If your device is intended to be hand-held or body-worn, with a output power of >50mW (16.9dBm EIRP), you generally need to do SAR testing. There are different rules for different parts of the body - in particular hand-held is less stringent than body worn (think: walkie talkies).
As I remember, you can completely skip SAR if your EIRP is <50mW (this includes “worst case” (ie maximum) antenna gain). Depending on your product, you may be able to turn down the maximum transmit power - sacrificing range - to avoid the need to do SAR at all.
We did SAR testing on the first imp, and kept our ~80mW EIRP (+17dBm output power in CCK modes, +2.5dB antenna gain) - we passed device independent testing - which has a lower maximum absorption limit) at 20mm separation as I remember. SAR testing is quite cool (they use a robot arm and a tub full of “human body simulator” goo!) but also not cheap (~$10k).
On CE: CE is self certified. There is no such thing as CE modular approval, but modules can be tested to CE specs - that just doesn’t guarantee your product will pass, it only guarantees that on a test board, the module passed product level specs. There are plenty of modules with CE marks which are obviously lying about it - eg the ESP8266 ones which note a +25dBm output power and then also say CE, which is not possible as this is 5dBm over the legal CE power levels…
People DO ship stuff with modules in it without doing intentional emitter testing, but you should speak to a lab and determine whether you think this is a good path. If you CE mark your product and can’t produce any backup that shows that you tested it to CE specs, then you may end up in a bad place. See my post back in July’15.