F2 Tech Notes

If an Authority Having Jurisdiction (AHJ) or electrical inspector has ever informed you that you have failed your inspection or that you require a “UL or CSA Certification” or that your equipment must be “UL/CSA Certified” or “UL/CSA Labeled” we can help you. F2 Labs can provide the evaluation, testing, and label you need to turn the equipment on and turn it over to your customer – and move on to the next project. 

When someone says, “UL or CSA Certification” or that your equipment be “UL/CSA Certified” or “UL/CSA Labeled”, that means your product must be evaluated to meet the government guidelines for installation and use of the equipment at that location.  In these instances, the AHJ or inspector is asking for you to have your equipment “Field Labeled” by an OSHA approved NRTL (National Recognized Testing Laboratory) and is not asking you to specifically have Underwriters Laboratories (UL) or CSA Group (CSA) perform the evaluation.  There are many different labs that can certify products to the UL and CSA standards.  You have the freedom to use a different laboratory in almost all cases.

If you have a piece of equipment that is unlabeled and it is preventing you from starting production on your line or turning the equipment over to your customer at their site, F2 Labs can quickly quote and schedule our engineers to get you exactly what you need to get moving. We have three locations in the in the US from which to dispatch our experienced Safety Engineers to perform the UL Certification & CSA International Certification testing quickly. Additionally, we collect information from you and review it prior to our visit to reduce inefficient and costly second visits.

CONTACT F2 LABS FOR HELP, THIS IS WHAT WE DO.

Want to discuss your project with us?

You can contact us at this link. Our phone number is 877-405-1580 and we are here to help you.

Imagine this: your brand-new, bright, glistening product steps into a chamber. The door closes. Inside, it’s not the day at the spa it expected – instead – it’s a nightmare at the beach. That is Corrosion/Salt Fog Testing..

This testing is basically the same as setting your product outside a seaside condo with no shade, no maintenance, and a hurricane every day… for weeks. Why is this done? To determine if your product can survive in the kind of humid, salty, nightmare that would make even a pelican move inland.

Why We Do It? (Other than because it’s fun)

Because some standards require it and the goal is simple: duplicate years of corrosive exposure in just a few days or weeks. Think of it as time travel, but instead of visiting the Bronze Age, your product is flung into the future, where rust is king.
What do we check?
• That metal components survive the testing without turning into lace.
• That the coating stays on and intact and doesn’t peel off like last week’s sunburn.
• That fasteners remain functional, not fuse together in a salty embrace.

Typical standards that require this testing:

• MIL-STD-810H Method 509.7 – Environmental Engineering Considerations for Defense Electronics
• IEC 60068-2-11 – Environmental testing – Part 2-11: Tests – Test Ka: Salt mist
• ISO 9227 – Corrosion tests in artificial atmospheres — Salt spray tests
• UL 50E – Enclosures for Electrical Equipment, Environmental Considerations
• NEMA 250 – Enclosures for Electrical Equipment (1000 Volts Maximum)

The Test Setup

A typical salt fog chamber resembles a mix between a fridge, a sauna, and a mad scientist’s fish tank. Inside, your product gets showered with a fine mist of saltwater, usually 5% sodium chloride. That’s the same stuff in ocean water — except here, it’s 24/7 and there’s no “low tide.”
Engineers then check the product at intervals. If something is corroding, swelling, cracking, or just generally looking like it’s been rescued from the Titanic… congratulations, you’ve learned something valuable (and probably expensive).

Lessons Learned

Salt fog testing teaches us that:

1. Nature is undefeated.
2. A good protective coating is worth its weight in gold (or at least stainless steel).
3. Just because it survived in the lab doesn’t mean it’ll survive on the Jersey Shore.

---

Final Thoughts

Salt fog testing is brutal, but it’s also a love letter to durability. By the end, your product will either emerge victorious — battle-scarred but proud — or it’ll be heading back to R&D for a serious armor upgrade.

And hey, at least it got to “visit the beach,” right? Contact Us if you have a product that needs to lounge in the salty air!

Let’s talk about Essential Performance—the term that sounds like it belongs in a motivational poster but is actually a cornerstone of medical device compliance. If you’ve ever stared at a test plan wondering, “Do I really need to define this?”—this one’s for you.

