A Standard Is Not the Law That Uses It

Certification portals.

Badges with reassuring hexagons.

A laboratory report printed on paper thick enough to stop a modest calibre of doubt.

Somebody will build you a dashboard in which a connected industrial sensor has a green check beside the words “ISO compliant.”

Which is not a sentence, but does have excellent posture.

Then the regulation arrives.

It has no interest in your dashboard.

It wants to know which product it governs, what it requires, what procedure it selects, and why the document in your certificate pile is relevant at all.

The standard waits beside it, carrying a technical text and the quiet annoyance of a book repeatedly mistaken for a statute.

You need two citations, even when your final prose uses one.

Citation one identifies the binding statute, regulation, directive or sectoral product act.

Citation two identifies the standard: issuer, identifier, edition, scope, status.

The first document says what has to be achieved. The second may supply a controlled route for showing it.

They touch at the reference.

They do not merge into a single object because somebody put both logos on a lanyard.

The logo pile has no authority

Start with the instrument that can actually impose a product duty.

It establishes the product scope, the essential requirements, the assessment procedure, the documentation, the marking, and operator duties.

The 152-page Blue Guide 2022 is unusually clear about the hierarchy. Only the Union harmonisation act itself has legal force.

A standard can explain a design or a test method.

It becomes legally relevant only when an act names, incorporates or recognises it.

Which is why “the standard is the law” fails its first reading.

Regulation 1025/2012, Article 2, treats a standard as ordinarily a voluntary technical specification.

It reserves “harmonised standard” for a European standard adopted after a Commission request for Union harmonisation legislation.

The special name does not promote the document to Parliament.

A published reference can attach a presumption of conformity to a covered essential requirement.

Your legal duty remains conformity with that requirement.

So your citation has three possible jobs, and they should not attend the same meeting under the name “compliance.”

A mandatory incorporation makes the named external text obligatory through the incorporating instrument.

A presumptive route gives use of a recognised technical path an evidentiary effect, while another route may remain possible.

A guidance cross-reference informs interpretation.

It may have the practical force of an office coffee machine, but it doesn’t impose the text.

The standard’s cover cannot tell you which job it got.

The law has to do that.

The US version wears a slightly different tie.

NIST describes 1 CFR Part 51 as the federal framework for incorporation by reference in the Federal Register and the CFR.

Its preambles address reasonable availability and summarise incorporated material.

Your legal rule has to identify enough material that you can discover what text you’re being judged against.

Issuer, title, edition, approved location.

“The current edition” is not a phrase.

It’s a trapdoor with typesetting.

An edition is not a decorative year

Once you’ve found the legal act, the standard needs a record rather than a confident hyperlink.

The basic record has twelve fields.

Issuer.

Preferred title.

Document class.

Identifier.

Edition or draft version.

Publication date.

Technical scope.

Lifecycle status.

Predecessor or successor.

Responsible committee.

Rights statement.

Source URL.

A title retrieves a document.

Scope tells you what technical question it addresses, and occasionally more usefully, what it leaves outside.

The edition field describes a text set.

Not the largest type on a PDF cover.

It records whether you hold a base edition alone, base text plus amendments, a corrected version, or a consolidated revision.

ISO recognises four modification types.

Technical corrigendum.

Corrected version.

Amendment.

Revision.

A revision creates a new edition.

An amendment normally changes only part of the existing standard and may stay separate.

So your record needs an integrated_text_available flag.

A base PDF can be impeccably real and still be missing a live amendment.

An IEEE draft makes this less negotiable.

Its required pattern is at least IEEE Pxxx/DXX, with the date included.

Two parts, doing the work an edition number can’t do yet.

For an approved IEEE standard, up to 3 amendments may be approved before revision is required, subject to the exception for a base standard less than three years old.

ISO takes a different approach.

Two separate amendments may attach to a current International Standard before a third requires a new edition.

Neither count is a general law of publishing.

Each is a fact about a controlled document system.

Status has its own opportunities for administrative mischief.

Keep three dates apart.

Approval.

Publication.

Withdrawal or supersession.

A replacement can publish before the preceding edition is formally withdrawn. A national adoption can carry a separate implementation date.

An ISO proposed withdrawal carries an 8-week objection opportunity.

An IEEE standard is considered for inactive status at the start of the calendar year after it is 10 years past approval.

“Old” is not a lifecycle status.

It’s an adjective trying to avoid paperwork.

Successor links need direction too.

supersedes and superseded_by describe different arrows.

A withdrawn document may have no successor.

An ISO reinstatement, if approved, publishes as a new edition with a new date.

