Electronics System Standards Compliance: Certification, Testing & Verification
I can only answer this question from my point of view, so I am doing so to start the conversation, not because I expect this to be an exemplary response!

EDIT: there is a VERY good ESE answer here that I think would be of interest to anyone reading this.

Let me start by saying that I am based in the UK, and work for a small, young company (I hate the word startup) that produces products for sale worldwide.

When I first had to consider approvals and compliance for a product that I had designed I had no idea where to start. TL;DR - we partnered with UL, who advised us on the standards that they believed applied to our product, along with some practical advice. We had them test everything that they recommended and haven't had a problem since. However, our product is pretty simple. Now that I understand more about the legal enforcement and implications of the standards we tested to, I would likely go about this differently in the future (fewer tests, and do some of them internally).

Our product is an Arduino-compatible single board computer. We produced an initial run via Kickstarter and only worried about certification after the fact - in future I would do some preliminary testing in advance. At the time we ran the Kickstarter, we had raised the highest total ever in the UK (long since eclipsed by others). Through this, UL actually contacted us, basically saying "we're not a big corporate monster - we can work with small companies too" - so we decided to go with them as an established name.

Initial discussions covered lots of ground that was brand new to me:


CE marking is something that you do as a company. It is up to you to work out what relevant standards apply to your product, test the product against them, and assuming that the product passes, you mark your product with the CE symbol (there are rules about how to do this) and keep a dossier of the test results in case anybody needs to question it in the future. UL can advise on this and do the testing on your behalf - and produce documents that go into your dossier - but they do not mark the product as CE compliant.
As an unintentional radiator we didn't need an FCC ID for sale in the US - but we did need to comply with FCC radiated emissions standards.
How you describe your product is important. If we had classed our product as a low voltage device we would have had to undergo surge testing - by classing it as a USB computer accessory, we didn't have to.
Additionally, how you recommend and show your product being used is important. Our product encourages people to connect other devices (particularly crocodile clips) to the board. During testing, you have to place these in the most unfavourable position for that particular test (often spread as wide as possible in the case of radiation emission / immunity testing). By ensuring that we only show relatively short cables in any example on our website, we could test only with those cables - if we ever recommended or showed longer cables, it could be argued that we are encouraging that sort of use and should test with longer cables.
In the UK, CE compliance is enforced by Trading Standards. They are quite busy trying to stop fake cigarettes, fake medicines, self-igniting phone chargers and exploding e-cigarettes from hitting the market. If you test and design your product well and the chance of it actually hurting anyone is very low, you're probably going to be fine. Anything that plugs in to a real computer USB socket is a good example of this - the computer should limit the output current, so even if you're slack there the worst thing you could likely achieve is to damage the USB port on the machine it is plugged into.


We ended up testing for radiated and conducted emissions, static discharge immunity, electric and magnetic field immunity. Immunity testing is an odd one. It basically says that your product has to recover to a managed "working" state after being exposed to the test conditions.

Firstly, our test engineer pointed out that measured electric and magnetic field strengths in your average large PC shop (e.g. PC World in the UK) far exceed the levels tested against in the standards we tested to. If you wanted to save time / money in the future, this is a test that you might do myself, using hired measurement equipment to ensure that you were within the specification of the test. Similarly, you can hire the test equipment for the static discharge immunity testing and easily conduct the test yourself for the cost of purchasing the relevant test standards document and building a simple rig.

Secondly, given that our equipment is not life-critical equipment, I don't see why we have to recover gracefully from an immunity test as part of designing a safe-to-sell product. I assume this is a legislative defence against REALLY terribly designed products that break easily in the hands of the consumer.

For future products, I would get an early prototype in for an initial exploratory radiated and conducted emissions test so that I could identify any potential issues and deal with them - waiting until you are close to release is a risk I wouldn't take. For immunity testing, I would likely wait until the end - unless you're talking about mains surge immunity, which I don't fancy doing any time soon! (but would look at early just in case you have a show stopper hiding in there).

As I say, this is just my experience - I would be really interested to hear from any compliance engineers out there (both inside electronics design companies and those working in test houses).

EDIT: I thought of some more things that came up during our compliance testing journey:


CE marking is about the overall safety and suitability for sale of a product. This includes lots of matters beside electromagnetic compatibility - material consideration, toxicity and huge amounts more. Again, having a knowledgable test house working for you really helps break down what is relevant and what is not
I haven't mentioned the RoHS and WEEE directives here (applicable in Europe) but those are pretty easy to self ensure through design and internal procedure design.