I can only answer this question from my point of view, so I am doing so to start the conversation, not because I expect this to be an exemplary response!
EDIT: there is a VERY good ESE answer here that I think would be of interest to anyone reading this.
Let me start by saying that I am based in the UK, and work for a small, young company (I hate the word startup) that produces products for sale worldwide.
When I first had to consider approvals and compliance for a product that I had designed I had no idea where to start. TL;DR - we partnered with UL, who advised us on the standards that they believed applied to our product, along with some practical advice. We had them test everything that they recommended and haven't had a problem since. However, our product is pretty simple. Now that I understand more about the legal enforcement and implications of the standards we tested to, I would likely go about this differently in the future (fewer tests, and do some of them internally).
Our product is an Arduino-compatible single board computer. We produced an initial run via Kickstarter and only worried about certification after the fact - in future I would do some preliminary testing in advance. At the time we ran the Kickstarter, we had raised the highest total ever in the UK (long since eclipsed by others). Through this, UL actually contacted us, basically saying "we're not a big corporate monster - we can work with small companies too" - so we decided to go with them as an established name.
Initial discussions covered lots of ground that was brand new to me:
- CE marking is something that you do as a company. It is up to you to work out what relevant standards apply to your product, test the product against them, and assuming that the product passes, you mark your product with the CE symbol (there are rules about how to do this) and keep a dossier of the test results in case anybody needs to question it in the future. UL can advise on this and do the testing on your behalf - and produce documents that go into your dossier - but they do not mark the product as CE compliant.
- As an unintentional radiator we didn't need an FCC ID for sale in the US - but we did need to comply with FCC radiated emissions standards.
- How you describe your product is important. If we had classed our product as a low voltage device we would have had to undergo surge testing - by classing it as a USB computer accessory, we didn't have to.
- Additionally, how you recommend and show your product being used is important. Our product encourages people to connect other devices (particularly crocodile clips) to the board. During testing, you have to place these in the most unfavourable position for that particular test (often spread as wide as possible in the case of radiation emission / immunity testing). By ensuring that we only show relatively short cables in any example on our website, we could test only with those cables - if we ever recommended or showed longer cables, it could be argued that we are encouraging that sort of use and should test with longer cables.
- In the UK, CE compliance is enforced by Trading Standards. They are quite busy trying to stop fake cigarettes, fake medicines, self-igniting phone chargers and exploding e-cigarettes from hitting the market. If you test and design your product well and the chance of it actually hurting anyone is very low, you're probably going to be fine. Anything that plugs in to a real computer USB socket is a good example of this - the computer should limit the output current, so even if you're slack there the worst thing you could likely achieve is to damage the USB port on the machine it is plugged into.
We ended up testing for radiated and conducted emissions, static discharge immunity, electric and magnetic field immunity. Immunity testing is an odd one. It basically says that your product has to recover to a managed "working" state after being exposed to the test conditions.
Firstly, our test engineer pointed out that measured electric and magnetic field strengths in your average large PC shop (e.g. PC World in the UK) far exceed the levels tested against in the standards we tested to. If you wanted to save time / money in the future, this is a test that you might do myself, using hired measurement equipment to ensure that you were within the specification of the test. Similarly, you can hire the test equipment for the static discharge immunity testing and easily conduct the test yourself for the cost of purchasing the relevant test standards document and building a simple rig.
Secondly, given that our equipment is not life-critical equipment, I don't see why we have to recover gracefully from an immunity test as part of designing a safe-to-sell product. I assume this is a legislative defence against REALLY terribly designed products that break easily in the hands of the consumer.
For future products, I would get an early prototype in for an initial exploratory radiated and conducted emissions test so that I could identify any potential issues and deal with them - waiting until you are close to release is a risk I wouldn't take. For immunity testing, I would likely wait until the end - unless you're talking about mains surge immunity, which I don't fancy doing any time soon! (but would look at early just in case you have a show stopper hiding in there).
As I say, this is just my experience - I would be really interested to hear from any compliance engineers out there (both inside electronics design companies and those working in test houses).
