mandatory from 1 August 2025 for internet-connected and personal-data-processing radio equipment placed on the Portuguese market. Chinese GB/T cybersecurity standards and CCC certification provide no presumption of EN 18031 conformity. DoC for new products must reference EN 18031. The EU Cyber Resilience Act adds further obligations from December 2027. ANACOM enforces in Portugal. CE marking with EN 18031 does not extend cybersecurity compliance to the Brazilian market. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
Electrical Safety — RED Art. 3.1(a) + EN IEC 62368-1 (Portugal 230 V/50 Hz, Plug C/F) In China, information technology equipment safety is governed by GB 4943.1-2022 (equivalent to IEC 62368-1:2018, second edition), mandatory under CCC (CNCA-C17-01) for IT equipment. Chinese mains supply is 220 V/50 Hz with plug types A and I (GB 2099 series); Chinese products are often designed for 100–240 V input, but the plug type will differ from Portuguese C/F sockets. GB 4943.1-2022 aligns with IEC 62368-1 second edition, while EN IEC 62368-1:2020+A11:2021 is derived from the third edition with an EU-specific A11 amendment. Chinese CCC safety certificates do not satisfy RED Art. 3.1(a) conformity assessment in Portugal.GB 4943.1-2022 — Information technology equipment; safety; Part 1: General requirements (equivalent to IEC 62368-1:2018 2nd edition) (SAMR/CNCA, mandatory under CCC)
GB 2099 series — Plugs and socket-outlets for household and similar use (Chinese plug types A/I)		 Portugal applies EU harmonised electrical safety standards without national derogation. Under RED 2014/53/EU Art. 3.1(a), radio equipment must protect the health and safety of persons, domestic animals, and property. For Wi-Fi routers, IoT gateways, smart home devices, and Bluetooth accessories, the mandatory harmonised safety standard is EN IEC 62368-1:2020+A11:2021 (Audio/video, information and communication technology equipment — Part 1: Safety requirements). EN 60950-1 ceased to provide presumption of conformity on 20 December 2020 and is no longer acceptable. Portugal uses 230 V/50 Hz mains supply; plug type F (Schuko) is predominant on the Portuguese mainland, with type C (Europlug) also widely accepted; mains-powered devices must be verified for compatibility with these supply parameters. Products must be labelled with the supply voltage and frequency in Portuguese (in addition to other EU languages or universally understood symbols). ANACOM enforces RED Art. 3.1(a) for radio equipment; ASAE enforces general product safety (GPSR) for consumer goods alongside.Directive 2014/53/EU (RED), Art. 3.1(a) — as transposed in Portugal via Decree-Law No. 57/2017
EN IEC 62368-1:2020+A11:2021 — Audio/video, information and communication technology equipment; Part 1: Safety requirements (harmonised under RED and LVD)
Directive 2014/35/EU (LVD) — Low Voltage Directive; may apply to standalone mains-powered accessories
Regulation (EU) 2023/988 — General Product Safety Regulation (GPSR); enforced by ASAE for consumer goods		 Four gaps apply for Chinese manufacturers exporting to Portugal: (1) Edition gap — EN IEC 62368-1:2020+A11:2021 (3rd edition + EU amendment) vs. GB 4943.1-2022 (2nd edition); the A11 amendment introduces additional fire enclosure and earthing conductor requirements absent from the Chinese standard; (2) Supply voltage and plug compatibility — China 220 V / plug types A and I vs. Portugal 230 V/50 Hz / plug types C and F (Schuko); products must be tested and labelled for European supply parameters; (3) Chinese CCC test reports are insufficient for RED Art. 3.1(a) — re-testing at an EU-recognised laboratory is required; (4) EN 60950-1 is no longer valid and must not be cited in the DoC. ASAE may additionally enforce General Product Safety Regulation (GPSR) obligations for consumer-facing devices. Note: the Portuguese language requirement on labelling includes the supply voltage/frequency marking.[INFORMATIONAL] EN IEC 62368-1:2020+A11:2021 is mandatory for electrical safety under RED Art. 3.1(a) in Portugal. EN 60950-1 is no longer valid. Chinese CCC tests to GB 4943.1-2022 (2nd edition) do not cover EU A11 requirements. Products must also be verified for 230 V/50 Hz operation and C/F plug compatibility. Re-testing at an EU-recognised laboratory and Portuguese-language labelling of supply parameters are required. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