What Is Essential Performance, Anyway?

According to AAMI CR500, Essential Performance is:

“Performance of a clinical function, other than related to BASIC SAFETY, where loss or degradation beyond the limits specified by the MANUFACTURER results in an unacceptable RISK.”

Translation? If your device stops doing something it’s supposed to do—and that failure could hurt someone—it’s probably Essential Performance.

It’s not about whether the device turns on or doesn’t electrocute anyone (that’s basic safety). It’s about whether it does its job in a way that keeps patients safe.

How Do You Decide What It Is?

Start with your Indications for Use. If your device is just along for the ride (think: adjunct therapy), you might not need to define Essential Performance. But if it’s delivering therapy or doing something critical—buckle up.

Then, do a risk assessment (hello, ISO 14971). Ask yourself:

•  What are the clinical functions?

•  What happens if they fail?

•  Would that be bad? Like, really bad?

If the answer is yes, congrats—you’ve got Essential Performance.

Pro tip: Don’t get lazy with vague language. “Monitor alarms” doesn’t cut it if your device doesn’t even have alarms. FDA reviewers are not fans of generic fluff.

Common Pitfalls to Avoid

Let’s be honest—this is where things get messy. Here are some classic missteps we’ve seen:

•  Skipping the risk analysis: You can’t just say “no Essential Performance” without backing it up. That’s like skipping the fire drill and hoping for the best.

•  Using generic criteria: “Device functions as intended” is not a testable metric. Be specific. Be measurable.

•  Copy-pasting from other devices: Just because it worked for Device A doesn’t mean it applies to Device B. Context matters.

•  Assuming therapy = safety: Delivering therapy doesn’t automatically mean you’ve covered Essential Performance. You still need to define it.

•  Ignoring the IFU: Your Indications for Use are the blueprint. If they say “delivers therapy,” you’re on the hook.

When You Can Say “No Essential Performance”

Yes, there are times when it’s okay to say your device doesn’t have Essential Performance. But only if:

•  The IFU clearly shows it’s not delivering therapy.

•  There are no clinical functions that could cause harm if they fail.

•  You’ve documented this with a proper risk-based rationale.

No shortcuts. No, “we just decided not to.” And definitely no “we copied this from another device.”

Real-World Examples

• Thermometer – The importance of maintaining a certain accuracy is critical because if a fever goes undetected, then fever reducer would not be given, or the person may have a serious infection go undiagnosed and untreated.
• Infusion Pumps – Accuracy is extremely important.  Administering too much or not enough of certain medications, such as Chemotherapy Drugs, can pose serious risks.
• UV light used to disinfect – If the UV level is too low, then there is the risk of the bacteria or pathogens not being killed and possibly being ingested.  If the UV is too high, there is a risk of it burning a material and possibly putting toxic gases into the air.

These aren’t guesses—they’re tied to actual risk and clinical function.

 Final Thoughts

Essential Performance isn’t just a checkbox—it’s a safety net. It’s how we ensure medical devices don’t just work, but work safely when it matters most.

So next time you write a test plan or prepare for a submission, ask yourself: What’s essential? Then prove it.

Do you have a device you’re unsure about? Do you need help defining Essential Performance criteria that won’t get flagged by reviewers? Reach out to our compliance team or submit a Contact Us form. We love a good challenge—and we’ve seen it all. Want us to feature your device in a future Tech Note? Let’s talk.

* Until August 15^th, if you mention this blog post we will offer special pricing (20% off) your full REACH and RoHS evaluation with F2 Labs. *

We evaluate your device and keep it on autopilot, painlessly.

The RoHS Directive 2011/65/EU+(EU)2015/863 started life in 2002 as the RoHS Directive 2002/95/EC. It has changed over the years, adding substances and exemptions, and all affect the compliance of your device. Likewise, manufacturers and suppliers often change both the components and materials that comprise the parts you buy from them. And they do this with no obligation to alert you.

