I spent a week cursing Europe. Then I read the rules.

A beehive is a wooden box. Inside are the bees, doing the work they’ve done for a few tens of millions of years without ever asking anyone’s opinion. I put a scale under it, a few sensors, and a low-power radio that reads the telemetry every so many minutes and sends it. That’s it.

To sell that thing in Europe I find myself with three distinct products to declare separately, four directives, a dozen or so standards, and weeks of lab time. I spent a whole week reading and doing the math, and I spent that week angry. The thought was always the same, and I’ll write it down the way it was: why, for a wooden box with a thermometer inside, do I have to spend as if I were launching a medical device?

Then I went and read the actual texts. And the piece I was about to write, the one venting my spleen, doesn’t hold up. I’ll tell you why, because I think it’s more useful than the complaint.

The certificate I was trying to buy doesn’t exist

I started from an implicit assumption I’d absorbed without ever checking it: that somewhere out there was a body you bring the object to, and it hands you a CE certificate. The number that terrified me was the price of that piece of paper.

That piece of paper doesn’t exist. The ordinary route under the radio directive is self-assessment: you apply the harmonized standards, you assemble the technical file, and then you sign it. You make the declaration of conformity yourself, under your own responsibility, and nobody hands you a stamp. There’s no body to pay for the right to exist, except in specific cases where a notified body comes into play.

Which moves the question to a much more uncomfortable place. It’s not “how much does the certificate cost”. It’s: what evidence has to exist in the file to stand behind that signature? And that’s a question you can’t answer with a check.

And the second discovery demolished the other half of my resentment: the standards are free to read. After a 2024 Court of Justice ruling (case C-588/21 P), the three parts of the standard on the cybersecurity of radio devices are available in full and legally without paying anything. It’s nearly six hundred pages. I downloaded them and I read them. I was ready to be outraged about that too, and instead it was an open door.

The turnaround

In my estimates, the single most expensive line item in the whole project was cybersecurity. And it’s the line that made me angriest, because it looked like a pure racket: paying someone to say my firmware is fine.

Then I understood how it’s built, and it turned on me. That standard sells you no measurement at all. There’s no instrument to hook up, no shielded chamber to book. It asks you to demonstrate, in writing, that the device has certain mechanisms and that they’re designed in a certain way: how it updates, how it authenticates, how it protects its keys, how it handles its secrets. It’s all paper.

Which seems even more absurd, until you reach the point: if the firmware isn’t already built that way, that’s not documentation to write. It’s a redesign. It doesn’t cost because someone is taxing you. It costs because it’s asking you for something you didn’t do.

So I went to check mine, with the attitude of someone gathering evidence for his own defense. I wrote an audit of the real code: the node firmware, the receiver’s, the bridge, the backend. Here’s what I found:

There is no update mechanism at all. Not “the update isn’t signed”: there simply isn’t one, in any of the three firmwares. Today, if I discovered a vulnerability, the only way to fix it would be to go physically hive by hive with a USB cable. On a product meant to sit for years in the middle of a field, in thousands of units. This isn’t a bureaucratic technicality: it’s an industrial problem I would have discovered in the field, at the worst possible moment.

The radio link isn’t authenticated. The node transmits and the receiver trusts it. There’s an integrity check, but integrity isn’t authenticity: it says the message didn’t get corrupted on the way, not that it was sent by whoever claims to have sent it. For telemetry, that’s bad. For the anti-theft function, which is one of the reasons this product exists, it’s a broken promise: a thief with a radio costing a few tens of euros can jam the alarm. I’d written that code myself, and I was convinced it was fine.

The credentials were shared. When I told the story of how you don’t need an engineer to install it, I was proud that each receiver got its own credential, revocable. True. But underneath, the system image I use to prepare the devices carried another one, identical for everyone, and nobody was forced to change it. One of those details you only see when someone forces you to write down in black and white that they aren’t there.

Three things. None found by an inspector: found by me, because a standard I was cursing forced me to ask myself the right questions. The most irritating rule of all, the one I’d marked down as vindictive, in practice says just one line: never allow the user to skip setting a password, in any configuration. I was breaking it. It was right.

What’s still fair to curse

This isn’t a conversion. There are things I still find stupid, and I’m writing them down because a piece that ends with “they were right about everything” would be as false as the one I wanted to write at the start.

The same measurement, three times. Electromagnetic compatibility is tested on the finished product and isn’t inherited from anyone. Three products means three lab sessions to measure the exact same physics on nearly identical hardware. It’s the line item that doesn’t budge by a single euro in any scenario.

No binding source proves me right, and none proves me wrong either. My most important position (that a node which only speaks point-to-point radio, and reaches the internet only because a gateway terminates the link and opens another one, isn’t “radio equipment connected to the internet”) rests on a guidance document from the market surveillance authorities that is explicitly non-binding. The case closest to ours uses precisely the example of a temperature sensor on a LoRa network, and says no. Good. But an authoritative position from the Commission on this simply doesn’t exist. I’m building a product on a reasonable reading, not on a certainty. That, yes, is a bizarre way to run a market.

And a detail that says a lot. The authorities who inspect you have the most permissive reading. The association of the bodies that sell you certification has the most expansive one, that is, the one that pulls more products into scope. It’s not malice: it’s that when you ask advice from whoever sells the remedy, the remedy is always needed.

And above all: the truce expires. The regulation my reasoning rests on is repealed on 11 December 2027, because the Cyber Resilience Act arrives, and that “connected to the internet” filter isn’t in it at all. The node goes out the door and comes back through the window about a year later, exactly in the phase where the product goes into production.

Which is, in fact, the line I closed the audit with, and the one I’ll close with here. The honest tally isn’t “we save on certifying the node”. It’s: we pay for it later, under another name, and in the meantime we have a product in the field that we can’t update.

I started the week convinced that Europe was asking me to pay a toll for a wooden box. I finished it with three real bugs to fix, an architecture decision to make before freezing the design, and the nagging feeling that the part I was cursing was the only one doing the review work that no one else had done for me.

The toll stays, no question. But now at least I know what I’m paying it for.