EMC — RED Art. 3.1(b) + EN 301 489 Series (Portugal / ANACOM) Chinese EMC requirements for wireless devices are covered by GB/T 9254.1-2021 (emissions, equivalent to CISPR 32:2015) and GB/T 17618-2015 (immunity, equivalent to CISPR 24:2010), administered by SAMR/SAC. CCC-listed products are tested at CNCA-designated laboratories. While the underlying emission limits are broadly aligned with CISPR 32, EN 301 489-17 applies RLAN-specific test modes and duty-cycle-adjusted averaging not present in the Chinese GB/T framework. Chinese test reports are not accepted by ANACOM as evidence of RED EMC conformity.GB/T 9254.1-2021 — Information technology equipment; radio disturbance characteristics (emissions, equivalent to CISPR 32:2015) (SAMR/SAC)
GB/T 17618-2015 — Information technology equipment; immunity characteristics (equivalent to CISPR 24:2010) (SAMR/SAC)		 Portugal applies EU harmonised EMC requirements without national derogation. Radio equipment must protect the radio spectrum and ensure adequate immunity under RED 2014/53/EU Art. 3.1(b). For Wi-Fi and Bluetooth devices, the applicable harmonised standards are EN 301 489-1 v2.2.3 (common technical requirements) and EN 301 489-17 v3.2.4 (specific conditions for RLAN / Bluetooth broadband data transmission systems). These standards reference CISPR 32 emission limits and IEC 61000-4 immunity levels. ANACOM is the national authority enforcing RED EMC requirements in Portugal; it can request test reports and DoC documentation from importers or EU Authorised Representatives at any time. Test records must be retained by the manufacturer or EU AR for 10 years after the last product is placed on the market.Directive 2014/53/EU (RED), Art. 3.1(b) — as transposed in Portugal via Decree-Law No. 57/2017
EN 301 489-1 v2.2.3 — Electromagnetic compatibility and radio spectrum matters; common technical requirements
EN 301 489-17 v3.2.4 — Specific conditions for broadband data transmission systems (RLAN / Bluetooth)		 Chinese EMC test reports to GB/T 9254.1 / GB/T 17618 cannot substitute for EN 301 489-1 + EN 301 489-17 compliance in Portugal. Key gaps: (1) EN 301 489-17 applies RLAN-specific duty-cycle-adjusted emission averaging and dedicated test modes not present in GB/T 9254.1; (2) EU immunity test configurations under EN 301 489-1 reference specific IEC 61000-4 severity levels that may differ from Chinese test setups; (3) ANACOM may request test reports citing the specific harmonised EN version — Chinese GB reports do not meet this evidential standard. Re-testing at an ILAC MRA-member or EU-accredited laboratory to EN 301 489-1 + EN 301 489-17 is required. Test reports must be retained for 10 years and made available to ANACOM on request.[INFORMATIONAL] RED Art. 3.1(b) EMC compliance for Wi-Fi/Bluetooth devices in Portugal requires EN 301 489-1 + EN 301 489-17 testing. Chinese GB/T 9254.1 / GB/T 17618 reports are not accepted. ANACOM may request test documentation at any time. EU-accredited laboratory re-testing is required, and reports must be referenced in the DoC and retained for 10 years. ETSI (European Telecommunications Standards Institute)2026-06-17 · reference
EMC Directive 2014/30/EU — Applicability to Non-Radio EEE in Portugal China does not distinguish between radio and non-radio EMC frameworks in the same manner as the EU. GB/T 9254.1-2021 covers emissions for information technology equipment generally. The CCC mandatory certification scope under CNCA-C17-01 covers both radio-enabled and wired IT equipment under the same EMC standard framework. There is no Chinese regulatory analogue to the EU distinction between RED Art. 3.1(b) and the standalone EMCD for IT/AV equipment.GB/T 9254.1-2021 — Information technology equipment; radio disturbance characteristics (SAMR/SAC)
CCC CNCA-C17-01 — China Compulsory Certification for information technology equipment (SAMR/CNCA)		 For electrical or electronic products that are not radio equipment (i.e., do not contain a radio transmitter or receiver), Portugal applies the EMC Directive 2014/30/EU (EMCD) rather than RED. However, for the wireless/IoT device category covered by this dataset, RED 2014/53/EU is the primary applicable directive and its Art. 3.1(b) EMC essential requirement subsumes EMCD for in-scope radio equipment. Products that combine radio and non-radio functions (e.g., a smart home hub with both Wi-Fi and a wired Ethernet port) are assessed under RED for the radio elements; the non-radio elements may also need EMCD compliance if sold separately as standalone non-radio EEE. ANACOM enforces both RED and EMCD in Portugal and may flag incorrect directive selection during market surveillance as a compliance deficiency.Directive 2014/30/EU (EMCD) — Electromagnetic Compatibility Directive; applies to EEE not covered by RED
Directive 2014/53/EU (RED), Art. 3.1(b) — subsumes EMCD for radio equipment in scope
