Europe raises concerns, Australia investigates: AI glasses globalization faces new compliance tests

Text/Wickey

Brands such as Rokid, INMO, and XGIMI have successively accelerated their international expansion through overseas launches, crowdfunding, and e-commerce channels. Going global means broader market space, but the regulatory systems of different countries and regions also impose different requirements on product compliance. Certification and compliance regimes such as China's CCC and SRRC, the US FCC, and the EU CE each differ, and before AI glasses enter different markets, they need to meet the corresponding market-access requirements based on product functions and local regulations.

As features such as cameras, recording, and AI visual recognition become more widespread, privacy and data security issues have also attracted more attention. On October 13, the European Data Protection Board (EDPB) issued a dedicated statement on smart glasses, focusing on devices collecting information about bystanders and the related data processing responsibilities.

For Chinese manufacturers accelerating their overseas expansion, how to adapt to the regulatory requirements of different markets is becoming an issue that requires continuous consideration in product R&D, launch, and subsequent operations.

For a product to be legally sold in the local market, it must first meet the corresponding market-access requirements. The relevant certification and conformity assessment not only relate to product safety, but also directly affect whether it can smoothly enter overseas sales channels.

At present, AI glasses come in many forms, including AI audio glasses, camera-equipped AI glasses, and AR/AI glasses with display functions, and the compliance requirements corresponding to different hardware configurations also vary. For example, Bluetooth and Wi-Fi involve radio spectrum management, built-in lithium batteries involve electrical safety, and wireless transmitting devices worn close to the head may also require RF exposure assessment. Some products adopt a split design, and the glasses body and the external computing unit also need to have their applicable certification requirements determined separately according to their respective functions and wireless configurations.

Image source: treeview

Major consumer markets worldwide have established corresponding regulatory systems for electronic products, but countries differ to some extent in certification scope, technical standards, and assessment procedures. Tuoluo has reviewed and compiled the hardware compliance certification systems of major markets such as China, the United States, the European Union, Japan, and South Korea for reference:

Image source: VR Tuoluo

In the domestic market, AI glasses mainly need to pay attention to CCC compulsory product certification, SRRC radio transmission equipment type approval, and, in specific cases, the applicable telecommunications equipment network access license. Among these, CCC is subject to catalog management, and ordinary AI and AR glasses are not separately included in the compulsory certification catalog. However, for products with independent cellular communication functions, if they meet the catalog definition of "mobile user terminals (1606)," whole-device CCC certification may be required. In addition, components such as lithium-ion batteries and power adapters used in the glasses also need to have their certification requirements determined separately according to the scope of application.

Image source: State Administration for Market Regulation

Taking a pair of AI glasses integrating display, camera, recording, audio, and wireless communication functions as an example, if they are planned to enter both the US and EU markets, manufacturers usually need to complete the applicable FCC equipment authorization and RF exposure assessment, and conduct conformity assessment in accordance with relevant EU regulations such as RED, prepare an EU Declaration of Conformity (DoC), and affix the CE mark. In addition, applicable requirements for batteries, optical safety, and environmental protection also need to be considered.

Compliance markings such as CE, UKCA, and FCC ID on the inner side of the temple of the Ray-Ban Meta Skyler smart glasses. Image source: Pawn America

Therefore, for AI glasses manufacturers targeting the global market, wireless frequency bands, hardware safety standards, and certification procedures in different regions need to be considered at the product design stage, to avoid increasing compliance assessment work later due to differences in product configurations. And as features such as cameras, recording, and AI visual recognition become more widespread, beyond traditional hardware certification, personal privacy and data protection have also become important issues in AI glasses compliance.

As privacy controversies continue to intensify, many countries and regions have begun to strengthen regulation of AI glasses. Norway recently proposed a plan to temporarily ban the use of AI glasses in certain designated places; Australia also said in September that it is considering restricting the use of camera-equipped smart glasses in government office spaces. In addition, data regulators in Italy and Austria confirmed to Reuters that they are investigating incidents involving students' use of smart glasses in schools.

Image source: VR Tuoluo

Countries differ in their regulatory priorities and implementation progress for AI glasses, involving both restrictions on device use in specific places and requirements on personal information collection, data processing, and privacy protection. Below is a compilation by VR Tuoluo of the regulatory attitudes and related compliance requirements for AI glasses in some countries and regions:

Image source: VR Tuoluo

On October 13, the European Data Protection Board (EDPB) issued the "Statement on Smart Glasses" (Statement 1/2026), specifically discussing the data protection challenges brought by smart glasses. The EDPB pointed out that although smart glasses look similar to ordinary glasses, their integrated cameras, microphones, and networking functions may collect personal information without others' knowledge. In sensitive environments such as hospitals, schools, and workplaces, such risks deserve particular attention.