EDIT: I thought of some more things that came up during our compliance testing journey:
CE marking is about the overall safety and suitability for sale of a product. This includes lots of matters beside electromagnetic compatibility - material consideration, toxicity and huge amounts more. Again, having a knowledgable test house working for you really helps break down what is relevant and what is not
I haven't mentioned the RoHS and WEEE directives here (applicable in Europe) but those are pretty easy to self ensure through design and internal procedure design.
The "continuous transmission" requirement cannot be met with regular HTTP requests, you are expected to use every GSM slot, ignoring any higher-level protocols.
This test verifies that the emission spectra are within required parameters; this is done by moving a bandpass filter across the spectrum and writing down the power of the signal received. As moving this filter requires some time, the signal must be present for the entire duration -- interruptions could hide problems.
You are still required to follow the GSM framing and disable the amplifier between packets to verify that the sharp transitions at the packet boundaries do not translate to transmissions outside the allowed range.
The module is already approved as far as I know, so there is most likely a non-functional testing variant of the firmware that was used in that certification, so you'd have to ask the vendor for either a copy of that firmware, or a pre-flashed module that can be used for verification.
Best Answer
To Start
You're going to want some things if you can get them. First would be a spectrum analyzer with quazi-peak averaging, if you can't beg borrow or steal one of those, the test lab will have one. I suppose you could try to use your scope and FFT mode but that's nowhere near as good. Then if you can buy your self a EMI sniffer probe set, mine is the 100C from Behive Eelctronics I think it cost me $300. If you don't want to buy that then you can make a poor mans probe by taking three or four loops of wire in a coil and soldering each end to a single BNC cable. But you really should have something for a probe, because even if you can't get your own analyzer I've been in labs where they let me sit with my probe and their old outdated spectrum analyzer and try to debug my problem without charging me. Oh and get yourself some copper tape it's your friend :) Keep in mind you can rent them by the month too if you can't buy one.
Also a quick look on ebay shows you can get under 1Ghz analyzers for around $1000
Prepping:
Ok I'm guessing you didn't design your board with EMI in mind. It would be really nice if you had a nice 4 layer board, well decoupled, with power and gnd in the middle, no traces passing over split planes etc. If you don't then you should seriously weigh the cost of test chamber time VS respinning your board. Maybe your design can support a spread spectrum clock? If so great use it! I'm just trying to point out that any upfront things you do can save you a lot of money when it comes time for certification.
Know your spec:
To clear FCC you're going to need to pass 433Mhz intentional radiator testing, and Class B unintentional radiator Basically they're going to scan all the frequencies your board puts out and then show you if you're over the allowed levels. It will help if you know the rules going in so here are some links to what you'll need.
Review:
One of the nice things about most certification labs is they have experts there who can review your design and your layout to point out possible problem areas, but don't expect to be able to rely on them to solve your problems for you. I would just advise you to go in with the attitude that you really don't know what you're doing in terms of compliance. Ask for help and listen as much as you can. I don't know where you plan on going but here are some places I've used:
I've also used small independent places. They can all help you but I like to pick someplace close by so I can sneak in when I need to, no one wants a two hour trip every day while working on an emissions problem. Plus sometimes other people finish early and you can get in for half a day at half price, nice when you're on a budget.
Your first day radiated emmissions:
Ok it's your first day you're going to do a pre-scan because you have no idea if you'll pass or not. Of course you've brought your product to the lab, and if you need any cables you've brought "really really long" versions of them. If you need a USB cable to debug you'd better have a long one cause it's going under the floor and some long distance to a room outside the chamber. They're going to put your product in the chamber on a rotating table, you're going to get it up and running and then close the door.
Now this part takes a little bit, they're going to rotate your card around while moving their receiving antenna up and down. What you'll get in the end is a set of plots from different positions showing the amplitude/frequency that your card radiated. There's also going to be a line, you cross the line you fail, you don't you pass. Chances are good that on your first attempt you are going to fail, don't worry it happens all the time.
AHHHH I Failed now what?:
Ok you failed, but you got this cool map that basically shows you where you're failing. Maybe it's something obvious like the exact frequency your micro is running at. Or less obvious like why am I failing at 1.34Mhz??? Now this becomes a debugging process like anything else. Keep in mind in it's most simplistic form radiation is caused by current flowing in a loop. That creates EM fields, those fields radiate out from your board and the FCC gets angry. Your job is to track down these sources of noise and crush them.
