Manufacturing and certification basics

Key takeaways

You have a validated prototype that works beautifully on the bench. Now you need to build thousands of them. This is the point where many IoT projects hit unexpected delays and cost overruns. By the end of this lesson you will understand the core manufacturing considerations for cellular IoT devices and the regulatory certifications required to bring a wireless product to market.

What you'll learn

Why manufacturing a cellular device is different from a simple electronic product

The presence of a radio, a cellular module that transmits and receives on licensed spectrum, adds layers of complexity to both the build process and the regulatory requirements. That radio is the reason you face certification testing that a non-wireless product would never encounter.

How to protect against component end-of-life and supply chain risk

IoT products are designed for 10- to 20-year lifespans, but their components are not. Nearly 30% of semiconductor end-of-life (EOL) events occur without a formal Product Change Notice, so a critical chip can disappear with little warning. Adopt three practices from day one:

• Multi-source design: Prioritize components with drop-in replacements from multiple vendors to reduce single-supplier dependency.
• PCN/PDN workflows: Establish internal processes to evaluate Product Change Notices (PCN) and Product Discontinuance Notifications (PDN) so you can act fast on a last-time-buy announcement.
• Alternate qualification: Maintain a pre-approved list of alternate parts validated for "form, fit, and function" compatibility, avoiding costly full redesigns.

How device security starts on the factory floor

Security begins during manufacturing, not after deployment. Each device should be pre-loaded with a unique cryptographic identity stored in a Secure Element (SE) or Trusted Platform Module (TPM), a tamper-resistant chip where private keys never leave the hardware boundary. The standard approach uses X.509 certificates with Elliptic Curve Cryptography (ECC) key pairs. ECC matches RSA security with far smaller keys, 256 bits versus 3,072 bits, making it well suited to resource-constrained microcontrollers.

What a Software Bill of Materials (SBOM) is and why it matters

The EU Cyber Resilience Act now requires a signed Software Bill of Materials (SBOM) which is a list of every third-party library in your device firmware. It allows rapid identification and patching when vulnerabilities appear in common software components. Even if you are not selling in the EU today, building an SBOM practice now prepares you for where global regulation is heading.

Which regulatory certifications a wireless IoT device must pass

Every wireless product must clear regional certifications before it can legally be sold; shipping uncertified can bring fines, recalls, and market exclusion. The four you are most likely to encounter:

• FCC ID (United States): The Federal Communications Commission requires testing for radio frequency interference, also called electromagnetic interference (EMI), at an accredited lab. Your device must not emit RF energy that disrupts other devices.
• CE Marking (European Union): Covers the Radio Equipment Directive (RED) for wireless function, the Low Voltage Directive (LVD) for electrical safety, and the EMC Directive for electromagnetic compatibility. Depending on the product, you may self-declare conformity or need a Notified Body review.
• UL / ETL (North America): Underwriters Laboratories testing focuses on electrical and battery safety: overheating, fire risk, and shock hazards. UL certification is critical for any device with a lithium battery.
• RoHS / REACH (European Union): Environmental regulations on material composition. RoHS restricts hazardous substances such as lead and mercury; REACH requires chemical analysis and registration of substances used in manufacturing.

When to start the certification process

Plan for certification to take 8 to 16 weeks depending on product complexity and how many regions you target. Start during PVT, not after. Discovering a certification issue once production is ready can delay your launch by months.

When to start the certification process

Plan for certification to take 8 to 16 weeks depending on product complexity and how many regions you target. Start during PVT, not after. Discovering a certification issue once production is ready can delay your launch by months.

Lesson 7.2 Self-assessment

Frequently asked questions