EN 55032:2015+A11:2020 — Electromagnetic compatibility of multimedia equipment; emission requirements (harmonised under EMCD)		 For wireless/IoT products exported from China to Portugal, RED Art. 3.1(b) is the primary EMC gate and the relevant EN 301 489 series standards must be applied. If the product also contains non-radio EEE functionality sold standalone, or the product is borderline for RED scope, EMCD EN 55032 compliance may additionally be needed. Manufacturers should confirm product scope under RED Article 1 before selecting the conformity assessment route. ANACOM enforces both RED and EMCD; incorrect directive selection is a common compliance deficiency found in market surveillance.[INFORMATIONAL] For wireless/IoT devices exported to Portugal, RED Art. 3.1(b) and EN 301 489 series are the mandatory EMC pathway; EMCD 2014/30/EU applies to any non-radio EEE component sold separately. Incorrect directive selection is a recognised market-surveillance risk in Portugal. Chinese GB/T EMC reports satisfy neither pathway. Manufacturers must confirm scope under RED Art. 1 and apply the correct harmonised standards. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
EU Authorised Representative + Portuguese Importer Obligations (RED Art. 11 / 12) China has no regulatory concept equivalent to the EU Authorised Representative. In China, the manufacturer or its domestic agent handles product registration and certification. For export, the Chinese manufacturer is responsible for obtaining SRRC, CCC, and where applicable MIIT NAL. There is no mandatory requirement to appoint a local representative in the destination country under Chinese export regulations. The importer-of-record in the destination country bears customs compliance duties but has no statutory role akin to the EU AR under Chinese law.SRRC Type Approval — NRA/MIIT; no destination-country representative required under Chinese regulations
CCC (CNCA-C17-01) — manufacturer or domestic agent handles certification; no EU AR equivalent
Chinese Customs Law — export compliance is manufacturer-side; importer in destination country handles local customs		 Under RED 2014/53/EU Art. 11, a manufacturer established outside the EU must appoint an EU Authorised Representative (EU AR) before placing radio equipment on the EU market, including Portugal. The EU AR must be established in an EU member state and must hold the technical documentation and DoC on the manufacturer's behalf, making them available to ANACOM or customs authorities upon request. The EU AR's name and address must appear on the product or its packaging. Under RED Art. 12, the importer (the entity placing the equipment on the market in the EU) must verify that the manufacturer has carried out conformity assessment, that technical documentation exists, that the CE marking and DoC are in order, and that the product is labelled correctly including Portuguese-language markings. The importer must keep a copy of the DoC for 10 years and cooperate with ANACOM. If a product is found non-compliant after market placement, the importer bears joint responsibility for corrective action. Distributors established in Portugal also carry obligations under RED Art. 13 to verify CE marking and labelling before making products available.Directive 2014/53/EU (RED), Art. 11 — Authorised Representative obligations
Directive 2014/53/EU (RED), Art. 12 — Importer obligations
Directive 2014/53/EU (RED), Art. 13 — Distributor obligations
Regulation (EU) 2019/1020, Art. 4 — Economic operator obligations for products entering the EU market		 Appointing an EU Authorised Representative is a hard legal requirement with no Chinese equivalent. Key obligations for Chinese manufacturers exporting to Portugal: (1) an EU AR must be appointed before first shipment and their details (name, address) printed on the product or packaging; (2) the EU AR must hold the technical file and DoC and provide them to ANACOM on demand; (3) the Portuguese importer must verify conformity, retain the DoC for 10 years, and cooperate with ANACOM; (4) Portuguese-language labelling must be verified by both the EU AR and importer — labelling in Chinese only is non-compliant; (5) distributors in Portugal must verify CE marking and labelling before making the product available; (6) any Chinese entity that imports into Portugal itself is treated as the importer under RED and assumes all importer obligations. Non-compliance with EU AR requirements is one of the most common grounds for market-surveillance withdrawal actions.[INFORMATIONAL] An EU Authorised Representative established in an EU member state is mandatory for all non-EU wireless device manufacturers placing products on the Portuguese market under RED 2014/53/EU. The EU AR's name and address must appear on the product or packaging. Importers and distributors in Portugal carry joint responsibility for verifying CE marking and Portuguese-language labelling. Failure to appoint an EU AR is a standalone ground for market-surveillance withdrawal action by ANACOM. EUR-Lex / Official Journal of the European Union2026-06-17 · reference