The REACH Regulation (EC) No 1907/2006 changes every six months. ECHA always adds substances to the restricted list. They never remove substances from the list which can make it excruciating for you and your staff. Presently there are 250 substances of very high concern, also called SVHC’s. That list is here: ECHA SVHC List and it will change again in either December 2025 or January 2026. Testing for REACH and RoHS is very expensive and it can cost thousands of dollars per part, depending upon what it is and how many materials make up the part. For example, a part made with plastic and metal can easily cost $3,000 to test. Just for one part. Now, multiply that against the number of parts a manufacturer like Molex, Murata, Vishay, or TE Connectivity produces. It is easy to see that this is a monumental task for these companies that never ends. You can imagine that once they clear a “list” of SVHC’s… right around the corner another, new list is published and the testing starts all over again. Then, add in that these companies likely have their own supply challenges and it is apparent that the RoHS and REACH status of these parts changes constantly.

What happens if the composition of a part changes?

Manufacturers can change how they make their parts. Suppliers can change who they buy a part from. In both cases they are not obligated to indicate to you, the electronic device manufacturer, what changes they made. In a worst-case example a supplier can sell you a machine screw made of RoHS and REACH compliant steel and use a descriptor and part number for that screw that is unique to their system. Let’s call it, “10 mm screw, pn 123456”. You could make orders for that screw over the years, always ordering their part number 123456, without knowing if that supplier is still using the same screw that was originally evaluated for RoHS and REACH compliance.

I routinely see examples of parts that were compliant at one point in time and then are not-compliant the next time the part is used in a build under review, and vice-versa. When this happens I see the part used in the new build — but I also see that the part is used in a build by a customer that submitted the device for review in the past.

Why is this important to you?

There is no one obligated at these companies to go through your past orders and tell you if a part you ordered a year ago now maintains the same RoHS and REACH status when you make a repeat order. You need to do this and it is your responsibility to alter your build(s) and or product documentation if there are restricted substances added into any of the parts used in your machine. No matter how insignificant. Even product labels made out of paper are in scope.

How can F2 Labs help you with this?

F2 Labs is a product safety and EMC test laboratory and we assist our clients with nearly all compliance requirements for global marketing and sales. We started offering RoHS services in 2014 and added REACH a few years later. We started these services because they are legal requirements and oftentimes our customers’ customer in the EU is unaware of these laws. We load your device in our system and can maintain the integrity of the build in an ongoing basis for products you make over and over. We can also perform a one-time RoHS and REACH evaluation for a custom product you are only making once.

Machinery, control panels, and medical devices are not excluded. RoHS and REACH apply to all equipment with electric function and that includes commercial, industrial, and medical equipment. REACH also applies to non-electric products. They are not restricted to consumer goods.

F2 Labs tracks down the EU RoHS and EU REACH (and we can do this for California Prop 65 and California RoHS also) status of each and every part, terminating with a report to you that indicates the compliance status. We can also tell you which of your suppliers responded and when, who ignored the request if that happens, and most importantly – the parts that are not compliant. The EU included teeth in these laws. They can fine you per device, make you pull it from the market, or even test it in the EU and then send the bill to you. You do not want to ignore these requirements, even if your customer in the EU did not mention them.

CONTACT F2 LABS FOR HELP, THIS IS WHAT WE DO.

Want to discuss your project with us?

You can contact us at this link. Our phone number is 877-405-1580 and we are here to help you.

F2 Labs is here to help.

The U.S. Food and Drug Administration (FDA) has issued formal warning letters to two overseas third-party labs for serious violations involving data falsification, poor quality controls, and noncompliance with regulatory standards—raising red flags for medical device manufacturers that outsource premarket testing to overseas labs.

“The FDA has no room for bad actors,” said Commissioner Marty Makary, M.D., M.P.H. “False and shoddy activity jeopardizes patient access, product sponsors, and the device supply chain.”

What Happened?

After detailed inspections, the FDA found both labs—used for U.S. device submissions—violated Good Laboratory Practices (GLP) and failed to ensure test reliability.  Read the news release here

Key Violations Identified:

• Data Integrity Failures: Incomplete, inaccurate, or untraceable test records
• Weak Quality Oversight: Lack of QA systems and supervision
• Animal Welfare Lapses: Poor documentation and animal tracking in biocompatibility studies
• Training Gaps: Unqualified personnel performing critical testing tasks

These issues compromise the credibility of data submitted in FDA filings—posing risks to manufacturers and patients alike.