That's why I had you make or get a probe, now you can go back into that chamber with the probe and the analyzer and slowing move the probe around your card until you find that damned 1.34Mhz. Divide and concur is the name of the game. On more complex boards you may have the luxury of turning off parts or ripping things out and testing again. Let's say you find that an opamp seems to be the source of your noise. Well unsolder it and scan again at least that will tell you the source. Things like clocks, busses, and especially external cables all make great sources of radiation (as do hastily designed boards).
Basically wash and repeat till you get an idea of where your emissions are coming from.
Fixing it:
I'll go back to prepping again, because anything you could have done is going to be less money and less painful than what you'll try now. There are so many possible causes and fixes, and it would be impossible to list them all. Some things you may try are using your copper tape to cover a component (or your board) and grounding it. Then scanning again, this is like having a shield on your board already. You could try lowering the edge rates of clocks or serial lines if it seems to be coming from that. Maybe cutting and re-routing a signal will help. External cables are always a struggle. You may want to try clip on ferrite beads, or other solutions there. Your lab should have a bunch of toys to play with as well as a variety of caps, resistors, and other strange things to try. My advice would be go for a day get the scan and try to isolate things. Then ask for help at the lab, and come back here and ask for more help.
After each change scan it with your sniffer probe, this is also something you can do back at your office / home if you have the equipment. You can work on lowering that emmission level all day and when you think you have it go back to the chamber again. Keeps the boss off your back about costs, or keeps your stress level down if you're the boss.
Don't be afraid:
The first time is always scary, I've had Jr. Engineers get stuck in testing for days trying to figure things out. That can be a nightmare scenario when that $1200 a day is coming out of your pocket. If you just take your time and divide and conquer you should be able to get it. Don't be afraid to ask for more advice again and again. If I could get half the things through that we've gotten through, then you can get your board through.
On spread spectrum:
If your board can handle it consider using a spread spectrum clock source instead of what you use today. A SS clock bascially wobbles the main clock frequency back and forth a little bit. This helps becasue the FCC measures not your peak amplitude but your quasi peak which is a way of averaging. So by wobbilng around you lower the average amplitude of your emmissions. Most of my consumer designs use this since we were always in plastic cases.
Metal Cases / Sheilding:
You can always sheild your product in one way or another. Most cheap consumer goods are in plastic boxes, and most little dev boards are open air. However many products either come in some kind of metal box or enclosure or they have individual parts on the board that are sheilded. If you've ever torn apart some electronics, then no doubt you've seen parts or sections of a circuit with a little metal box with holes in it surrounding it. You can play around with some copper tape or aluminum foil when debugging to see if that helps. Just make sure you GND it, and don't short anything! I usually put down Kapton or some other tape and then put my copper tape over that.
Going back to prepping one more time, it's often a good idea if you can to leave room and GND connections around parts or circuit sections so you can easily add a cage later if you have to. That way if you get stuck at the last minute at least you won't have to respin. A lot of times things that can be solved with a cage could be solved with a careful redesign, but not always.
Intentional Radiator:
If you have to go through this it is more expense and more of a pain in the... :) My advice for your first time since you're using a module anyway is if the module plus the antenna you're using is not pre-certified, then pick another one. Why spend your money debugging their board? To me that's the whole point of buying a module otherwise I'd just make it myself. If you decide not to, then this test is going to be similar to the one above but now they'll be looking at how your product radiates, is it within the allowed power, not interfering with adjacent bands, etc. I'm sure someone on here can explain this process better than me. I've only done it once with help.
Conducted Emissions:
I'll assume you're using a wall wart style power supply and not connecting to mains directly. If so that should make it a lot easier for you to pass conducted emissions test. Most manufactures provide plugs that at least pass the conducted portion of the emissions test, and if yours doesn't try another plug :) (thanks to @dext0rb for pointing that out)
I'm sure I've missed some things, so if you have questions let me know. I'll be happy to try to help you through your first time. I'm sure other guys will chime in as well. It's a complex area but nothing to be afraid of.