CE Marking — RED 2014/53/EU + ANACOM / ASAE Market Surveillance In China, market access for wireless devices requires SRRC Type Approval (NRA/MIIT) for the radio transmitter module and, for IT equipment such as Wi-Fi routers and IoT gateways, CCC (China Compulsory Certification) under CNCA-C17-01. A separate MIIT Network Access Licence (NAL) is required for certain telecom terminal equipment. The SAMR supervises market surveillance through its provincial bureaus. Neither SRRC nor CCC confers CE marking or satisfies RED conformity assessment obligations in Portugal or any EU country.SRRC Type Approval — NRA/MIIT mandatory radio licence for wireless transmitters
CCC — China Compulsory Certification (CNCA-C17-01 for IT equipment)
MIIT Network Access Licence (NAL) — for telecom terminal equipment		 Portugal is an EU member state; the Radio Equipment Directive (RED) 2014/53/EU applies directly and in full, transposed into Portuguese law by Decree-Law No. 57/2017. All wireless and radio equipment placed on the Portuguese market must bear the CE marking, backed by a signed EU Declaration of Conformity (DoC). The DoC must reference all applicable directives and harmonised standards (RED Art. 3.1(a) safety, Art. 3.1(b) EMC, Art. 3.2 radio performance, and Art. 3.3(d)-(f) cybersecurity where in scope). ANACOM (Autoridade Nacional de Comunicações) is Portugal's national regulatory authority for electronic communications and primary market surveillance authority for RED; it conducts market checks, can issue withdrawal orders, and reports non-compliant products to the EU RAPEX/Safety Gate system. ASAE (Autoridade de Segurança Alimentar e Económica) acts as the broader market surveillance authority for general consumer goods safety alongside ANACOM. CE marking must be affixed to the product or its packaging before market placement; minimum marking height is 5 mm. Portuguese-language labelling is required as Portugal's official language under EU labelling law. The same RED requirements apply to the Azores and Madeira as EU territory.Directive 2014/53/EU (RED) — transposed into Portuguese law via Decree-Law No. 57/2017
Regulation (EU) 2019/1020 — market surveillance and conformity of products (ANACOM as national authority for RED)
Decision 768/2008/EC — CE marking conformity assessment modules
Portuguese Decree-Law No. 57/2017 — national transposition of RED 2014/53/EU		 CE marking under RED is a hard legal prerequisite for placing wireless devices on the Portuguese market. SRRC and CCC are not recognised and cannot substitute. Key Portugal-specific points beyond the standard EU RED gap: (1) ANACOM actively enforces RED through market surveillance and product withdrawals; ASAE additionally enforces the General Product Safety Regulation (GPSR) for consumer goods; (2) Portuguese-language labelling is mandatory (product name, manufacturer or EU AR name and address, model identifier, intended use where not self-evident); (3) Plug type C/F (Schuko) and 230 V/50 Hz must be confirmed for mains-powered devices — Portugal and Brazil share the Portuguese language but CE marking does not confer Anatel approval; separate Brazilian compliance is needed for the Brazilian market; (4) WEEE registration in Portugal (via Amb3E, ERP Portugal, or equivalent producer compliance scheme) is required before market placement of EEE. Chinese manufacturers must complete the full EU RED conformity assessment (testing, DoC, CE mark, EU AR appointment) before any shipment to Portugal.[INFORMATIONAL] CE marking under RED 2014/53/EU is the primary market-access gate for wireless devices entering Portugal. ANACOM enforces RED nationally; ASAE enforces general product safety; non-compliant products are subject to withdrawal and RAPEX/Safety Gate notification. SRRC and CCC are not recognised. Portuguese-language labelling and WEEE registration in Portugal are additional mandatory obligations beyond the EU-wide CE marking requirement. ANACOM (Autoridade Nacional de Comunicações)2026-06-17 · reference

E-E-A-T

Named editorial review

Pending named reviewer

Official regulator, standards body, notified body, customs, or primary legal source preferred. Local PDFs are not accepted.

Editorial controls

Rows must include publisher, official URL, access date, verification flag, and last_verified before human_reviewed can be true.

SOURCES

Official-source register.