Implications for Manufacturers

The FDA reminds manufacturers that they remain fully responsible for the integrity of the data they’re submitting. Companies relying on these “bad actors” could face submission rejections or re-testing requirements. To mitigate risk, the FDA urges manufacturers to:

• Reevaluate submissions tied to the cited labs
• Strengthen due diligence when selecting third-party labs
• Ensure traceability of all submitted test results
• Use FDA ASCA-accredited laboratories whenever possible

If your compliance testing has gone off track, don’t worry—we’re here to support you. Let us help you bring clarity and direction back to your project in the fastest, most cost-effective way possible.  We understand that time is money.

So, manufacturers, get your cybersecurity capes on. The EU is coming for your gadgets—and it means business.

Brace Yourselves: The EU Is Mandating Cyber Hygiene for Wireless Devices

Starting August 1, 2025, the EU is tightening the screws on anything with an antenna or IP address. If your device transmits via radio and talks to the internet—even once—it now falls under the revised Radio Equipment Directive (RED 2014/53/EU). In short: your hardware just got a cybersecurity to-do list.

Yes, this applies to a wide array of products: routers, wearables, smart toys, baby monitors, fitness trackers, and any IoT thingamajig you’ve designed to be “smart.” Now it also has to be “secure.”

What’s In Scope?

If it’s radio-equipped and internet-connected, it’s in. Think:

• Smartphones, tablets, wireless cameras
• Routers and modems
• Sensors, wearables, home automation gadgets
• Basically, anything with Wi-Fi, LTE, Bluetooth, Zigbee, etc.

If it sends packets or listens for them, you should assume RED applies.

---

The Three Cyber Must-Haves

Here’s what the Directive now explicitly requires at the engineering level:

1. Network Safeguards (Art.3.3(d)) – Cybersecurity

Your device must not compromise the network it connects to. That means:

• Implement rate limiting and request throttling
• Avoid open ports and insecure default configs
• Prevent DDoS amplification (yes, that includes securing UPnP and STUN misconfigurations)
• Validate firmware updates properly—no unsigned OTA madness

Basically, stop your devices from turning into network bullies or zombie bots.

---

2. Data Protection (Art.3.3(e)) – Privacy

If your product handles any personal or location data—even if it’s indirect (say, via cloud sync or a companion app)—you need:

• Strong access control
• Data encryption at rest and in transit
• Local storage isolation
• Privacy-by-design baked into the firmware and UI

Bonus: If it’s a children’s product (e.g. smart toys or wearables), you really need to lock it down. Think COPPA-level security or higher.

---

3. Fraud Prevention (Art.3.3(f)) – Fraud Prevention

Devices that facilitate payments or virtual currency? You’re now responsible for:

• Secure user authentication (multi-factor, biometrics, hardware tokens, etc.)
• Transaction verification layers
• Anti-spoofing and tamper resistance
• No hardcoded secrets or reused cryptographic keys, please

This especially applies to mobile wallets, NFC payment gadgets, and wearables that act like debit cards.

---

But Wait—Where Are the Standards?

Here’s the fun part: no harmonized standards yet. That’s right. As of now, there’s no pre-approved checklist to mark as “compliant.”

You’ll likely need a Notified Body to evaluate compliance unless your implementation clearly aligns with best practices from:

• ETSI EN 303 645 (IoT security baseline)
• IEC 62433-1 (embedded system threat mitigation)

Translation: Just being “secure” won’t cut it unless you can prove it.

---

Non-Compliant? No CE Mark = No EU Market

If your product doesn’t meet these new cybersecurity requirements, forget about affixing that CE mark. Customs will be scanning for this, and regulators are expected to ramp up enforcement.

No CE = No sales in the EU. Period.

---

Engineering Teams:

• Audit your devices now for radio+internet exposure
• Revisit firmware and protocol stack designs with RED compliance in mind
• Document your security measures—you’ll need the paperwork
• Build with security as a core requirement, not a post-hoc patch

EU’s message to engineers: If you’re connecting it, you’re protecting it.

CONTACT F2 LABS FOR HELP, THIS IS WHAT WE DO.

Want to discuss your project with us?

You can contact us at this link. Our phone number is 877-405-1580 and we are here to help you.