CE marking for IT equipment: who is responsible when servers and switches enter the EU

CE marking for IT equipment is the manufacturer's declaration that servers, switches, storage arrays and radios meet the EU rules on electrical safety, electromagnetic compatibility, radio and hazardous substances. The manufacturer affixes it, but when the hardware comes from outside the EU, an EU-established importer must check the marking, the declaration and the technical file before sale.

That split of responsibilities is where most non-EU vendors get caught. A rack server built in Taiwan or a switch designed in California usually leaves the factory with a CE logo on the rating label, so it is easy to assume the compliance work is done. It is only half done. EU product law expects a company inside the Union to stand behind that logo, keep the paperwork and answer the authorities. If nobody in the EU has accepted that role, the shipment can be held at the border or refused by the buyer.

This guide explains who is responsible for CE marking when high-value IT and network hardware enters the European Union: what the marking covers, what the manufacturer and the importer each have to do, how customs checks it, and where an Importer of Record fits in the chain.

What does CE marking for IT equipment actually cover?

For most servers, switches, routers, storage systems and power distribution units, CE marking covers four sets of rules: electrical safety, electromagnetic compatibility, radio performance for anything with a wireless module, and restrictions on hazardous substances. Servers and online storage products also have ecodesign requirements. The marking says the product meets all of them at once.

In legal terms, a typical rack server sits under the Low Voltage Directive (2014/35/EU), which applies to equipment designed for use between 50 and 1,000 volts AC or 75 and 1,500 volts DC, the Electromagnetic Compatibility Directive (2014/30/EU) and the RoHS Directive (2011/65/EU) on lead, mercury, cadmium and other restricted substances. As soon as a product contains a radio, such as a Wi-Fi access point, a switch with a wireless management module or a 5G small cell, the Radio Equipment Directive (2014/53/EU) takes over. It includes its own safety and EMC requirements, so radio equipment is assessed under the RED instead of the LVD and the EMC Directive in parallel.

Servers and data storage products add one more layer. Commission Regulation (EU) 2019/424 sets ecodesign requirements for servers with up to four processor sockets and for online data storage products, including minimum power supply efficiency, a secure data deletion function and the availability of firmware and security updates for a defined period. Products covered by ecodesign measures are CE marked against them too, which is why a server's declaration of conformity often lists more legislation than buyers expect.

When several acts apply, the manufacturer draws up a single EU declaration of conformity listing all of them, backed by a technical file with test reports, risk assessment and the harmonised standards used. The logo on the label is only the visible summary of that file.

Who is responsible for CE marking when the manufacturer is outside the EU?

The manufacturer remains responsible for the design, the conformity assessment, the technical file and the CE marking itself, wherever it is based. What changes is that EU law also requires an economic operator established in the Union to answer for the product, and when the goods are imported, the importer carries a specific set of legal duties.

Under the general rules on CE marking in Regulation (EC) No 765/2008, only the manufacturer or its authorised representative may affix the marking. A non-EU manufacturer can appoint an authorised representative in the EU by written mandate to keep the declaration of conformity and the technical file at the disposal of the authorities. That representative does not redesign or retest the product, but it becomes the contact point inside the Union.

The Market Surveillance Regulation, Regulation (EU) 2019/1020, closes the gap for products sold from outside the Union. Its Article 4 says that products covered by the LVD, the EMC Directive, the RED, RoHS and several other acts may be placed on the market only if there is an economic operator established in the Union responsible for them: the manufacturer itself if it is established in the EU, an importer, an authorised representative, or a fulfilment service provider when no other operator is established in the Union. That operator's name and contact details must appear on the product, its packaging, the parcel or an accompanying document.

So one question has to be answered before the first shipment: which company inside the EU is the responsible economic operator? If an EU distributor imports the goods, it is usually the distributor; if you sell delivered and cleared, you decide it yourself. Our guide to importing into the EU without an EU entity covers the customs and VAT side of that same decision.

What does the importer have to check before servers and switches are sold?

The importer must verify that the manufacturer has carried out the conformity assessment, drawn up the technical documentation and affixed the CE marking, and that the equipment comes with the required instructions and safety information. It then adds its own name and address, keeps the declaration of conformity and acts if the product turns out to be non-compliant.

The European Commission summarises the CE marking obligations for importers in three checks: the non-EU manufacturer has taken the steps needed to place the product on the EU market, the declaration of conformity and technical documentation can be produced on request, and the importer can contact the manufacturer at any time. Behind those checks sit detailed duties in each directive. Article 8 of the Low Voltage Directive, for example, requires the importer to indicate its name, registered trade name or trademark and postal address on the equipment or, where that is not possible, on the packaging or an accompanying document, and to keep a copy of the EU declaration of conformity for 10 years after the equipment is placed on the market.

The same article requires instructions and safety information in a language easily understood by users, as decided by the member state of sale: Spanish for a data center in Madrid, German and French for a delivery split between Frankfurt and Paris. If the importer believes a product is non-compliant, it must not place it on the market until it is fixed, and must inform the manufacturer and the authorities when it presents a risk.

There is one trap worth knowing. An importer that sells equipment under its own name or trademark, or modifies it in a way that can affect compliance, is treated as the manufacturer and takes over the manufacturer's full obligations. White-labelled servers and rebranded network appliances fall into this category more often than vendors realise.

Can customs stop a shipment over CE marking?

Yes. Customs authorities in the EU act as the first line of market surveillance for products coming from outside the Union. They must suspend the release for free circulation of products that lack the CE marking or the required documents, carry a false or misleading marking, or have no identifiable responsible economic operator in the EU.

