Why You Can't Buy This. Ever.

I get the same message every week: "Cool project — when can I buy one?"

Never. Not because I don't want your money. Because the paperwork between me and your money costs more than the entire project, and none of it makes the device any safer than it already is.

Let me walk you through what "just sell a few" actually means for a small electronics project with a rechargeable lithium-ion battery and a LoRa radio, sold from Germany.

The list

CE marking. Not one thing — a stack. EMC, Low Voltage where the thresholds apply, RoHS, REACH, and because there's a 868 MHz LoRa module in it, the Radio Equipment Directive as well: spectrum efficiency, duty cycle, radiated emissions, the lot. I can self-declare, yes. But self-declaration isn't a vibe, it's a legal claim I have to defend with test reports from an accredited lab. German labs quote roughly €2,000–10,000 for an electrical device, €3,000–9,000 once a radio is involved. Fail a scan, redesign, book the chamber again.

GPSR (Regulation (EU) 2023/988). Applies on top of everything else, to every consumer product, regardless of company size. Documented internal risk analysis, technical file, traceability marking, kept for 10 years. There is no micro-enterprise exemption. There is a "the Commission will provide guidance for SMEs" clause, which is not the same thing.

Cyber Resilience Act (Regulation (EU) 2024/2847). My thing has firmware and a companion app, so it's a "product with digital elements." The vulnerability reporting duties are landing right now: actively exploited vulnerabilities get an early warning within 24 hours, a full notification within 72, a final report within 14 days of a fix. From 11 December 2027, the rest: secure-by-design requirements, an SBOM in the technical documentation, vulnerability handling across the entire declared support period, CE marking tied to security. Fines up to €15M or 2.5% of turnover. Open source developed outside a commercial activity is exempt. The moment I take money for it, it isn't.

So I'd be legally obligated to run a 24/7 incident response process. For a hobby PCB. Alone.

Battery Regulation (EU) 2023/1542, implemented in Germany by the BattDG. Register with stiftung ear per brand and battery category, join an approved producer responsibility organisation for the category, take-back obligations, labelling. From February 2027: a QR code linking to the battery data, guaranteed user removability and replaceability of the cell, and spare cells available for at least five years after the last unit ships. Fines up to €500,000. Anyone without a German establishment needs a resident authorised representative.

UN 38.3. Before a lithium cell moves by air, sea, road or rail it needs the transport test series. Quotes range from a few hundred euros to five figures depending on lab and pack complexity, and a certified cell does not certify my pack — the BMS, wiring and enclosure change the answer. On top of that, UN3481 is Class 9 dangerous goods: trained shipping staff, correct labelling, carriers who'll actually accept the parcel.

WEEE. Register before the first sale, provide an insolvency-proof financial guarantee for consumer devices recalculated every year, and organise take-back and disposal. The authority's own fees are peanuts. Bundled through a compliance service provider it's roughly €450 a year at small volumes, and full-service packages from the larger providers rarely come in under four figures. Selling unregistered: up to €100,000 and a distribution ban.

Packaging. Registration in the packaging register is free and mandatory from the first shipped box — there is no minimum quantity — and system participation with a dual system is not free. Under the PPWR my cardboard box now needs its own EU Declaration of Conformity and its own technical documentation. My box. Needs a declaration of conformity.

And the part that actually kills it: shipping to another EU country means an authorised representative in the destination country. Per country. Each one billing an annual fee, each one with its own national register, its own reporting deadlines, its own fee schedule. Ship to five countries and you're maintaining five parallel compliance relationships before you've sold five units.

Then the boring German layer: Gewerbeanmeldung, IHK membership, VAT plus OSS returns once anything crosses a border, legally reviewed T&Cs and withdrawal instructions, two years of statutory warranty, product liability insurance, and the new Product Liability Directive (EU) 2024/2853, which explicitly puts software and firmware updates in scope. Proper double-entry bookkeeping, receipts, GoBD-compliant archiving, monthly VAT filings, annual accounts — either hours of my week, every week, or a tax advisor's invoice. Plus Germany's national sport: an Abmahnung from a competitor's lawyer over a comma in the imprint.

The math

Conservatively, before I sell a single unit and before I buy a single component:

Lab testing (EMC, safety, RED)	€3,000–10,000
Battery pack testing (UN 38.3, IEC 62133-2)	€1,000–20,000
Technical files, risk assessment, declarations	€2,000–5,000
Legal review, insurance, registrations, guarantee	€1,500–4,000
Before revenue	≈ €10,000–25,000

Then a few thousand a year, forever, in recurring fees, representatives, accounting and insurance — plus a CRA reporting duty running on a 24-hour clock, plus a retest every time a component goes end-of-life and I have to swap it.

Take the low end. €15,000 of compliance spread over an optimistic first batch of 100 units is €150 per device. The hardware BOM is €30.

So a €30 pile of components has cost me €180 by the time it's legally allowed to exist.

And I want to be precise about what that number is, because people keep misreading it: €180 is not the price. €180 is the cost. It contains zero hours of design work, zero hours of firmware development, zero hours of filling in forms and chasing lab appointments and filing quarterly reports, zero hours of answering support emails for the next five years, zero hours of maintaining the firmware for the entire declared support period because the CRA says I have to. A price would be that number plus all of it. Nobody is buying that. I wouldn't buy that.

So instead

The schematics, board files, firmware, BOM and build instructions are all in this repo under an open license. Build it. Fork it. Sell your own if you can face the above.

Building a device for yourself isn't "placing it on the market." None of this applies to you. That's not a loophole — it's the actual, sane design of the law, and it's the only door left open for a project this size.

I'm not against regulation. I want batteries that don't burn people's houses down and I want e-waste collected. But every one of these rules was written with a company that has a compliance department in mind, and the fixed cost lands identically on someone shipping 200,000 units and someone shipping 100. The result isn't safer products. The result is that the small, repairable, documented, openly designed thing never gets built — and you buy the sealed grey-import brick instead, from a seller who ignores all of this and gets away with it.

So: files, not products. Sorry. Go solder something.

---

Rant, not legal advice. Figures are ballpark quotes and public fee schedules as of August 2026; your product, your lab, your lawyer, your numbers. Corrections welcome — open an issue.