In response, the EDPB recommends using obvious LED indicators, sound prompts, and other methods to let people around know that the device is recording, and emphasizes that manufacturers and service providers should bear the corresponding data protection responsibilities. For example, the Ray-Ban Meta series AI glasses are equipped with a capture indicator light, and Meta has also introduced an indicator obstruction detection mechanism to prevent covert recording.

Meanwhile, in terms of data processing, the multimodal perception capabilities of AI glasses are continuously improving, and devices may need to transmit images and audio captured by cameras and microphones to a phone or cloud model for analysis. Whether the relevant data is stored, the retention period, whether it is used for model training, and whether third-party service providers are involved may all give rise to privacy compliance issues.

Currently, AI glasses are also exploring more proactive long-term memory functions. The "All-Day Smart Memory" feature on the RayNeo iO can continuously collect voice information, automatically transcribe it, and generate daily summaries. Regarding data security, RayNeo stated that raw conversations are first anonymized and desensitized on the device side, and only desensitized structured information is uploaded when necessary; users can also manage and delete historical records.

The EDPB specifically pointed out that if manufacturers further use data originally collected for visual recognition for AI model training, they need to have a corresponding legal basis and cannot ignore the right to know and reasonable expectations of the people being filmed. In terms of product design, the EDPB also recommends prioritizing on-device processing, blurring the identity of bystanders, restricting continuous recording, and disabling unnecessary long-term image storage by default, so as to minimize the collection and use of third-party personal information.

Image source: EDPB

China's Personal Information Protection Law also classifies biometric, medical health, and other information as sensitive personal information and requires stricter protection measures. The Security Management Measures for the Application of Face Recognition Technology, which took effect in June 2025, further regulates the collection and use of facial information and requires application entities whose stored facial information reaches 100,000 people to complete filing procedures in accordance with the law.

English text is being prepared.

The actual operation of smart glasses after launch also involves hardware brands, software developers, cloud service providers, and retail channels. Even if a product has already entered the local market, the data processing activities of its companion app may still trigger regulatory investigations and affect sales channels.

Recently, the removal of smart glasses from the shelves by Australian retailer Kmart attracted attention. On October 7, the Office of the Australian Information Commissioner (OAIC) announced an investigation into the HeyCyan app developed by the Chinese company Shenzhen Qingcheng Future Technology Co., Ltd.; the app is used in products such as the Anko smart glasses sold by Kmart for AUD 89.

OAIC investigation announcement. Image source: OAIC

Because no response was received from the HeyCyan developer, the regulator decided to launch a formal investigation. Subsequently, Kmart stopped online sales of the relevant products. Previously, the OAIC had also sent inquiries to Meta, Google, Kmart, and relevant software developers, asking them to explain how smart glasses record information, who can access these data, and where the data is stored.

On September 11 this year, the reporting obligations of the EU Cyber Resilience Act (CRA) regarding security vulnerabilities and serious security incidents officially began to apply. Under the rules, manufacturers within scope are generally required to submit an initial early warning within 24 hours after discovering an actively exploited vulnerability or a serious security incident, and to provide a further report within 72 hours. The CRA's main product safety requirements will apply from December 11, 2027, covering aspects such as cybersecurity risk assessment, secure development, vulnerability handling, and software updates.

EU CRA reporting deadlines. Image source: CRA

China's security management for network products is also being continuously improved. As early as the Provisions on the Management of Security Vulnerabilities in Network Products, which took effect in 2021, network product providers were explicitly required to report information to the relevant platform of the Ministry of Industry and Information Technology within two days after discovering or learning of a security vulnerability, and to promptly organize repairs. On this basis, the revised Cybersecurity Law, which takes effect on January 1, 2026, further strengthens the legal liability for related illegal acts. For enterprises that fail to take timely vulnerability remediation measures, fail to fulfill notification and reporting obligations as required, and cause particularly serious cybersecurity consequences, a maximum fine of 10 million yuan may be imposed.

Image source: Cyberspace Administration of China

At present, the core functions of many products rely on operating systems, mobile apps, and cloud AI services, and devices will continue to receive software updates and feature iterations after delivery. Once a security vulnerability appears in the relevant components, manufacturers also need to promptly carry out risk assessments, vulnerability remediation, and necessary information disclosure in accordance with applicable regulations.

Final notes

As an emerging consumer electronic product, AI glasses have not yet formed a unified dedicated certification system. Existing standards can cover basic requirements such as wireless communication and battery safety, but as camera, recording, and AI recognition functions continue to enrich, issues such as bystander privacy, data storage, and cloud processing are also testing the existing regulatory system.

For manufacturers, in addition to obtaining the necessary hardware certifications, they also need to clarify how data is collected, stored, and used, and who is responsible for fixing software vulnerabilities. Problems in any link may trigger regulatory investigations and even affect product sales.

Submissions/tips: tougao@youxituoluo.com

Article/business cooperation: Lin Nan (WeChat 19250561593)

Join the industry exchange group: Lin Nan (WeChat 19250561593)

English text is being prepared.

Metaverse Digital Industry Service Platform

English text is being prepared.