The procedure is set out in Articles 25 to 27 of the Market Surveillance Regulation. When customs suspends release, it notifies the market surveillance authority, which then decides whether to keep the goods blocked. Under Article 27, if the market surveillance authority has not asked customs to maintain the suspension within four working days, the goods are released, provided all other customs formalities are complete. The same article adds that release does not prove the product complies with EU law, so authorities can still act after delivery.

Four working days sound short, but on a data center project they mean storage charges, idle installation crews and penalty clauses, and if the authority keeps the suspension, the delay becomes open-ended. Customs selection is risk-based, and high-value electronics attract attention when the invoice, the packing list and the product labels do not agree on who the importer is.

Who does what between the manufacturer, the importer and the IOR?

Each role has a defined owner. The manufacturer owns the design and the conformity assessment, the importer or authorised representative answers for the product inside the EU, and the customs declarant handles the import formalities. When an Importer of Record is involved, the contract has to say which of these roles it takes.

Here is how responsibilities usually fall when a non-EU vendor ships servers or network equipment to an EU customer.

Two lines cause most of the friction. The EU contact details must be on the product, the packaging or an accompanying document before sale, which is hard to fix once a pallet is sealed. And the importer named in the customs file is the first party authorities look at, whatever the commercial understanding was.

Does an Importer of Record become the importer under product law?

Not automatically. Under EU product law, the importer is the EU-established operator that places a product from a third country on the Union market. A company that only lodges a customs declaration on someone else's behalf is not, by that act alone, the importer for CE purposes. The role depends on the structure agreed for each shipment.

In practice, an Importer of Record can work in two ways. In the first, the IOR handles the customs side while the vendor appoints an authorised representative, or the EU customer takes the importer role for product compliance. In the second, the IOR or a partner in the group also acts as the responsible economic operator under Article 4 of the Market Surveillance Regulation, so its name goes on the packaging and it holds the declaration and technical file. The second model is cleaner for the vendor, but no responsible operator will put its name on a product whose file it cannot defend. If the concept is new to you, our guide on what an Importer of Record is explains the role and its limits.

The customs framework is also moving in this direction. The new Union Customs Code, Regulation (EU) 2026/2108, defines the importer for the first time, and analyses published after its adoption note that an indirect customs representative acting for a non-EU importer will take on related compliance obligations once most of its provisions apply from 21 September 2027. Vendors that settle the CE question now will not have to rebuild their EU import model later. When an EU delivery is part of a wider rollout that also reaches Spain or South America, this overview of importer of record options across the European Union shows how our sister operation in the same group handles it.

What changes for radios, firmware and cybersecurity?

Connected radio equipment now has cybersecurity requirements under the CE marking, and the Cyber Resilience Act will extend similar duties to most products with digital elements. For switches, access points, servers with wireless modules and 5G equipment, the technical file must show how the product protects networks and personal data and guards against fraud.

Commission Delegated Regulation (EU) 2022/30 activated three essential requirements of the Radio Equipment Directive for internet-connected radio equipment, and it has applied since 1 August 2025. Manufacturers can demonstrate compliance using the harmonised standards EN 18031-1, EN 18031-2 and EN 18031-3, although some restrictions on their use mean certain products still need a notified body. A Wi-Fi access point that passed its radio tests in 2024 but has no cybersecurity assessment cannot be placed on the market today with the same declaration.

The Cyber Resilience Act, Regulation (EU) 2024/2847, goes further. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents in their products, with an early warning within 24 hours, and the rest of the regulation applies from 11 December 2027. From then on, CE marking for most IT equipment will also cover secure design, vulnerability handling and security updates, so EU partners will ask for security documentation alongside the safety and EMC reports. Our guide to importing networking equipment covers the export control and homologation side of the same hardware.

Where do EU deliveries of servers and network gear usually go wrong?

Most problems are documentary. The hardware usually meets the standards, but the declaration of conformity is outdated, the EU contact details are missing, the language of the instructions does not match the country of sale, or the file cannot be produced quickly when customs or the buyer asks for it.

A frequent case is a declaration that misses a directive, such as a switch declared under the LVD and the EMC Directive although the shipped version has a radio module, which brings it under the RED. Another is a configuration change after testing, like a different power supply or network card, that never reached the technical file.

CE marking also sits next to other EU obligations that are easy to confuse with it. Producer registration for electrical equipment, batteries and packaging is a separate national system, explained in our guide to WEEE compliance for IT hardware. None of these registrations replace the CE file, and the CE file does not replace them.

How should you prepare the first EU shipment?

Settle the roles first, then the documents, then the logistics. A vendor that knows who the responsible economic operator is, has a current declaration of conformity and has the EU contact details printed on the packaging can usually clear servers and network equipment without CE questions at the border.

A sequence that works for most non-EU hardware vendors:

1. Map each product and configuration to the legislation that applies: LVD, EMC Directive or RED, RoHS, ecodesign for servers and storage, and the RED cybersecurity requirements for connected radios.
2. Ask the factory for the current EU declaration of conformity, the test reports and the list of harmonised standards, and check they match the exact configuration you will ship.
3. Decide who is the responsible economic operator in the EU: your customer, a distributor, an authorised representative or your Importer of Record, and put it in the contract.
4. Print that operator's name and postal address on the product, the packaging or an accompanying document, and prepare instructions in the language of each country of sale.
5. Align the customs file with the product file, so the importer on the declaration, the invoice and the labels tell the same story.

If you are planning to deliver servers, switches or storage to a customer in the European Union, tell Comex IOR Services what you are shipping, which configurations are involved and where the equipment will be installed. As your EU Importer of Record for IT equipment, we will review the CE documentation before anything ships, tell you plainly who should carry each role and organise the import so the hardware clears and reaches the rack on time.