In the regional implementation layer, CEN/CENELEC’s dow is normally 6 months after availability, for withdrawal of conflicting national standards, with a justified extension not exceeding 3 years.

That calendar is not a product grace period, and it isn’t the Commission-managed end of a presumption of conformity.

Documents have their own clocks.

Law has another one.

They exchange postcards.

A test result is not a passport

Your certificate pile returns here, now wearing a lab coat.

Conformity assessment before sale can include three activities.

Testing.

Inspection.

Certification.

The sectoral act decides which, if any, belongs to your product and its risk.

The manufacturer can be permitted to self-assess, or the route can require a notified body for a defined module.

Neither outcome lets a report about one question answer the rest by association.

A useful technical file has five layers.

Product identification.

Design and risk analysis.

Requirement-to-evidence matrix.

Test, inspection or certificate records.

Controlled production information.

The matrix has three columns.

Legal requirement.

Triggering product feature.

Evidence needed.

Put the legal act in the first column before the standard.

Otherwise the familiar catalogue number walks into your room, announces it is “best practice,” and starts billing hours.

Third-party assurance comes in three levels.

Accreditation.

Designation.

Notification.

Under Regulation 765/2008, accreditation concerns competence for a specified activity.

Designation is the national decision to use the body for a regulated function. Notification communicates that designation under the relevant Union act.

A notified body’s conclusion stays bounded by its scope, product family, procedure, or task.

Its certificate is not a diplomatic passport for the manufacturer’s entire warehouse.

The manufacturer still makes the legal claim.

The declaration of conformity identifies at least five categories.

Product.

Governing legislation.

Manufacturer or authorised representative.

Notified body where applicable.

Harmonised standards or other normative documents where appropriate.

The CE marking has a minimum height of 5 mm where no sector-specific dimension applies.

That tells you something precise about the geometry of a marking.

It tells you almost nothing about whether the antenna, the firmware, the enclosure, or the production change is represented by your evidence.

For an Article 4 product placed on the EU market by a non-Union manufacturer, an EU-established responsible economic operator must exist before placement.

The details appear on the product, the packaging, the parcel, or an accompanying document.

That operator needs access to the technical file.

A warehouse address that can receive a brochure and cannot retrieve the evidence is a decorative address.

An old business model, but not the assigned one.

The later inquiry reads the real thing

Six months after sale, an authority doesn’t have to accept your green badge as a substitute for a question.

Regulation 2019/1020 lets a market-surveillance authority request four evidence classes.

Technical documents.

Supply-chain information.

Website-ownership information.

Product samples.

It may inspect without notice and, where necessary, access embedded software.

The inquiry concerns the version actually on the market. Not the version that had a productive afternoon in a laboratory.

The result can be document correction, re-test, stop-sale, withdrawal, recall, or penalty.

Depending on the non-compliance and the risk.

The three broad outcomes are less dramatic than the badge economy prefers.

The authority closes the inquiry after accepting the reported issue is not non-compliance. Or it accepts a proportionate correction and verifies completion.

Or persistent non-compliance produces restrictions, withdrawal, recall, penalties.

A certificate receives due consideration.

It does not make the authority unemployed.

The routine that keeps nouns apart

None of this needs an ontology with a centre of excellence.

It needs a card and four checks.

First, resolve issuer, identifier and title against the official catalogue.

Second, check that edition and amendment set describe the text you actually have.

Third, verify status and successor links on the recorded date.

Fourth, confirm the URL supports the asserted rights and publication facts, rather than merely mentioning the standard.

Your source hierarchy runs from current catalogue or status page, to published text, to ballot report or procedure, to committee record, then to a reliable secondary index.

Keep rights on the card too.

There are two permissions.

Access to read, and permission to reproduce.

Your rights record has four components.

Named copyright owner.

Copy or quotation permission.

Licence or purchase condition.

Supporting page.

IEC says its publications cannot be reproduced or used without written permission under its conditions.

IEEE owns copyright in draft and approved IEEE standards.

A readable web page does not turn either document into public domain by exposure to daylight.

The completed card has a plain shape.

LAW
legal act | product scope | essential requirement | legal mechanism

STANDARD
issuer | identifier | edition or draft | text set | status_checked_on
scope | supersedes | superseded_by | rights source

LINK
mandatory incorporation | presumption of conformity | guidance
product configuration | evidence route | remaining legal duties

Which one is the law

Call it the incorporation card.

It doesn’t answer whether your particular product conforms.

It records the binding instrument, the controlled technical text, the edition, and the legal mechanism that lets the text matter.

Then a report, a certificate, a declaration and a mark can sit beside that record without being asked to become one another.

That’s a modest piece of clerical stubbornness.

It is also the only thing in the pile that knows which document is the law.